CmdID

CmdID / Techniques / T1588

T1588.002 Obtain Capabilities: Tool

Adversaries may buy, steal, or download software tools that can be used during targeting. MITRE ATT&CK

3 Sigma rules T1588.002 on attack.mitre.org

Part of

MITRE ATT&CK
T1588Obtain Capabilities

Sigma rules tagged with it

process creation, the highest levels first
highHacktool Execution - PE MetadataFlorian Roth (Nextron Systems) · Windows
highRenamed SysInternals DebugView ExecutionFlorian Roth (Nextron Systems) · Windows
lowPotential Execution of Sysinternals ToolsMarkus Neis · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Get detailed information and accept this command's End-User License Agreement (EULA) on the page for gethelpcmd-expertexperienceadmintask

GetHelpCmd.exe -S ExpertExperienceAdminTask -AcceptEulaIdentify

Get detailed information and save the logs to a specific directory on the page for gethelpcmd-expertexperienceadmintask

GetHelpCmd.exe -S ExpertExperienceAdminTask -AcceptEula -LogFolder path\to\directoryIdentify

Get detailed information without showing the progress on the page for gethelpcmd-expertexperienceadmintask

GetHelpCmd.exe -S ExpertExperienceAdminTask -AcceptEula -HideProgressIdentify

Automatically fix activation-related errors, close Office, and accept this command's End-User License Agreement (EULA). Requires Administrator privileges to do so on the page for gethelpcmd-officeactivationscenario

GetHelpCmd.exe -S OfficeActivationScenario -AcceptEula -CloseOfficeIdentify

Detach the currently-installed Office licensing scheme from Shared Computer Activation (SCA), and activate the product separately. Requires Administrator privileges to do so on the page for gethelpcmd-officeactivationscenario

GetHelpCmd.exe -S OfficeActivationScenario -AcceptEula -CloseOffice -RemoveSCAIdentify

Analyze the calendar for the current, active profile, and accept this command's End-User License Agreement (EULA) on the page for gethelpcmd-outlookcalendarchecktask

GetHelpCmd.exe -S OutlookCalendarCheckTask -AcceptEulaIdentify

Analyze calendar for a specific Outlook profile on the page for gethelpcmd-outlookcalendarchecktask

GetHelpCmd.exe -S OutlookCalendarCheckTask -AcceptEula -P profileIdentify

Analyze the calendar for a specific profile and save the logs to a specific directory on the page for gethelpcmd-outlookcalendarchecktask

GetHelpCmd.exe -S OutlookCalendarCheckTask -AcceptEula -P profile -LogFolder path\to\directoryIdentify

Analyze the calendar for a specific profile without showing the progress on the page for gethelpcmd-outlookcalendarchecktask

GetHelpCmd.exe -S OutlookCalendarCheckTask -AcceptEula -P profile -HideProgressIdentify

Run the troubleshooter, close Outlook, and accept this command's End-User License Agreement (EULA) on the page for gethelpcmd-teamsaddinscenario

GetHelpCmd.exe -S TeamsAddinScenario -AcceptEula -CloseOutlookIdentify

To install Sysmon with default settings, run the following command on the page for sysmon

sysmon -accepteula -iIdentify

To install Sysmon with a configuration file, run the following command on the page for sysmon

sysmon -accepteula -i c:\windows\config.xmlIdentify

An example is here when CmdID’s reading of it names T1588.002: a Sigma rule it trips is tagged with it, or its abuse is documented as it.